mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: Refer to the exhibit
Exhibit
zone-pair security ZP_INSIDE_OUT source INSIDE destination OUTSIDE service-policy type inspect INSIDE_OUT_POLICY ! class-map type inspect match-any DMZ_OUT_TRAFFIC match protocol tcp match protocol udp ! policy-map type inspect DMZ_OUT_POLICY class type inspect DMZ_OUT_TRAFFIC inspect class class-default drop
Refer to the exhibit. An administrator has configured the router with zone-based firewall rules. Traffic from the DMZ zone to the OUTSIDE zone is being dropped, although traffic from the INSIDE zone to the OUTSIDE zone flows normally. The DMZ zone is configured with security-level 50 and the INSIDE zone with 100. What is the most likely cause of the dropped traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No zone-pair is defined for traffic from DMZ to OUTSIDE
The most likely cause is that no zone-pair is defined for traffic from DMZ to OUTSIDE. In zone-based firewall, traffic between zones is implicitly denied unless a zone-pair with a service policy is configured. Since only INSIDE to OUTSIDE has a zone-pair, DMZ to OUTSIDE traffic is dropped by default. Option B is correct. Option A is incorrect because the inspect action, while missing, would not help if no policy is applied. Option C is incorrect because the class-default applies only within the applied policy. Option D is incorrect because security-levels are not used in ZBFW.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The inspect action is not applied to the DMZ traffic class
Why it's wrong here
The class-map includes TCP and UDP, and the inspect action is present; the issue is the lack of zone-pair assignment.
- ✓
No zone-pair is defined for traffic from DMZ to OUTSIDE
Why this is correct
The zone-pair is only defined for source INSIDE to destination OUTSIDE, leaving DMZ traffic without any policy.
- ✗
The class-default action in the policy-map drops all traffic from DMZ
Why it's wrong here
The class-default action is only applied if the policy-map is associated with a zone-pair, which is not the case for DMZ.
- ✗
The DMZ has a lower security-level than the INSIDE zone, causing traffic to be implicitly denied
Why it's wrong here
Zone-based firewall does not use security-levels; access is controlled solely by zone-pair policies.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.