easyMultiple ChoiceObjective-mapped
Firewall Log Analysis — Interpreting Denied Connections
Exhibit
%SEC-6-IPACCESSLOGP: list inbound denied tcp 192.0.2.10(12345) -> 10.0.1.1(22), 1 packet
Refer to the exhibit. What does this syslog message indicate?
Quick Answer
The answer is a denied SSH connection attempt. This is correct because the syslog message shows a failed login on localport 22, which is the default port for SSH, and the failure indicates the connection was denied rather than established. In firewall log analysis, port numbers are the key differentiators: port 22 always points to SSH, while port 23 would indicate Telnet. On the Cisco CyberOps Associate 200-201 exam, this type of question tests your ability to interpret syslog messages and map them to specific denied connections, a core skill for security monitoring. A common trap is confusing failed SSH logins with Telnet attempts, so always check the port number first. Memory tip: “22 is SSH, 23 is Telnet—if login fails on 22, it’s SSH denied.”
⚠ Common exam trap
Test-takers frequently confuse the 'Login failed' message with a generic 'denied' message, but Cisco specifically tests the ability to identify the protocol by the port number (22 for SSH vs. 23 for Telnet) in the syslog output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Denied SSH connection attempt
The syslog message '%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 10.1.1.1] [localport: 22]' indicates a failed login attempt on port 22, which is the default port for SSH. Since the message explicitly shows 'localport: 22' and the login failed, it corresponds to a denied SSH connection attempt, not a successful one or a Telnet attempt (which uses port 23).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Failed telnet attempt
Why it's wrong here
Telnet uses port 23, not 22.
- ✓
Denied SSH connection attempt
Why this is correct
The destination port 22 (SSH) was denied.
- ✗
Successful SSH connection
Why it's wrong here
The log says 'denied', not successful.
- ✗
Allowed TCP traffic
Why it's wrong here
The log explicitly states 'denied'.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. What does this firewall log entry indicate?
medium- A.Outbound HTTP connection denied
- B.Inbound HTTP connection allowed
- ✓ C.Inbound HTTP connection denied
- D.Outbound HTTP connection allowed
Why C: The firewall log entry shows a packet with source IP 203.0.113.5 (external) and destination IP 10.0.0.2 (internal) on destination port 80 (HTTP). The action is 'DENY' and the direction is 'inbound', indicating an inbound HTTP connection attempt from an external host to an internal host that was denied by the firewall.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.