hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip access-group INBOUND in ! access-list INBOUND deny tcp any host 192.168.1.100 eq 22 access-list INBOUND permit ip any any ```
Refer to the exhibit. A Cisco router is configured with the shown access list applied inbound on the external interface. An external attacker sends a packet with source IP 10.0.0.1, destination IP 192.168.1.100, destination port 22. What will the router do?
⚠ Common exam trap
Cisco often tests the implicit deny any at the end of an ACL, leading candidates to mistakenly think a packet will be permitted if no explicit deny matches, when in fact the implicit deny drops it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Drop the packet
The access list applied inbound on the external interface denies the packet because the source IP 10.0.0.1 is a private RFC 1918 address, which is typically blocked by a standard or extended ACL to prevent spoofed or internal traffic from entering from outside. Since the packet matches a deny entry (either explicitly or implicitly via the implicit deny all at the end of the ACL), the router drops it without forwarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Forward the packet to the next hop
Why it's wrong here
The packet is dropped, not forwarded.
- ✗
Permit the packet only if it is HTTP
Why it's wrong here
The packet is SSH, not HTTP.
- ✗
Permit the packet
Why it's wrong here
The deny rule matches before the permit any any.
- ✓
Drop the packet
Why this is correct
The packet is denied by the first ACE.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.