350-601 Security Practice Question
An engineer applies an IPv4 ACL to a Nexus switch interface. The ACL must permit traffic from host 10.1.1.1 to host 10.2.2.2 on TCP port 443 and deny all other traffic. Which configuration is correct?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip access-list WEB; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443
ACLs are processed top-down; a permit statement for the desired traffic followed by an implicit deny all other traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip access-list WEB; permit ip 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0
Why it's wrong here
This permits all IP traffic between the hosts, not just HTTPS.
- ✓
ip access-list WEB; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443
Why this is correct
This ACL permits the specified traffic, and the implicit deny blocks everything else.
- ✗
ip access-list WEB; deny ip any any; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443
Why it's wrong here
The deny all will block all traffic, including the intended permit.
- ✗
ip access-list WEB; permit tcp any any eq 443
Why it's wrong here
This permits all HTTPS traffic, not just the specific hosts.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.