easyMultiple ChoiceObjective-mapped
ACL Rule Interpretation for Security Policy
Exhibit
Refer to the exhibit. ``` object network INSIDE_SUBNET subnet 192.168.1.0 255.255.255.0 object network WEB_SERVER host 10.0.0.10 access-list OUTSIDE_IN extended permit tcp any object WEB_SERVER eq 80 access-list OUTSIDE_IN extended deny ip any any ```
Refer to the exhibit. An ASA security policy is configured as shown. A user from the internet tries to access 192.168.1.5 via HTTP. What will happen?
Quick Answer
The correct answer is that the traffic will be denied. This occurs because a Cisco ASA security policy enforces an implicit deny at the end of every access control list (ACL), meaning any traffic that does not match an explicit permit rule is automatically dropped. In this scenario, no ACL entry permits HTTP traffic from the internet to 192.168.1.5, so the packet is denied by default, regardless of any other configuration. For the Cisco CyberOps Associate 200-201 exam, this question tests your understanding of ACL rule interpretation for security policy, specifically the fundamental principle that ACLs are deny-by-default. A common trap is assuming that a missing explicit deny means traffic is allowed, but the opposite is true—without a permit, nothing passes. Remember the mnemonic: “No permit, no entry; implicit deny ends the story.”
⚠ Common exam trap
Cisco often tests the implicit deny principle in ASA ACLs, where candidates mistakenly assume that traffic is allowed by default or that a missing permit statement still allows traffic if it matches a subnet or is logged.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic will be denied
The ASA security policy shown uses an access control list (ACL) that implicitly denies all traffic unless explicitly permitted. Since the exhibit does not show any ACL entry permitting HTTP traffic from the internet to 192.168.1.5, the traffic is denied by default. The correct answer is B because the ASA's default behavior for inbound traffic on an interface is to deny it unless a matching permit ACE exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Traffic will be allowed, but logged
Why it's wrong here
Traffic is denied, not allowed.
- ✓
Traffic will be denied
Why this is correct
The access list does not permit traffic to 192.168.1.5.
- ✗
Traffic will be allowed only if it matches the subnet
Why it's wrong here
No rule permits traffic from the internet to the inside subnet.
- ✗
Traffic will be permitted
Why it's wrong here
Only traffic to the web server is permitted.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A security policy states that all remote desktop (RDP) and Telnet access from external networks must be blocked. Does the above access-list comply with the policy?
easy- ✓ A.Yes, because it denies RDP and Telnet.
- B.Yes, because it denies TCP ports 3389 and 23.
- C.No, because it permits all other traffic.
- D.No, because it should deny HTTP traffic as well.
Why A: The access-list explicitly denies TCP port 3389 (RDP) and TCP port 23 (Telnet), which matches the security policy requirement to block all remote desktop and Telnet access from external networks. The implicit deny at the end of the access-list ensures that any traffic not explicitly permitted is blocked, so the policy is fully enforced.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.