CCNA Network Services and Security Practice Question
A router interface applies this ACL inbound:
10 deny tcp any any eq 80 20 permit ip any any
A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?
⚠ Common exam trap
Remember that ACLs are processed sequentially; the first match dictates the action, not subsequent lines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL blocks HTTP but allows ICMP
ACLs are processed top down. Line 10 denies TCP destination port 80, which blocks HTTP. Line 20 then permits all remaining IP traffic, including ICMP echo packets used by ping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL blocks all traffic because the first entry is a deny
Why it's wrong here
This ACL does not apply a blanket deny to every packet; line 10 specifically targets TCP only. Any non-TCP packet, such as ICMP, skips past that ACE and continues to the subsequent permit ip any any, which grants permission. So the presence of a deny first does not block all traffic when a later broad permit exists.
When this WOULD be correct
In a different scenario where an ACL has a single entry that denies all traffic, followed by a permit statement for a specific protocol, the first deny would indeed block all traffic, making this option correct. For example, if the ACL were structured as '10 deny ip any any' followed by '20 permit tcp any any', then the first entry would block all traffic.
- ✓
The ACL blocks HTTP but allows ICMP
Why this is correct
HTTP traffic is encapsulated in TCP, so it matches the first ACE, deny tcp any any, and is immediately discarded because ACLs stop at the first match. ICMP, however, is not TCP; it is a separate Layer 3 protocol, and therefore bypasses line 10. It then matches the permit ip any any on line 20, allowing ping to succeed.
- ✗
The ACL permits HTTP because line 20 overrides line 10
Why it's wrong here
Cisco ACLs are evaluated top-down and the first matching ACE decides the fate of the packet; there is no concept of a later line overriding an earlier match. An HTTP request is TCP, so it matches line 10 before line 20 can ever be considered. Therefore HTTP is denied, and line 20 only applies to traffic that did not match any earlier ACE.
When this WOULD be correct
In a different scenario where the ACL had the entries reversed (20 permit ip any any followed by 10 deny tcp any any eq 80), option C would be correct, as the permit rule would allow HTTP traffic before the deny rule is evaluated.
- ✗
The ACL blocks ping because ICMP is not explicitly permitted
Why it's wrong here
The first ACE uses the tcp keyword, so it filters only TCP segment payloads; ICMP echo requests use IP protocol 1 and do not match that line. The ACL then reaches the later permit ip any any statement, which explicitly permits all IP traffic, including ICMP. Thus ping is allowed, not blocked, by this ACL.
When this WOULD be correct
In a different scenario where an ACL explicitly denies all ICMP traffic, such as '10 deny icmp any any', the statement would be correct if the question asked why ping fails while other traffic is allowed. Here, the ACL would block ping requests while allowing other protocols.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The ACL blocks HTTP but allows ICMPCorrect answer▾
Why this is correct
HTTP traffic is encapsulated in TCP, so it matches the first ACE, deny tcp any any, and is immediately discarded because ACLs stop at the first match. ICMP, however, is not TCP; it is a separate Layer 3 protocol, and therefore bypasses line 10. It then matches the permit ip any any on line 20, allowing ping to succeed.
✗The ACL blocks all traffic because the first entry is a denyWrong answer — click to see why▾
Why this is wrong here
The ACL does not block all traffic; it only denies TCP traffic destined for port 80 (HTTP). Other traffic, including ICMP, is permitted by the subsequent 'permit ip any any' statement.
★ When this WOULD be the correct answer
In a different scenario where an ACL has a single entry that denies all traffic, followed by a permit statement for a specific protocol, the first deny would indeed block all traffic, making this option correct. For example, if the ACL were structured as '10 deny ip any any' followed by '20 permit tcp any any', then the first entry would block all traffic.
Why candidates choose this
Students might think that the first deny entry blocks all traffic because they overlook the permit entry that follows, or they may misunderstand that ACLs process entries sequentially and stop at the first match.
✗The ACL permits HTTP because line 20 overrides line 10Wrong answer — click to see why▾
Why this is wrong here
Line 20 does not override line 10 because ACLs use first-match logic. Once a packet matches line 10 (TCP port 80), it is denied and no further processing occurs. Line 20 only applies to packets that do not match earlier entries.
★ When this WOULD be the correct answer
In a different scenario where the ACL had the entries reversed (20 permit ip any any followed by 10 deny tcp any any eq 80), option C would be correct, as the permit rule would allow HTTP traffic before the deny rule is evaluated.
Why candidates choose this
Students may confuse ACL processing with other rules where later entries override earlier ones, or they may think that a permit statement always overrides a deny statement.
✗The ACL blocks ping because ICMP is not explicitly permittedWrong answer — click to see why▾
Why this is wrong here
ICMP is not explicitly blocked; it is permitted by the 'permit ip any any' statement on line 20, which covers all IP protocols including ICMP. The user's ping works, confirming this.
★ When this WOULD be the correct answer
In a different scenario where an ACL explicitly denies all ICMP traffic, such as '10 deny icmp any any', the statement would be correct if the question asked why ping fails while other traffic is allowed. Here, the ACL would block ping requests while allowing other protocols.
Why candidates choose this
Students might think that only explicitly permitted protocols are allowed, forgetting that 'permit ip any any' permits all IP traffic, including ICMP.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
HTTP
HTTP stands for Hypertext Transfer Protocol, the set of rules web browsers and servers use to communicate and transfer web pages over the internet.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.