hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` ! Access-list for DMZ to Inside access-list DMZ_TO_INSIDE extended permit tcp 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0 eq 3306 access-list DMZ_TO_INSIDE extended deny ip any any ```
Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?
⚠ Common exam trap
Cisco often tests the direction of ACL application—candidates frequently mistake inbound vs. outbound filtering, leading them to think the ACL controls traffic from the internal network when it actually controls traffic from the DMZ.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It allows MySQL traffic from DMZ to internal network and blocks all other traffic
The ACL is applied inbound on the DMZ interface, meaning it filters traffic arriving from the DMZ (10.0.1.0/24) destined for the internal network (10.0.2.0/24). The first line permits TCP traffic from the DMZ to the internal network on port 3306 (MySQL). The second line is an explicit deny all, which blocks any other traffic from the DMZ to the internal network. Therefore, the ACL allows only MySQL traffic from the DMZ to the internal network and denies everything else.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It allows MySQL traffic from internal network to DMZ
Why it's wrong here
The ACL is applied to traffic from DMZ to inside, not the reverse.
- ✓
It allows MySQL traffic from DMZ to internal network and blocks all other traffic
Why this is correct
The first line permits MySQL (port 3306), the second denies everything else.
- ✗
It blocks all traffic from DMZ to internal network
Why it's wrong here
MySQL is permitted.
- ✗
It allows any traffic from DMZ to internal network
Why it's wrong here
The deny any any at the end blocks all other traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.