hardMultiple ChoiceObjective-mapped
Access Control List Security Flaws
Exhibit
Refer to the exhibit.
```
Router# show ip access-list EXTENDED_FILTER
Extended IP access list EXTENDED_FILTER
10 permit tcp 10.1.1.0 0.0.0.255 any eq 22
20 permit tcp 10.1.2.0 0.0.0.255 any eq 22
30 deny tcp any any eq 22
40 permit ip any any
```Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?
Quick Answer
The most significant security flaw is the permit ip any any statement at the end of the access control list, which allows all unexamined traffic and effectively bypasses any intended security controls. This is because ACLs are processed sequentially from top to bottom; once a packet matches the permit ip any any rule, it is allowed through regardless of the earlier deny statements, meaning the specific SSH restrictions for the 10.1.1.0/24 and 10.1.2.0/24 subnets are rendered meaningless for any other protocol or source. On the Cisco CyberOps Associate 200-201 exam, this question tests your understanding of implicit deny versus explicit permit logic, and the common trap is assuming that a deny statement for SSH is sufficient—when in reality, a broad permit at the end opens the entire network to all traffic. A helpful memory tip is "last line wins the whole network," reminding you that any permit ip any any at the end of an ACL overrides all prior restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The permit ip any any at the end allows all unexamined traffic, potentially bypassing other security controls
The ACL permits all other traffic (line 40) after denying SSH from other sources. This bypasses any additional restrictions; the intent might be to allow only specific IPs for SSH, but the permit ip any any at the end allows all other traffic, which could include other unwanted protocols. Option A is incorrect because line 40 permits everything. Option B is wrong because the source is correctly the internal subnets. Option C is wrong because ACLs are sequence-dependent, but line 30 only denies SSH from other sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The destination 'any' allows SSH to any external server, which is too permissive
Why it's wrong here
The policy is to allow SSH to external servers, so destination any might be intentional.
- ✗
The ACL permits SSH from unauthorized IP addresses
Why it's wrong here
Lines 10 and 20 permit only the authorized subnets; line 30 denies all other SSH.
- ✗
The ACL sequence is illogical; line 30 should be before lines 10 and 20
Why it's wrong here
ACLs process in sequence; lines 10 and 20 permit first, so line 30 only catches others. This is correct logic.
- ✓
The permit ip any any at the end allows all unexamined traffic, potentially bypassing other security controls
Why this is correct
A broad permit all at the end can mask unintended traffic. Better practice is to explicitly deny any traffic not permitted.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A Cisco router is configured with the shown access list applied inbound on the external interface. An external attacker sends a packet with source IP 10.0.0.1, destination IP 192.168.1.100, destination port 22. What will the router do?
hard- A.Forward the packet to the next hop
- B.Permit the packet only if it is HTTP
- C.Permit the packet
- ✓ D.Drop the packet
Why D: The access list applied inbound on the external interface denies the packet because the source IP 10.0.0.1 is a private RFC 1918 address, which is typically blocked by a standard or extended ACL to prevent spoofed or internal traffic from entering from outside. Since the packet matches a deny entry (either explicitly or implicitly via the implicit deny all at the end of the ACL), the router drops it without forwarding.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.