CCNA Network Services and Security Practice Question
Exhibit
Requirement: - Block HTTPS from 10.44.44.0/24 to 172.16.8.20 Configured ACL entry: deny tcp 10.44.44.0 0.0.0.255 host 172.16.8.20 eq 80
Based on the exhibit, why does the ACL still allow HTTPS traffic from the branch subnet to the server?
⚠ Common exam trap
A common exam trap is assuming that blocking TCP port 80 also blocks HTTPS traffic. Candidates may see a deny statement for port 80 and mistakenly conclude that all web traffic is blocked. However, HTTPS uses TCP port 443, so if the ACL does not explicitly deny port 443, HTTPS traffic will still be allowed. This trap tests attention to detail and understanding of port assignments for common services. Overlooking the exact port number leads to incorrect conclusions about ACL effectiveness and network security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL blocks TCP port 80 instead of TCP port 443.
The ACL still allows the HTTPS traffic because the deny statement is matching TCP port 80, not TCP port 443. In practical terms, the entry blocks HTTP, not HTTPS. Since the requirement is specifically to block encrypted web traffic on TCP 443, the current line is aimed at the wrong service. This is a good precision question because it tests whether the candidate pays attention to the exact destination port rather than just seeing a generic web-related deny.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL blocks TCP port 80 instead of TCP port 443.
Why this is correct
HTTPS is HTTP encapsulated in TLS/SSL, and it uses TCP port 443 by default. Port 80 is reserved for plain HTTP, which is unencrypted. If the ACL denies only TCP port 80, then traffic destined to port 443 is not matched by that deny statement and will be evaluated by subsequent ACEs, which likely permit it, leaving HTTPS functional.
- ✗
HTTPS uses UDP port 443, so TCP matching can never work.
Why it's wrong here
HTTPS operates over TCP because TLS relies on reliable, ordered, connection-oriented delivery. UDP port 443 is used by QUIC for HTTP/3, but standard HTTPS uses TCP 443. Since the ACL was written with a TCP protocol match, that part is correct; the real issue is that it points to port 80 instead of port 443, so the encrypted traffic avoids the deny rule.
When this WOULD be correct
In a different scenario, if a question stated that a firewall was configured to filter UDP traffic and the exam asked about HTTPS traffic being blocked, this option could be correct if the context mistakenly assumed HTTPS could use UDP. This would highlight a misunderstanding about the protocols involved.
- ✗
The ACL must deny all IP traffic to the server to stop HTTPS.
Why it's wrong here
To block HTTPS you only need to deny the specific service's TCP port 443, not all IP traffic to the server. A narrow deny statement such as deny tcp any host 10.0.0.5 eq 443 is sufficient and preferable because it minimizes collateral impact. An implicit deny all exists at the end of an ACL, but an explicit broader deny is unnecessary and would also break other services that should remain accessible.
When this WOULD be correct
In a different scenario where the question states that the ACL is designed to deny all traffic except for specific protocols, and the context indicates that HTTPS must be explicitly denied, this option would be correct. For example, if the question asked what needs to be done to ensure HTTPS is blocked, then stating that all IP traffic must be denied would be valid.
- ✗
ACLs cannot filter by destination port when a host keyword is used.
Why it's wrong here
The claim that extended ACLs cannot filter by destination port when using the host keyword is false. The host keyword is simply a shorthand for a wildcard mask of 0.0.0.0, and it is perfectly valid to combine it with protocol and port operators, such as deny tcp host 192.168.1.10 any eq 443. Thus, a host entry does not restrict port-filtering capability.
When this WOULD be correct
In a different scenario where the question specifies that ACLs are configured to only filter by IP address without considering port numbers, this option could be correct. For example, if the question states that the ACL is designed to block all traffic from a specific host without specifying port filtering capabilities.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The ACL blocks TCP port 80 instead of TCP port 443.Correct answer▾
Why this is correct
HTTPS is HTTP encapsulated in TLS/SSL, and it uses TCP port 443 by default. Port 80 is reserved for plain HTTP, which is unencrypted. If the ACL denies only TCP port 80, then traffic destined to port 443 is not matched by that deny statement and will be evaluated by subsequent ACEs, which likely permit it, leaving HTTPS functional.
✗HTTPS uses UDP port 443, so TCP matching can never work.Wrong answer — click to see why▾
Why this is wrong here
HTTPS uses TCP port 443, not UDP. The statement that HTTPS uses UDP is factually incorrect; HTTPS relies on TCP for reliable, connection-oriented communication. Therefore, an ACL matching TCP can still filter HTTPS traffic if the correct port is specified.
★ When this WOULD be the correct answer
In a different scenario, if a question stated that a firewall was configured to filter UDP traffic and the exam asked about HTTPS traffic being blocked, this option could be correct if the context mistakenly assumed HTTPS could use UDP. This would highlight a misunderstanding about the protocols involved.
Why candidates choose this
Students might confuse HTTPS with DNS or other services that use UDP, or they might think that because TLS can theoretically run over UDP (as in DTLS), HTTPS commonly uses UDP. However, standard HTTPS always uses TCP.
✗The ACL must deny all IP traffic to the server to stop HTTPS.Wrong answer — click to see why▾
Why this is wrong here
A narrow, service-specific deny statement (e.g., deny tcp any any eq 443) is sufficient to block HTTPS traffic. Denying all IP traffic to the server would be overly broad and could block other necessary services, violating the principle of least privilege.
★ When this WOULD be the correct answer
In a different scenario where the question states that the ACL is designed to deny all traffic except for specific protocols, and the context indicates that HTTPS must be explicitly denied, this option would be correct. For example, if the question asked what needs to be done to ensure HTTPS is blocked, then stating that all IP traffic must be denied would be valid.
Why candidates choose this
Students might think that because HTTPS is encrypted, a specific port deny might not work, or they might believe that a blanket deny is simpler and more effective. However, proper ACL design uses specific denies to minimize impact.
✗ACLs cannot filter by destination port when a host keyword is used.Wrong answer — click to see why▾
Why this is wrong here
Extended ACLs can filter by both source/destination IP addresses (including host keyword) and port numbers. The host keyword is simply a shorthand for a /32 mask and does not prevent port filtering. The statement is technically incorrect.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that ACLs are configured to only filter by IP address without considering port numbers, this option could be correct. For example, if the question states that the ACL is designed to block all traffic from a specific host without specifying port filtering capabilities.
Why candidates choose this
Students might confuse the capabilities of standard ACLs (which cannot filter by port) with extended ACLs, or they might think that using a host keyword limits the ACL to only IP-based filtering. In reality, extended ACLs support both.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP that encrypts data between a web browser and a web server using SSL/TLS protocols.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.