hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A medium-sized enterprise uses a Cisco ASA…
A medium-sized enterprise uses a Cisco ASA firewall configured with multiple security zones (Inside, Outside, DMZ). The DMZ hosts a web server that must be accessible from the Internet on TCP 443. The Inside network (10.0.0.0/24) hosts internal clients. The web server has IP 172.16.0.10. The firewall's current rules: allow any from Outside to DMZ on TCP 443; allow any from Inside to Outside; deny all else. Recently, the security team noticed that an attacker compromised the web server and used it to launch an attack against an internal database server at 10.0.0.50. The attack was successful because the firewall allowed traffic from the DMZ to the Inside. The firewall's default behavior is to deny traffic from lower security zones to higher security zones (DMZ is lower than Inside). What is the MOST likely reason this traffic was allowed?
⚠ Common exam trap
ISC2 often tests the misconception that the ASA's default behavior allows traffic from lower to higher security levels if the connection is initiated from the higher level, but in reality, the ASA only permits return traffic for established connections; new connections from lower to higher are always denied by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall has an explicit permit rule for traffic from DMZ to Inside on any destination.
The firewall's default behavior is to deny traffic from a lower security zone (DMZ) to a higher security zone (Inside). For the attack to succeed, an explicit permit rule must have been configured to allow traffic from DMZ to Inside. The existing rules only permit Outside to DMZ on TCP 443 and Inside to Outside; without an explicit DMZ-to-Inside rule, the default deny would have blocked the attack. Thus, the most likely reason is that an administrator inadvertently or intentionally added such a permit rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall has an explicit permit rule for traffic from DMZ to Inside on any destination.
Why this is correct
An explicit rule would override the default deny and allow the attack traffic.
- ✗
The firewall was configured in transparent mode, allowing all traffic.
Why it's wrong here
Transparent mode acts as a layer 2 bridge, but rules still apply; would not explain selective allowance.
- ✗
The attacker used a VPN connection that bypassed the firewall.
Why it's wrong here
No indication of VPN; the firewall logs showed the attack originated from DMZ IP.
- ✗
The firewall's default behavior permits traffic from lower security level to higher if the connection is initiated from the higher level.
Why it's wrong here
Default behavior for lower-to-higher is deny; only return traffic for existing sessions is allowed.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.