In which three cases does the ASA firewall permit inbound HTTP GET requests during normal operations? (Choose three).
A.
when matching NAT entries are configured
B.
when matching ACL entries are configured
C.
when the firewall receives a SYN-ACK packet
D.
when the firewall receives a SYN packet
E.
when the firewall requires HTTP inspection
F.
when the firewall requires strict HTTP inspection
The answer should A,B,D
The HTTP Inspection Engine feature allows users to configure their Cisco IOS Firewall to detect and
prohibit HTTP connections—such as tunneling over port 80, unauthorized request methods, and
non-HTTP compliant file transfers—that are not authorized within the scope of the security policy
configuration. Tunneling unauthorized protocols through port 80 and over HTTP exposes a network to
significant security risks
Ans are A B E
So, why E?
The question is not about ios firewall, it’s about ASA.
When htttp inspection is not present in global policy, ASA allows http, and basic tcp inspection is applied.