CCNA Network Services and Security Practice Question
An ACL on R1 contains only these entries:
access-list 101 permit tcp 10.10.10.0 0.0.0.255 any eq 443 access-list 101 permit icmp any any
What happens to an HTTP packet sourced from 10.10.10.25 and destined for 198.51.100.10 if ACL 101 is applied in the traffic path?
⚠ Common exam trap
Be careful not to confuse TCP with ICMP or overlook the specific port numbers in ACL entries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is denied by the implicit deny.
HTTP uses TCP port 80, not 443. Because the ACL does not include a permit for that traffic, it is dropped by the implicit deny at the end of the ACL. The ICMP entry is irrelevant because the packet is TCP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is permitted because the source subnet is allowed.
Why it's wrong here
The ACL does not broadly permit the source subnet; it uses an extended ACL entry that permits only TCP traffic destined for port 443, not all traffic from that subnet. An HTTP packet from that subnet is destined for port 80, which fails to satisfy the destination-port condition of the sole TCP permit statement. Since the source subnet alone is not sufficient to match the ACL, the packet is not permitted by that statement and falls through to the implicit deny at the end of ACL 101.
When this WOULD be correct
In a different scenario where the ACL allowed all traffic from the source subnet (e.g., 'access-list 101 permit ip 10.10.10.0 0.0.0.255 any'), then an HTTP packet from 10.10.10.25 would be permitted, making this option correct.
- ✓
It is denied by the implicit deny.
Why this is correct
The HTTP packet, utilising TCP port 80, does not match the first ACL entry, which specifically permits TCP traffic only for destination port 443. It also fails to match the second entry, which permits ICMP traffic. As the packet does not match any explicit `permit` statement within ACL 101, it is processed by the implicit `deny ip any any` that exists at the end of every Cisco access control list. This mechanism ensures the HTTP packet is denied.
- ✗
It is translated by NAT before the ACL is checked.
Why it's wrong here
This option misapplies NAT's role in packet filtering. In Cisco IOS, the order of NAT and ACL processing depends on the interface and direction (for example, inside NAT may occur before an outbound ACL), but no NAT configuration is given in the scenario. Even if NAT were present, it would only rewrite IP addresses, not the TCP destination port from HTTP's 80 to HTTPS's 443. Therefore, the packet still fails to match the explicit permit for port 443 and is ultimately denied by the implicit deny.
When this WOULD be correct
In a different scenario where the question specifies that NAT is configured on the router and the ACL is applied after NAT processing, an HTTP packet could be translated to a different address before being evaluated by the ACL. In this case, the packet might be permitted or denied based on the translated address.
- ✗
It is converted to HTTPS automatically.
Why it's wrong here
Routers do not automatically rewrite application-layer protocols or change destination ports. HTTP and HTTPS are distinct protocols using different TCP ports (80 versus 443), and the ACL matches on the literal destination port in the packet header. Unless an application-level gateway or explicit inspection rule is configured to alter the port—which is not present in this ACL-only scenario—the HTTP packet remains on port 80 and cannot match the permit for 443. Consequently, the packet violates the implicit deny and is discarded.
When this WOULD be correct
In a different scenario, if the question stated that the network device has a feature that automatically upgrades HTTP traffic to HTTPS based on specific configurations, then this option could be correct. For example, if the device was configured to enforce secure connections for all HTTP traffic, the packet could be converted to HTTPS before being processed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It is denied by the implicit deny.Correct answer▾
Why this is correct
The HTTP packet, utilising TCP port 80, does not match the first ACL entry, which specifically permits TCP traffic only for destination port 443. It also fails to match the second entry, which permits ICMP traffic. As the packet does not match any explicit `permit` statement within ACL 101, it is processed by the implicit `deny ip any any` that exists at the end of every Cisco access control list. This mechanism ensures the HTTP packet is denied.
✗It is permitted because the source subnet is allowed.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the ACL only permits TCP traffic on port 443 and ICMP traffic, so an HTTP packet (port 80) from the specified source would be denied by the implicit deny rule at the end of the ACL.
★ When this WOULD be the correct answer
In a different scenario where the ACL allowed all traffic from the source subnet (e.g., 'access-list 101 permit ip 10.10.10.0 0.0.0.255 any'), then an HTTP packet from 10.10.10.25 would be permitted, making this option correct.
Why candidates choose this
Candidates may choose this option because they might misinterpret the ACL's source address as sufficient for permitting all types of traffic, overlooking the specific port restrictions.
✗It is translated by NAT before the ACL is checked.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because NAT does not occur before ACL evaluation; the ACL is applied directly to the packet as it arrives at the interface. Therefore, the HTTP packet is evaluated against the ACL without any translation taking place.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that NAT is configured on the router and the ACL is applied after NAT processing, an HTTP packet could be translated to a different address before being evaluated by the ACL. In this case, the packet might be permitted or denied based on the translated address.
Why candidates choose this
Candidates may find this option tempting because they might confuse the order of operations in packet processing, thinking that NAT would modify the packet before ACL evaluation, which is a common misconception in networking.
✗It is converted to HTTPS automatically.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the ACL does not automatically convert HTTP traffic to HTTPS; it only permits or denies traffic based on the defined rules. The packet from 10.10.10.25 is not permitted by the ACL since it is not targeting port 443.
★ When this WOULD be the correct answer
In a different scenario, if the question stated that the network device has a feature that automatically upgrades HTTP traffic to HTTPS based on specific configurations, then this option could be correct. For example, if the device was configured to enforce secure connections for all HTTP traffic, the packet could be converted to HTTPS before being processed.
Why candidates choose this
Candidates may choose this option due to a common understanding that many modern networks implement security features that automatically upgrade HTTP to HTTPS, leading to confusion about the capabilities of ACLs in this context.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Implicit deny
Implicit deny is a security rule that automatically blocks any network traffic that is not explicitly allowed by an access control list or firewall rule.
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.