mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` %ASA-6-302013: Built outbound TCP connection 1234 for outside:203.0.113.1/80 (203.0.113.1/80) to inside:192.168.1.100/54832 ```
Refer to the exhibit. A security analyst sees this syslog message from the ASA. Which statement best describes what is occurring?
⚠ Common exam trap
Cisco often tests the distinction between 'built' (connection established) and 'denied' (traffic blocked) syslog messages, and candidates may confuse the direction of traffic by misreading the source/destination IPs or assuming all external IPs are attackers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An external host is connecting to an internal host
The syslog message shows a built connection from an external IP address (10.10.10.10) to an internal host (192.168.1.100) on port 80. The ASA logs 'built inbound TCP connection' when a new TCP session is established from a lower-security interface (outside) to a higher-security interface (inside), which requires an ACL or NAT rule to permit. This indicates an external host is connecting to an internal host, not an inside host initiating outbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An inside host is initiating a connection to a web server
Why it's wrong here
The log shows the connection is built from outside to inside, but the 'outbound' keyword indicates it's a response to an internal request.
- ✗
Traffic is being denied by the access list
Why it's wrong here
The message is a 'Built' connection, meaning it was allowed.
- ✓
An external host is connecting to an internal host
Why this is correct
The log shows the connection from outside to inside.
- ✗
The connection is being torn down
Why it's wrong here
The message indicates the connection is built, not torn.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.