hardMultiple ChoiceObjective-mapped
350-701 Practice Question: Refer to the exhibit
Exhibit
show running-config | section policy-map policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rpc inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect xdmcp inspect sip inspect pptp inspect icmp inspect icmp error inspect ip-options class class-default set connection advanced-options UMBC_Inside
Refer to the exhibit. An administrator notices that DNS responses larger than 512 bytes are being dropped. Which configuration change should be made to allow larger DNS responses?
⚠ Common exam trap
Cisco often tests the misconception that ACLs or removing inspection policies are the solution for application-layer drops, when in fact the issue is a specific inspection parameter (DNS message-length) that must be tuned via a DNS map.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the message-length maximum under the DNS map
DNS inspection on Cisco ASA/Firepower devices uses a DNS map to enforce a default maximum message length of 512 bytes, which aligns with the original DNS specification (RFC 1035). To allow larger DNS responses (e.g., those using EDNS0, which can exceed 512 bytes), you must increase the message-length maximum under the DNS map. This change permits the firewall to reassemble and forward DNS packets that exceed the default limit without dropping them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the DNS inspection policy
Why it's wrong here
Removing inspection would disable all DNS inspection, which may be undesirable.
- ✗
Add an access-list to permit the traffic
Why it's wrong here
Access-lists control traffic flow but do not affect DNS inspection limits.
- ✗
Disable the set connection advanced-options command
Why it's wrong here
Advanced connection options are unrelated to DNS message length.
- ✓
Increase the message-length maximum under the DNS map
Why this is correct
Raising the limit (e.g., to 4096) allows larger DNS responses.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.