hardMultiple ChoiceObjective-mapped
CISA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` ! Cisco ASA configuration snippet access-list OUTSIDE_IN extended permit tcp any host 203.0.113.10 eq www access-list OUTSIDE_IN extended permit tcp any host 203.0.113.10 eq https access-list OUTSIDE_IN extended deny ip any any log ! object network WEB_SERVER host 203.0.113.10 nat (inside,outside) source static any any destination static WEB_SERVER WEB_SERVER no-proxy-arp route-lookup ! ```
Refer to the exhibit. A security administrator is troubleshooting why external users cannot reach the web server at 203.0.113.10 from the internet. Based on the configuration, what is the MOST likely issue?
⚠ Common exam trap
Many exam-takers assume a NAT rule alone is sufficient for inbound traffic, overlooking the Layer 2 requirement that the ASA must respond to ARP for the public IP via proxy ARP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'no-proxy-arp' option prevents the ASA from responding to ARP requests for the public IP
The 'no-proxy-arp' command disables proxy ARP on the ASA interface for the public IP address 203.0.113.10. Without proxy ARP, the ASA will not respond to ARP requests from upstream routers for that IP, so traffic destined to the web server is never delivered to the ASA for NAT processing. This is the most likely cause because the NAT rule exists but the ASA cannot intercept the traffic at Layer 2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No NAT rule is configured for the web server
Why it's wrong here
A NAT rule exists.
- ✓
The 'no-proxy-arp' option prevents the ASA from responding to ARP requests for the public IP
Why this is correct
Without proxy ARP, the ASA does not claim the public IP, so traffic is not received.
- ✗
The source address is not translated
Why it's wrong here
Source translation is not required for inbound traffic; destination translation is the issue.
- ✗
The access list denies incoming web traffic
Why it's wrong here
The ACL permits tcp to port 80 and 443.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.