mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
access-list 100 permit tcp any host 192.168.1.100 eq www access-list 100 permit tcp any host 192.168.1.100 eq 443 access-list 100 deny tcp any host 192.168.1.100 range 1 1023 access-list 100 permit ip any any
Refer to the exhibit. An analyst observes that the router's ACL is allowing all traffic to the web server at 192.168.1.100 on ports 80 and 443, but blocking all other TCP ports below 1024. However, the web server is also running an SSH service on port 22. What will happen to SSH traffic from the outside?
⚠ Common exam trap
Cisco often tests the misconception that a final 'permit ip any any' overrides earlier deny statements, when in fact ACLs stop processing after the first match, so traffic denied earlier never reaches the final permit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH will be denied because of the deny line range.
The ACL denies all TCP ports below 1024 except ports 80 and 443, which are explicitly permitted. Since SSH uses TCP port 22, which falls within the denied range (below 1024) and is not explicitly permitted, it is blocked by the deny line. The last line 'permit ip any any' only applies to traffic not already denied, but SSH traffic is already denied by the earlier rule, so it never reaches that permit statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSH will be permitted because of the last line 'permit ip any any'.
Why it's wrong here
The last line is processed only after earlier rules; the deny rule matches first.
- ✗
SSH will be denied because the ACL does not have an explicit permit for SSH.
Why it's wrong here
While true that there is no explicit permit, the deny rule is the direct reason.
- ✗
SSH will be permitted because it is not blocked by any rule.
Why it's wrong here
The deny rule explicitly blocks it.
- ✓
SSH will be denied because of the deny line range.
Why this is correct
The deny line covers port 22, so SSH traffic is denied.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.