mediumMultiple ChoiceObjective-mapped

200-201 Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

```
%ASA-4-106023: Deny tcp src outside:10.0.0.10/54321 dst inside:192.168.1.100/80 by access-group "OUTSIDE_IN"
%ASA-4-106023: Deny tcp src outside:10.0.0.10/54322 dst inside:192.168.1.100/80 by access-group "OUTSIDE_IN"
%ASA-4-106023: Deny tcp src outside:10.0.0.10/54323 dst inside:192.168.1.100/80 by access-group "OUTSIDE_IN"
```

Refer to the exhibit. A security analyst observes these syslog messages from an ASA firewall. Based on the messages, which type of activity is most likely occurring?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

An external host scanning internal hosts for open port 80

The syslog messages show multiple connection attempts from the same external source IP to different internal destination IP addresses on port 80, with varying source ports. This pattern is characteristic of a port scan, specifically an external host scanning internal hosts for open port 80. Option A is incorrect because the traffic originates from outside, not inside. Option B is incorrect because a denial of service attack typically overwhelms the firewall with many packets or targets multiple ports, not a sequential scan. Option D is incorrect because the messages indicate connection attempts, not successful established connections.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
An inside host attempting to access a web server on the outside
Why it's wrong here
The src is outside, so it is an external host targeting an internal server.
✗
A denial of service attack flooding the firewall
Why it's wrong here
A DoS would likely involve many different sources or cause performance impact, not just three attempts.
✓
An external host scanning internal hosts for open port 80
Why this is correct
Multiple connection attempts to the same IP and port indicate a scan.
✗
Successful web traffic from an external client
Why it's wrong here
The syslog says 'Deny', so traffic is blocked, not successful.

Go deeper

200-201 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question