Exam 300-710 topic 1 question 307 discussion

Very good question. It is a difficult choice, but I will choose A. As for D, asp-drop, my understanding is that ASP: Accelerated Security Path is a feature that “skips some checks on already established connections”. https://community.cisco.com/t5/network-security/what-is-asp/td-p/4043042#:~:text=If%20the%20connection%20is%20already%20established In this question, I am guessing that there is no connection to the external web server at all. If the connection is not yet established, then the asp-drop option should not be enabled. (PS: There is a discussion of this very question on Cisco Community, but even the VIP respondents are divided between A and D. LOL) https://community.cisco.com/t5/network-security/how-to-capture-dropped-packet-in-ftd-firewalll/td-p/5070863 I chose A, probably because the person with the A opinion seems more trustworthy)

The asp-drop type of capture is used to identify and capture packets that are dropped by the Cisco Secure Firewall Threat Defense (FTD) appliance due to the Accelerated Security Path (ASP) process. This type of capture helps troubleshoot issues where traffic is being dropped by the firewall, which is the case in this scenario. The other options (A, B, and C) are for general packet captures, but they don't specifically capture dropped packets, which is the key part of this issue.

To capture packets that are dropped by Cisco Secure Firewall Threat Defense (FTD) and troubleshoot the issue of traffic from the inside network to a webserver not getting through, the administrator should use the command to capture packets dropped by the accelerated security path (ASP) engine. The correct command is: capture CAP type asp-drop all headers-only

The question doesn't specify the packets dropped.

(A) and (C) could be valid answers. However, (C) restricts the troubleshooting massively by saying that the client tcp source port must be 80. In regular connection requests, those source ports are randomized... So, answer (A) should be the correct one.

My choice is A