ANS-C01 Network Security, Compliance and Governance Practice Question

Network Topology

A security engineer reviews the NACL entries above for a subnet. Which statement about incoming SSH traffic (port 22) is correct?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SSH traffic is allowed from all IP addresses.

NACLs are stateless and rules are evaluated in order by rule number. Rule 100 allows SSH from all IPs. Rule 200 denies SSH from all IPs, but it is not evaluated because rule 100 already allowed. Rule 300 allows SSH from 10.0.0.0/8 but is not reached. Since rule 100 allows all, SSH is allowed from all IPs. Therefore, option B is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SSH traffic is allowed only from the 10.0.0.0/8 range.
Why it's wrong here
Rule 100 allows all; rule 300 is not evaluated.
✓
SSH traffic is allowed from all IP addresses.
Why this is correct
Rule 100 allows all SSH traffic; subsequent rules are not evaluated.
✗
SSH traffic is allowed from 10.0.0.0/8 and denied from all others.
Why it's wrong here
Rule 100 allows all, so traffic from outside 10.0.0.0/8 is also allowed.
✗
SSH traffic is denied from all IP addresses.
Why it's wrong here
Rule 100 allows it, so it is not denied.

Visual reference

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question