CCNA Network Services and Security Practice Question
An ACL permits only tcp 10.10.10.0/24 host 192.0.2.10 eq 443 and has no other permit entries. What happens to an ICMP echo request from 10.10.10.5 to 192.0.2.10?
⚠ Common exam trap
Remember that ACLs have an implicit deny all rule. Just because a source or destination is specified doesn't mean all traffic types are allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is denied by the implicit deny
ACLs end with an implicit deny. Since the only explicit permit is for HTTPS traffic, the ICMP packet is denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is permitted because the destination matches
Why it's wrong here
Matching a single field, such as the destination IP address, is insufficient because an ACE is a conjunction of all its conditions: protocol, source, destination, and port. This packet is ICMP, not TCP, and lacks a TCP destination port, so it fails the protocol and port criteria even though the destination matches 192.0.2.10.
When this WOULD be correct
In a different exam scenario where an ACL permits ICMP traffic from a specific source to a specific destination, such as 'permit icmp 10.10.10.0/24 host 192.0.2.10', this option would be correct as the ICMP echo request would match the permit statement.
- ✓
It is denied by the implicit deny
Why this is correct
An ACL ends with an implicit deny all rule, so any packet not explicitly permitted by a preceding ACE is dropped. An ICMP packet is not TCP and therefore does not match the permit tcp statement, regardless of its source or destination. Thus, it falls through to the implicit deny and is denied.
- ✗
It is permitted because the packet matches the source network stated in the ACE.
Why it's wrong here
The ACE permits TCP packets from 10.10.10.0/24 to host 192.0.2.10 on port 443, but it does not permit ICMP. Even if the source IP is within the specified network, the protocol field still does not match; ACLs evaluate the entire tuple, not just the source address, so an ICMP packet is not permitted.
When this WOULD be correct
In a different scenario where an ACL permits both TCP and ICMP traffic, a question might ask about the behavior of an ICMP packet under those conditions. If the ACL included rules for ICMP, then translating ICMP to TCP could be a valid consideration.
- ✗
It is permitted only if the source port is 443
Why it's wrong here
ICMP does not use TCP or UDP ports; it has its own message types and codes. The ACE specifies the destination port eq 443, not the source port, and it applies only to TCP. Therefore, the source port is irrelevant for ICMP, and the packet cannot be permitted by this rule.
When this WOULD be correct
In a different scenario, if the ACL specified a rule that allowed ICMP traffic from any source to a specific destination, and the question asked about ICMP traffic, then this option could be correct if the source port was relevant to the rule being applied.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It is denied by the implicit denyCorrect answer▾
Why this is correct
An ACL ends with an implicit deny all rule, so any packet not explicitly permitted by a preceding ACE is dropped. An ICMP packet is not TCP and therefore does not match the permit tcp statement, regardless of its source or destination. Thus, it falls through to the implicit deny and is denied.
✗It is permitted because the destination matchesWrong answer — click to see why▾
Why this is wrong here
The ACL only permits TCP traffic from 10.10.10.0/24 to host 192.0.2.10 on port 443. ICMP is not TCP, so even though the destination matches, the protocol does not match, and the packet is not permitted.
★ When this WOULD be the correct answer
In a different exam scenario where an ACL permits ICMP traffic from a specific source to a specific destination, such as 'permit icmp 10.10.10.0/24 host 192.0.2.10', this option would be correct as the ICMP echo request would match the permit statement.
Why candidates choose this
Students might think that matching the destination IP address is sufficient for permit, but ACLs require matching all specified fields (protocol, source, destination, and port).
✗It is permitted because the packet matches the source network stated in the ACE.Wrong answer — click to see why▾
Why this is wrong here
Although the source IP matches the ACE's source network, the ACE only permits TCP traffic; ICMP is a different protocol, so the packet is denied by the implicit deny.
★ When this WOULD be the correct answer
In a different scenario where an ACL permits both TCP and ICMP traffic, a question might ask about the behavior of an ICMP packet under those conditions. If the ACL included rules for ICMP, then translating ICMP to TCP could be a valid consideration.
Why candidates choose this
Some students may confuse ACLs with NAT or other features that can modify packets, but ACLs only filter based on existing packet headers.
✗It is permitted only if the source port is 443Wrong answer — click to see why▾
Why this is wrong here
ICMP does not use TCP ports; it uses ICMP type and code. The ACL entry specifies TCP port 443, which is irrelevant for ICMP traffic. Even if the source port were 443, ICMP packets do not have TCP ports.
★ When this WOULD be the correct answer
In a different scenario, if the ACL specified a rule that allowed ICMP traffic from any source to a specific destination, and the question asked about ICMP traffic, then this option could be correct if the source port was relevant to the rule being applied.
Why candidates choose this
Students might think that matching the source port 443 could permit the traffic, but they overlook that the protocol must also match TCP.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Implicit deny
Implicit deny is a security rule that automatically blocks any network traffic that is not explicitly allowed by an access control list or firewall rule.
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.