ANS-C01 Network Design Practice Question

Network Topology

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

⚠ Common exam trap

Many exam-takers confuse the evaluation order of network ACL rules (ascending by rule number) with the order of security group rules (all evaluated until a match), or mistakenly think that a higher-numbered allow rule overrides a lower-numbered deny rule.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.

Network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The subnet is not associated with this network ACL.
Why it's wrong here
Assuming it is associated.
✗
The security group attached to the web server is blocking the traffic.
Why it's wrong here
Not indicated in exhibit.
✓
The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.
Why this is correct
Rule 100 matches and denies.
✗
The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.
Why it's wrong here
Rule 100 is lower number and evaluated first.

Visual reference

Go deeper

ANS-C01 Network Design Practice Question

Why each option matters

Option-by-option breakdown

Related to this question