mediumMultiple ChoiceObjective-mapped
Cisco CyberOps Associate: Cisco ASA Syslog Deny — Interpreting External Inbound Block
Exhibit
Refer to the exhibit. ``` Mar 1 12:34:56 192.168.1.100 %ASA-4-106023: Deny tcp src outside:10.0.0.1/54321 dst inside:192.168.1.100/80 by access-group "OUTSIDE_IN" [0x0, 0x0] ```
Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?
Quick Answer
The correct answer is that an external host attempted to connect to an internal web server and was blocked. This is determined by the ASA syslog deny interpretation, where the message shows a deny action for traffic from source IP 10.10.10.10 (external) to destination 192.168.1.100 (internal) on TCP port 443, which is HTTPS. The access-group 'OUTSIDE_IN' applied to the outside interface confirms the packet was blocked by an ACL entry, not by a stateful inspection or NAT failure. On the Cisco CyberOps Associate 200-201 exam, this tests your ability to read ASA syslog messages and map them to real-world security events, often appearing in scenario-based questions where you must distinguish between inbound blocks and outbound denies. A common trap is confusing the source and destination IPs—remember that external IPs are typically public or non-RFC1918 addresses, while internal IPs like 192.168.x.x are private. For a quick memory tip, think "Deny on Outside In = Blocked from the internet to your LAN."
⚠ Common exam trap
Cisco often tests the ability to interpret syslog message fields (source/destination IPs and ports) to determine traffic direction and action, and the trap here is assuming that any syslog message from an ASA implies a permitted connection, when the 'deny' keyword clearly indicates a block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An external host attempted to connect to an internal web server and was blocked.
The syslog message shows a deny action for traffic from an external IP (10.10.10.10) to an internal IP (192.168.1.100) on TCP port 443 (HTTPS). The access-group 'OUTSIDE_IN' is applied to the outside interface, and the deny indicates the packet was blocked by an ACL entry. This matches the scenario of an external host attempting to connect to an internal web server and being blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The access-group 'OUTSIDE_IN' permitted the traffic.
Why it's wrong here
Deny indicates blocked.
- ✗
An internal host attempted to connect to an external web server.
Why it's wrong here
Source is outside, destination is inside.
- ✓
An external host attempted to connect to an internal web server and was blocked.
Why this is correct
Matches the deny action and direction.
- ✗
The ASA allowed the connection because it is a stateful firewall.
Why it's wrong here
Log says 'Deny'.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An analyst sees these syslog messages from the Cisco ASA. What is the most likely cause?
medium- A.An external host attempting to connect to an internal server.
- B.A denial-of-service attack from the external IP.
- ✓ C.An internal host (10.0.0.10) is attempting to access the Internet on port 80 and is being blocked.
- D.An internal host is performing a port scan of the external server.
Why C: The syslog messages show the Cisco ASA denying traffic from internal IP 10.0.0.10 to external destination 203.0.113.5 on TCP port 80. The ASA's access control list (ACL) is configured to block outbound HTTP traffic from this host, which is the most likely cause of the denial. The messages indicate a standard deny action, not a signature-based attack detection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.