200-901 Network Fundamentals Practice Question
A developer runs `python -c "import requests; r=requests.get('https://api.example.com/v1/status'); print(r.json())"` on a Linux host. The command returns a JSON payload instantly, but when the same request is sent to `http://api.example.com/v1/status` the client hangs and later times out with no response. Which network-layer behavior best explains why the HTTPS URL succeeds while the HTTP URL fails?
⚠ Common exam trap
The trap here is assuming HTTPS is inherently more reliable or uses a different transport, when the real difference is that port 80 is being silently blocked while port 443 is allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP port 80 is filtered by an intermediate device, while TCP port 443 is permitted.
The only difference between the two attempts is the destination port: 443 succeeds and 80 times out. When a TCP connection times out rather than receiving an immediate RST, an intermediate firewall or ACL is silently discarding the SYN. Because the hostname resolved and the encrypted session completed, name resolution and routing are functioning, leaving port-level filtering as the cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP/1.1 requires a three-way handshake that TCP port 443 avoids by using UDP.
Why it's wrong here
This misstates how HTTPS works. HTTPS runs over TCP as well and still performs a three-way handshake on port 443 before the TLS negotiation begins. No part of standard HTTPS uses UDP, so avoiding the handshake cannot explain why the encrypted request completes while the plaintext one stalls.
- ✓
TCP port 80 is filtered by an intermediate device, while TCP port 443 is permitted.
Why this is correct
The client hangs on port 80 and times out, which is the classic signature of silently dropped TCP SYN segments on an ACL or firewall policy. Because the same hostname and application reach the service over 443, routing and name resolution are already proven correct, so the only variable left is the destination port being filtered between client and server.
- ✗
The server's default gateway is missing, so replies to port 80 are dropped.
Why it's wrong here
If the server lacked a default gateway, replies to the HTTPS request on port 443 would equally fail to reach the client. A routing defect is not port-specific; it would break both flows or neither. The observed port-selective failure points to a filtering policy rather than an absent route on the server.
- ✗
The DNS A record for api.example.com resolves only for TLS connections.
Why it's wrong here
DNS does not behave differently based on the transport port the application later selects. A single A or CNAME record is returned for the hostname regardless of whether the client then connects to 80 or 443. Since the HTTPS request resolved and connected successfully, name resolution is demonstrably working for both attempts.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.