CCNA Network Services and Security Practice Question
Exhibit
R1# show access-lists
Standard IP access list 10
10 permit 192.168.1.0 0.0.0.255 (5 matches)
Extended IP access list 100
remark Allow HTTP to DMZ web servers
10 permit tcp any 192.168.1.0 0.0.0.255 eq www (234 matches)
remark Deny all other traffic and log
20 deny ip any any log (1356 matches)Refer to the exhibit. An administrator is trying to access a web server in the DMZ at 192.168.1.10 using HTTPS, but the connection times out. The web server is confirmed to be running and listening on both port 80 and port 443. The administrator examines the access list configuration on the perimeter router. Based on the output of the show access-lists command, what is the most likely cause of the failure?
⚠ Common exam trap
Cisco often tests the distinction between HTTP (port 80) and HTTPS (port 443) in ACLs, trapping candidates who assume that allowing HTTP automatically allows HTTPS or that the implicit deny only applies to non-TCP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The access list does not include a permit statement for TCP port 443.
The access list shown in the exhibit permits TCP port 80 (HTTP) but does not include a permit statement for TCP port 443 (HTTPS). Since the administrator is trying to access the web server using HTTPS, which uses port 443, the traffic is implicitly denied by the final 'deny ip any any log' statement. This causes the connection to time out because the packets are dropped before reaching the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The access list does not include a permit statement for TCP port 443.
Why this is correct
The access list only has a single permit statement for the 192.168.1.0/24 network, and it matches 'eq www', which is TCP port 80. Because HTTPS uses TCP port 443, no forwarded traffic to that port is explicitly permitted, so it is dropped by the implicit deny-all rule at the end of the ACL. Even if the server is listening, the router's ACL prevents the packets from ever reaching it.
- ✗
The access list is applied in the wrong direction on the interface.
Why it's wrong here
The 'show access-lists' command does not reveal any interface binding or directional information; it only lists the access control entries and their match counters. Therefore, asserting that the ACL is applied in the wrong direction is an unsupported guess. In fact, regardless of whether the ACL is inbound or outbound on the interface, the absence of a permit for port 443 would still cause HTTPS traffic to be denied by the implicit deny.
- ✗
The web server is not actually listening on TCP port 443, despite the configuration.
Why it's wrong here
The scenario explicitly states that the web server is running and listening on both TCP port 80 and port 443, so the server is not the source of the problem. The failure occurs before packets reach the server: the router's ACL is dropping them. Because the ACL lacks a permit statement for port 443, the server never receives the HTTPS connection requests, so its listening state is irrelevant to the troubleshooting.
- ✗
The 'deny ip any any log' statement at the end of the access list is blocking the HTTPS traffic, so it must be removed.
Why it's wrong here
Removing the explicit deny statement would not help, because the default implicit deny-all still drops any traffic not explicitly permitted. The traffic must be allowed with a permit statement for port 443 before any deny line.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The access list does not include a permit statement for TCP port 443.Correct answer▾
Why this is correct
The access list only has a single permit statement for the 192.168.1.0/24 network, and it matches 'eq www', which is TCP port 80. Because HTTPS uses TCP port 443, no forwarded traffic to that port is explicitly permitted, so it is dropped by the implicit deny-all rule at the end of the ACL. Even if the server is listening, the router's ACL prevents the packets from ever reaching it.
✗The access list is applied in the wrong direction on the interface.Wrong answer — click to see why▾
Why this is wrong here
Candidates may assume the ACL is not applied correctly, but without interface details this conclusion cannot be drawn from the given output.
✗The web server is not actually listening on TCP port 443, despite the configuration.Wrong answer — click to see why▾
Why this is wrong here
Candidates might blame the server configuration rather than the network ACL, but the question stem provides the server state to rule this out.
✗The 'deny ip any any log' statement at the end of the access list is blocking the HTTPS traffic, so it must be removed.Wrong answer — click to see why▾
Why this is wrong here
This is a common misconception: the explicit deny is not the root cause; the missing permit is the real issue. Removing the deny without adding a permit for HTTPS would still result in the traffic being blocked by the implicit deny.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.