Cisco Certified Internetwork Expert (CCIE) Practice Test

Which type of header attack is detected by Cisco ASA threat detection?

1. Failed application inspection

2. Connection limit exceeded

3. Bad packet format

4. Denial by access list

The correct answer is: Bad packet format

The correct answer focuses on the "Bad packet format," which is a relevant type of header attack that can be detected by Cisco ASA threat detection. This type of attack involves packets that do not adhere to the expected format, potentially indicating an attempt to exploit vulnerabilities within the network protocol stack. Bad packet formats can disrupt proper communication and allow attackers to initiate various exploits, leading to security breaches. Cisco ASA is designed to analyze incoming and outgoing packets for anomalies, including those that deviate from expected header structures, making it capable of identifying such threats. Detecting these malformed packets is crucial as they can be indicative of more severe attacks, such as buffer overflow attacks or attempts to evade security measures. In contrast, the other options address different types of issues. For instance, failed application inspection may indicate a legitimate application problem rather than an attack, while connection limit exceeded pertains to resource exhaustion and DDoS scenarios. Denial by access list involves policy enforcement and legitimate security configurations rather than a direct threat detection scenario. Therefore, the detection of a bad packet format stands out as a critical capability of Cisco ASA in proactive threat management.