easyMultiple Choice
Firewall Log Analysis — Interpreting Denied Connections
Exhibit
%SEC-6-IPACCESSLOGP: list inbound denied tcp 192.0.2.10(12345) -> 10.0.1.1(22), 1 packet
Refer to the exhibit. What does this syslog message indicate?
Quick Answer
The answer is a denied SSH connection attempt. This is correct because the syslog message shows a failed login on localport 22, which is the default port for SSH, and the failure indicates the connection was denied rather than established. In firewall log analysis, port numbers are the key differentiators: port 22 always points to SSH, while port 23 would indicate Telnet. On the Cisco CyberOps Associate 200-201 exam, this type of question tests your ability to interpret syslog messages and map them to specific denied connections, a core skill for security monitoring. A common trap is confusing failed SSH logins with Telnet attempts, so always check the port number first. Memory tip: “22 is SSH, 23 is Telnet—if login fails on 22, it’s SSH denied.”
⚠ Common exam trap
Test-takers frequently confuse the 'Login failed' message with a generic 'denied' message, but Cisco specifically tests the ability to identify the protocol by the port number (22 for SSH vs. 23 for Telnet) in the syslog output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Denied SSH connection attempt
The syslog message '%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 10.1.1.1] [localport: 22]' indicates a failed login attempt on port 22, which is the default port for SSH. Since the message explicitly shows 'localport: 22' and the login failed, it corresponds to a denied SSH connection attempt, not a successful one or a Telnet attempt (which uses port 23).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Failed telnet attempt
Why it's wrong here
A failed telnet attempt is logged by the telnet daemon or AAA service on the destination host, not by the device emitting this syslog message, so the message does not describe one. Telnet failure analysis fits logs showing authentication rejections on port 23.
- ✓
Denied SSH connection attempt
Why this is correct
The syslog message records that the firewall or access control denied an inbound SSH connection attempt, meaning TCP port 22 traffic was blocked. It reflects a rejected connection rather than a successful login or an established session.
- ✗
Successful SSH connection
Why it's wrong here
A syslog entry recording an accepted inbound TCP session on port 22 indicates the firewall permitted the connection, not that authentication succeeded; SSH banner and key-exchange messages would be needed to confirm a completed session. It tempts because port 22 is SSH's well-known port, so any port-22 log is easily mistaken for a successful login.
- ✗
Allowed TCP traffic
Why it's wrong here
The message records a session being built or denied against a specific port, so it cannot evidence permitted TCP traffic generally; a firewall allow log naming TCP and an action of permit would. Port 443 tempts because HTTPS traffic is routinely allowed, but the logged protocol and action here contradict that reading.
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. What does this firewall log entry indicate?
medium- A.Outbound HTTP connection denied
- B.Inbound HTTP connection allowed
- ✓ C.Inbound HTTP connection denied
- D.Outbound HTTP connection allowed
Why C: The firewall log entry shows a packet with source IP 203.0.113.5 (external) and destination IP 10.0.0.2 (internal) on destination port 80 (HTTP). The action is 'DENY' and the direction is 'inbound', indicating an inbound HTTP connection attempt from an external host to an internal host that was denied by the firewall.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.