200-901 Practice Question: Needs to allow HTTPS traffic from the internet to…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Routing protocol configuration

  Why it's wrong here

  Routing protocols exchange reachability information between layer-3 devices; they do not filter or permit traffic by port and direction. The requirement is a firewall rule permitting TCP 443 inbound to the web server. Routing configuration would be correct when advertising internal subnets to a neighbouring router.

• ✗

  Outbound ACL on the inside interface

  Why it's wrong here

  An outbound ACL on the inside interface filters traffic leaving the internal network, so it cannot permit inbound HTTPS sessions arriving from the internet. Inbound rules on the outside interface govern that direction. Outbound ACLs suit controlling internal users' egress to external destinations.

• ✓

  Inbound ACL on the outside interface

  Why this is correct

  An inbound ACL on the outside interface filters traffic arriving from the internet, permitting TCP 443 to the internal web server's translated address while denying other inbound flows. This satisfies the requirement to expose HTTPS only, applied at the perimeter where untrusted traffic first enters.

• ✗

  Static NAT configuration

  Why it's wrong here

  Static NAT maps a public address to the internal server's private address but performs no port or direction filtering, so it alone does not permit HTTPS. A firewall rule allowing TCP 443 inbound is still required. Static NAT suits publishing a server once the accompanying permit rule exists.