The correct answer is that an inbound UDP packet from an external source to an internal destination was denied. This is determined by parsing the Cisco ASA syslog message, which explicitly lists the protocol as UDP, the direction as inbound (from a lower-security outside interface to a higher-security inside interface), and the action as “denied” due to the access-group “OUTSIDE_IN” applied to the outside interface. On the Cisco CyberOps Associate 200-201 exam, this type of question tests your ability to read and interpret ASA syslog messages for denied traffic, a core skill for security monitoring and incident response. A common trap is confusing the source and destination IPs or misreading the protocol—remember that the ASA always logs the denied packet’s original direction, so “outside” source and “inside” destination means inbound. Memory tip: “UDP denied, outside tried inside” — focus on the protocol, the word “denied,” and the interface pair to avoid the trap.
200-201 Security Monitoring Practice Question
This 200-201 practice question tests your understanding of security monitoring. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
%ASA-4-106023: Deny udp src outside:10.0.0.1/53 dst inside:192.168.1.100/12345 by access-group "OUTSIDE_IN" [0x0, 0x0]
Based on the Cisco ASA syslog message, what does this event indicate?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An inbound UDP packet from an external source to an internal destination was denied.
The syslog message indicates that an inbound UDP packet from an external source to an internal destination was denied by the Cisco ASA. The message includes the source and destination IP addresses and ports, and the action is 'denied' due to the access-group 'OUTSIDE_IN' applied to the outside interface. This matches option B, which correctly identifies the denied inbound UDP traffic.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
A DNS response from an external server to an internal client was allowed.
Why it's wrong here
The message indicates 'Deny', not allow.
✓
An inbound UDP packet from an external source to an internal destination was denied.
Why this is correct
The syslog clearly states 'Deny udp src outside:... dst inside:...'.
Related concept
Read the scenario before looking for a memorised answer.
✗
The access-group "OUTSIDE_IN" is misconfigured.
Why it's wrong here
The message does not indicate misconfiguration; the deny could be by design.
✗
An outbound UDP connection was denied.
Why it's wrong here
The source is outside, so it is an inbound packet, not outbound.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the ability to distinguish between inbound and outbound traffic based on source/destination IPs in syslog messages, leading candidates to confuse the direction when the access-group name suggests an inbound policy but the traffic flow is misinterpreted.
Detailed technical explanation
How to think about this question
The Cisco ASA syslog message format for denied traffic includes the action 'denied' and the interface/access-group that enforced the rule. The access-group 'OUTSIDE_IN' is applied inbound on the outside interface, meaning it filters traffic entering the network from the internet. In real-world scenarios, such denials often result from missing or overly restrictive ACL entries, and administrators must verify the ACL order and implicit deny at the end.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Monitoring — This question tests Security Monitoring — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: An inbound UDP packet from an external source to an internal destination was denied. — The syslog message indicates that an inbound UDP packet from an external source to an internal destination was denied by the Cisco ASA. The message includes the source and destination IP addresses and ports, and the action is 'denied' due to the access-group 'OUTSIDE_IN' applied to the outside interface. This matches option B, which correctly identifies the denied inbound UDP traffic.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which type of traffic is being denied?
easy
A.Traffic permitted by the access group.
B.TCP traffic to a DNS server.
✓ C.UDP traffic from an internal host to an external DNS server.
D.ICMP traffic from an external host.
Why C: The exhibit shows an access control list (ACL) entry that denies UDP traffic from any source to any destination with a destination port of 53, which is the standard port for DNS. Since the ACL is applied inbound on an interface facing the internal network, it specifically blocks UDP traffic originating from an internal host destined for an external DNS server. This matches option C exactly.
Last reviewed: Jun 25, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.