hardMultiple ChoiceObjective-mapped
Cisco Firepower ACL: Why Rule Order Matters for Allow Any and Deny
A multinational company has deployed a Cisco Firepower 4100 series device as the perimeter firewall. The network consists of multiple internal segments: a corporate LAN (192.168.1.0/24), a data center (10.10.0.0/16), and a guest wireless network (172.16.0.0/16). The firewall is configured with the following access control policy rules:
1. Allow from any to any (for testing, but currently enabled) 2. Allow from corporate LAN to data center (destination ports TCP/443, TCP/8443) 3. Block from guest wireless to data center 4. Allow from any to internet (destination any)
Recently, the security team discovered that a host in the guest network (172.16.5.50) is communicating with a server in the data center (10.10.10.100) on TCP port 443. The security team wants to immediately block this traffic without affecting other legitimate communications. Which action should be taken first?
Quick Answer
The answer is to move rule 3 (block guest to data center) above rule 1 (allow any). This is correct because Cisco Firepower processes access control rules in strict top-down order, and rule 1’s “allow any any” matches all traffic first, including the guest-to-data-center communication, before rule 3 can ever be evaluated. By reordering the ACL so the specific deny precedes the broad allow, the block action takes immediate effect without disrupting other legitimate flows. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of rule ordering and the critical principle that specific deny rules must be placed above any general allow rules to be effective—a common trap where candidates mistakenly add a new deny rule at the bottom, forgetting it will never be reached. A useful memory tip: “Specific denies must rise above the any any tide.”
⚠ Common exam trap
Cisco often tests the concept that a default 'allow any' rule placed above more specific deny rules will negate those denies, and candidates mistakenly think adding a new rule or modifying an existing rule later in the policy will override the earlier match.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move rule 3 (block guest to data center) above rule 1 (allow all)
Rule 1 is an 'allow any any' rule placed above rule 3, which is supposed to block guest-to-data-center traffic. Because Cisco Firepower processes access control rules in top-down order, rule 1 matches and permits the traffic before rule 3 can be evaluated. Moving rule 3 above rule 1 ensures the block action is applied first, immediately stopping the unwanted communication without altering other rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Move rule 3 (block guest to data center) above rule 1 (allow all)
Why this is correct
This ensures the block rule is evaluated before the allow rule, stopping the traffic.
- ✗
Modify rule 2 to include a deny for the guest subnet
Why it's wrong here
Rule 2 is for corporate LAN to data center; modifying it would not affect guest traffic.
- ✗
Change rule 4 to block all traffic from guest network
Why it's wrong here
This would block all guest internet access, which is not desired.
- ✗
Add a new rule after rule 4 to block the specific traffic
Why it's wrong here
A new rule after rule 4 would still be after the allow rule (rule 1), so it would not match because the traffic is already allowed by rule 1.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a Cisco ASA firewall configured with multiple access-lists applied to the outside interface. The security team is investigating reports that legitimate HTTPS traffic to a public web server located on a DMZ is intermittently being blocked. The firewall configuration includes an ACL that permits traffic to the web server's IP address on TCP 443, but also includes a general deny rule for all other traffic. The engineer notices that the permit rule is placed after a deny rule that blocks traffic from a specific source subnet that is used by internal users for testing. The internal users report that they can access the web server, but external users sometimes experience timeouts. What is the most likely cause of the intermittent blocking?
medium- ✓ A.The permit rule for HTTPS is not hitting because traffic is being matched by a preceding deny rule.
- B.The external users are hitting the firewall's connection limit.
- C.The ASA is performing NAT incorrectly for the web server traffic.
- D.The ASA is experiencing high CPU utilization causing packet drops.
Why A: The most likely cause is that the permit rule for HTTPS (TCP 443) is placed after a deny rule that blocks traffic from a specific source subnet. Since ACLs on a Cisco ASA are processed sequentially from top to bottom, if a packet matches the earlier deny rule, it will be dropped before reaching the permit rule. This explains why external users (who may be sourced from the blocked subnet or whose traffic is inadvertently matched by the deny rule due to overlapping or misconfigured source conditions) experience intermittent timeouts, while internal users from a different subnet are not affected.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.