Courseiva
← 200-201
Full test
mediumMultiple Choice

200-201 Access Control List (ACL) Practice Question

Exhibit

Refer to the exhibit.

Extended ACL 101:
10 permit tcp 192.168.1.0 0.0.0.255 any eq 80
20 permit tcp 192.168.1.0 0.0.0.255 any eq 443
30 deny tcp any any eq 22
40 permit ip any any

Interface GigabitEthernet0/0:
 ip access-group 101 out

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

⚠ Common exam trap

The ACL includes an explicit deny for SSH (port 22) on line 30, so SSH is explicitly denied, not just by the implicit deny. Candidates may incorrectly think the final 'permit ip any any' allows SSH, but since the explicit deny comes before, SSH is blocked.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.

The ACL contains permit statements for HTTP (port 80) and HTTPS (port 443) from the 192.168.1.0/24 network. It also includes an explicit deny statement for SSH (port 22) and a final permit ip any any statement (line 40). As a result, HTTP and HTTPS traffic are allowed, SSH traffic is denied, and all other traffic is permitted. Therefore, option C is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    All outbound traffic is denied except HTTP and HTTPS.

    Why it's wrong here

    Line 40 permits all traffic, so nothing is denied except SSH.

  • ✗

    Only HTTP and HTTPS traffic is allowed.

    Why it's wrong here

    Line 40 permits all other traffic, so more than just HTTP/HTTPS is allowed.

  • ✓

    HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.

    Why this is correct

    HTTP and HTTPS are permitted because the ACL explicitly matches TCP ports 80 and 443, satisfying the requirement to allow web browsing outbound. SSH is denied since port 22 is absent from the permit statements and the implicit deny any catches it, blocking remote shell access from 192.168.1.0/24 to the internet.

  • ✗

    SSH traffic is only denied if it originates from the 192.168.1.0/24 network.

    Why it's wrong here

    Line 30 denies SSH from any source, not just the internal network.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.