easyMultiple ChoiceObjective-mapped

200-201 Practice Question: Based on the exhibit, which type of traffic is…

Exhibit

Refer to the exhibit.
Mar 1 12:34:56.789: %ASA-4-106023: Deny udp src inside:10.1.1.10/12345 dst outside:203.0.113.5/53 by access-group "OUTSIDE_IN" [0x0, 0x0]

Based on the exhibit, which type of traffic is being denied?

⚠ Common exam trap

Cisco often tests the distinction between UDP and TCP for DNS traffic, leading candidates to assume that all DNS traffic uses UDP, when in fact DNS can use TCP for larger responses or zone transfers, and the ACL only blocks UDP.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

UDP traffic from an internal host to an external DNS server.

The exhibit shows an access control list (ACL) entry that denies UDP traffic from any source to any destination with a destination port of 53, which is the standard port for DNS. Since the ACL is applied inbound on an interface facing the internal network, it specifically blocks UDP traffic originating from an internal host destined for an external DNS server. This matches option C exactly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Traffic permitted by the access group.
Why it's wrong here
The log says 'Deny', so it is blocked, not permitted.
✗
TCP traffic to a DNS server.
Why it's wrong here
The log indicates UDP, not TCP.
✓
UDP traffic from an internal host to an external DNS server.
Why this is correct
The log matches UDP from inside to outside port 53.
✗
ICMP traffic from an external host.
Why it's wrong here
The log shows UDP and source is inside, not ICMP.

Visual reference

Go deeper

200-201 Practice Question: Based on the exhibit, which type of traffic is…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question