200-201 Security Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Whether the ASA is failing over to the standby unit

  Why it's wrong here

  Failover events generate their own syslog messages, such as 105001 or 105003, and are not represented by 106023. Message 106023 is a per-packet ACL denial and does not indicate a high-availability state change. Investigating failover status would not explain why inbound TCP to port 443 is being dropped. The analyst should correlate with ACL configuration and interface status, not with failover logs that describe a different class of event.

• ✗

  Whether the external address is a known malicious scanner

  Why it's wrong here

  While the external address could be a scanner, the scenario states that the web server is expected to receive inbound HTTPS traffic. The denial affects any client, including legitimate users, because the ACL is blocking port 443. Treating the event purely as a scanning attempt ignores the availability impact on the intended service. The analyst should first determine whether the ACL is correct, then evaluate the source reputation if the traffic is unexpected.

• ✗

  Whether the web server has a valid TLS certificate installed

  Why it's wrong here

  A certificate problem would not generate ASA message 106023, which is specifically an ACL denial at the packet-filtering stage. The connection never reached the web server, so TLS negotiation and certificate validation never occurred. Investigating the certificate would be irrelevant to the logged event. The analyst should focus on why the firewall dropped the packet, not on application-layer configuration that only matters after the packet is permitted through the interface.

• ✓

  Whether the access control list is blocking legitimate inbound HTTPS

  Why this is correct

  Message 106023 indicates that a packet was denied by an ACL, and the destination port 443 with an expected inbound service strongly suggests a misconfigured or overly restrictive ACL. The analyst should review the interface ACL and any object group references to confirm whether the web server's public address is permitted. If the server is meant to receive HTTPS from the internet, the denial represents an availability issue rather than an attack, and the ACL must be corrected.