easyMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ip access-list extended BLOCK_CRITICAL deny tcp any any eq 3389 deny tcp any any eq 23 permit ip any any
Refer to the exhibit. A security policy states that all remote desktop (RDP) and Telnet access from external networks must be blocked. Does the above access-list comply with the policy?
⚠ Common exam trap
Cisco often tests the implicit deny any at the end of an ACL, tricking candidates into thinking that only explicitly denied traffic is blocked and all other traffic is permitted, when in fact the implicit deny blocks everything else.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because it denies RDP and Telnet.
The access-list explicitly denies TCP port 3389 (RDP) and TCP port 23 (Telnet), which matches the security policy requirement to block all remote desktop and Telnet access from external networks. The implicit deny at the end of the access-list ensures that any traffic not explicitly permitted is blocked, so the policy is fully enforced.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Yes, because it denies RDP and Telnet.
Why this is correct
The ACL denies both services required by policy.
- ✗
Yes, because it denies TCP ports 3389 and 23.
Why it's wrong here
This is also true but option A is more concise; however, only one correct answer. A is the best.
- ✗
No, because it permits all other traffic.
Why it's wrong here
The policy only requires blocking those two services; permitting other traffic is acceptable.
- ✗
No, because it should deny HTTP traffic as well.
Why it's wrong here
HTTP is not mentioned in the policy.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.