200-201 Security Monitoring Practice Question
An analyst is examining a firewall log entry: '2023-10-25 14:30:00 ACTION=DENY SRC=10.0.0.5 DST=203.0.113.50 PROTO=TCP SPT=445 DPT=445'. Which statement best describes this event?
⚠ Common exam trap
Cisco often tests the ability to interpret firewall log fields (SRC, DST, ACTION, PROTO, SPT, DPT) and map them to network directionality, where candidates mistakenly reverse source/destination or confuse port numbers with unrelated protocols like DNS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An internal host attempted to establish an SMB connection to an external IP and was blocked.
The log entry shows a deny action for traffic from internal IP 10.0.0.5 to external IP 203.0.113.50 on TCP port 445, which is the default port for SMB (Server Message Block) protocol. Since the source is internal (RFC 1918 address) and the destination is external, this indicates an outbound connection attempt that was blocked by the firewall. SMB is commonly used for file sharing and is often restricted outbound to prevent data exfiltration or malware propagation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An internal host attempted to establish an SMB connection to an external IP and was blocked.
Why this is correct
Port 445 is SMB, and the DENY action confirms the firewall dropped the session. The log shows an internal host (10.0.0.5) initiating TCP/445 toward an external address, so the outbound SMB connection attempt was blocked.
- ✗
A DNS query was made from an internal host to an external server.
Why it's wrong here
The log shows PROTO=TCP with source and destination port 445, not UDP port 53, so no DNS query occurred. It is tempting because DNS is a common firewall-log event, but the protocol and port fields identify SMB traffic instead, and DNS would show DPT=53.
- ✗
An external host attempted to access an internal SMB server on port 445 and was blocked.
Why it's wrong here
The source 10.0.0.5 is an internal RFC 1918 address and the destination 203.0.113.50 is external, so the direction is reversed: an internal host sent traffic outbound to port 445, which the firewall denied. It is tempting because port 445 does indicate SMB, but the addresses contradict the stated direction.
- ✗
An internal host successfully connected to an external server on port 445.
Why it's wrong here
ACTION=DENY means the firewall blocked the connection, so no successful session was established. It is tempting because port 445 and the addresses match an SMB connection attempt, but the deny action contradicts success; an ACCEPT or ALLOW entry would be required to describe a completed connection.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.