SkillTestPro | CCNP Security 350-701 SCOR Practice Test 9

CCNP Security 350-701 SCOR Practice Test 9 (Hard) - Cisco ASA Firewall Fundamentals

CISCO CCNP Security Exam Logo

1 / 10

On a Cisco ASA, which concept determines the default rule that traffic can flow from a higher-security-level interface to a lower-security-level interface without an explicit access list, while the reverse requires one?

The interface's MTU setting

The order in which interfaces were physically cabled

The ASA's hostname configuration

The interface's physical cable color

Security levels assigned to each interface (higher to lower is permitted by default; lower to higher is denied by default)

The interface's assigned VLAN number alone, with no security level concept, though the exact behavior varies depending on the specific platform and software version in use

2 / 10

Which ASA feature allows an administrator to translate multiple internal private IP addresses to a single public IP address using different port numbers, conserving public address space?

A spanning tree priority setting

An access control list with no NAT component

A VLAN trunking configuration

A routing protocol redistribution rule

Static one-to-one NAT with no port translation, which several deployment guides list as an important operational nuance

Port Address Translation (PAT), a form of NAT overload

3 / 10

Which ASA object type allows an administrator to define a reusable, named group of IP addresses or networks that can be referenced across multiple access control rules for easier management?

A spanning tree bridge ID, under typical enterprise deployment conditions before any further customization

A syslog facility code

An NTP server association

A routing table entry

A DHCP relay agent

A network object or object-group

4 / 10

Which ASA inspection feature is responsible for tracking the state of active connections (such as TCP sequence numbers and connection state) to permit legitimate return traffic without requiring an explicit inbound rule for every response?

Stateful packet inspection (the ASA's connection/state table)

DNS caching

Hot Standby Router Protocol (HSRP) alone

VLAN tagging (802.1Q)

Static routing

Link Aggregation Control Protocol (LACP), assuming no additional per-interface configuration overrides the default behavior

5 / 10

An administrator configures an ASA access control list that explicitly denies traffic from a specific host, placed above a broader permit rule for that host's subnet. Which ASA ACL processing behavior determines the outcome for that host's traffic?

The broadest matching rule always takes precedence over more specific rules regardless of order, a distinction that becomes more noticeable as the topology continues to scale

ASA ACLs ignore all deny statements entirely

ACL entries are processed top-down, and the first matching entry (the explicit deny) determines the action, regardless of later broader permit rules

Only the last matching entry in the list is ever evaluated

ASA ACLs require every packet to match all rules simultaneously before any action is taken

ASA ACLs always process entries in a random order with no regard to sequence

6 / 10

Which ASA high-availability feature allows two ASA appliances to operate as a redundant pair, with one actively passing traffic while the other stands by ready to take over if the active unit fails?

Active/Standby failover

DHCP address pool splitting between the two units

Equal-cost multipath routing between the two units

Static NAT translation duplication with no failover logic

Split-brain load balancing with no synchronization

Spanning tree root bridge election between the two units

7 / 10

Which ASA feature would be most appropriate for permitting a specific external partner's IP address to reach an internal web server on TCP port 443, while denying all other external access to that server?

Removing NAT entirely and exposing the server directly with no translation or filtering, but only once validated against a representative, non-peak traffic pattern, though the exact behavior varies depending on the specific platform and software version in use

Setting every interface to the same security level with no ACL at all

Creating a VLAN with no associated access control list

An access control list rule specifically permitting the partner's source IP to the server's destination IP on TCP/443, combined with NAT, with all other traffic implicitly or explicitly denied

Disabling the ASA's firewall functionality entirely for that interface

Configuring a static route with no access control component

8 / 10

Which ASA troubleshooting command output would most directly show whether a specific connection is currently being tracked in the stateful connection table, including its state and translated addresses?

The output of 'show interface' with no connection-specific data, which several deployment guides list as an important operational nuance

The output of 'show clock'

The output of 'show version' alone

The output of 'show conn' (or 'show xlate' for translation-specific detail)

The output of 'show hostname'

The output of 'show ntp status'

9 / 10

Which ASA concept describes traffic originating from a lower-security interface destined to a higher-security interface being denied by default, requiring an explicit access-list permit to allow it through?

The default DHCP lease time

The default routing protocol administrative distance

The default syslog severity level

The default security-level-based traffic flow rule

The default DNS TTL value

The default NTP polling interval

10 / 10

Which ASA design practice would best support both high availability and consistent security policy enforcement for a business-critical internet-facing application, while minimizing administrative overhead for ongoing rule changes?

Disabling failover synchronization to reduce configuration complexity

Relying solely on default security-level behavior with no explicit ACLs for the critical application, under typical enterprise deployment conditions before any further customization

Deploying a single, non-redundant ASA with every rule hardcoded individually and no object reuse

Avoiding object-groups entirely and duplicating every rule for every host individually

Deploying an Active/Standby (or Active/Active) ASA failover pair with object-groups and reusable network objects to simplify and synchronize policy management across both units

Deploying two completely independently configured ASAs with no synchronization or shared policy

Your score is

The average score is 0%