mediumMultiple ChoiceObjective-mapped
200-201 Syslog Analysis Practice Question
Exhibit
Refer to the exhibit. %SEC-6-IPACCESSLOGP: list OUTSIDE denied tcp 10.10.10.5(80) -> 192.168.1.10(49152) 1 packet
Refer to the exhibit. This syslog message is generated from a Cisco firewall. According to the security policy, all traffic from the 10.10.10.0/24 network to the internal 192.168.1.0/24 network must be denied except for HTTP traffic from specific IPs. Which of the following should be investigated?
⚠ Common exam trap
A common misinterpretation is to see a deny action for traffic from a blocked subnet and assume it is correct. However, because the policy includes an exception for HTTP traffic from specific IPs, the denial actually indicates a potential misconfiguration or missing entry in the exception list, prompting investigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The source IP 10.10.10.5 should be allowed to pass HTTP traffic.
The syslog message indicates a deny action for HTTP traffic from 10.10.10.5 to 192.168.1.10 on port 80. The security policy states that all traffic from the 10.10.10.0/24 subnet to the 192.168.1.0/24 subnet is denied, except for HTTP traffic from specific IP addresses. The denial of this packet implies that 10.10.10.5 is not on the exception list. Therefore, the source IP 10.10.10.5 should be investigated to determine if it should be added to the permitted list, making option D correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The packet was permitted but logged.
Why it's wrong here
The message clearly says "denied", not permitted.
- ✗
The packet was denied because it was HTTP traffic from 10.10.10.5.
Why it's wrong here
The denial is what triggered the log, but it doesn't indicate an investigation point.
- ✗
The destination IP 192.168.1.10 is compromised.
Why it's wrong here
There is no evidence of compromise from this log.
- ✓
The source IP 10.10.10.5 should be allowed to pass HTTP traffic.
Why this is correct
This IP might be one that should be permitted per policy; its denial warrants investigation.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.