mediumMultiple ChoiceObjective-mapped
200-901 Practice Question: Refer to the exhibit
Exhibit
ip access-list extended APP-SECURITY deny tcp any any eq 8080 permit tcp 192.168.1.0 0.0.0.255 any eq 8080 permit udp any any eq 53
Refer to the exhibit. An application is deployed on a server at 192.168.1.10, listening on TCP port 8080. The ACL is applied inbound on the server's network interface. Which clients will be able to access the application?
⚠ Common exam trap
A common mix-up: candidates assume a permit statement for a source network automatically allows all traffic from that network, ignoring that a later deny statement for a specific port can block that traffic due to the sequential processing of ACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No clients, because the deny statement blocks all TCP traffic to port 8080
The ACL is applied inbound on the server's network interface, meaning it filters traffic before it reaches the server. The second ACE explicitly denies all TCP traffic to port 8080, which is the port the application listens on. Since ACLs are processed sequentially and the deny statement matches the application's traffic, no TCP clients can access the application, regardless of their source IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Clients from any network, because the permit statement overrides the deny
Why it's wrong here
In an access list, order matters; the deny rule is applied before the permit rule for the same traffic type.
- ✗
Only clients from the 192.168.1.0/24 network
Why it's wrong here
The deny rule precedes the permit rule, so all TCP traffic to port 8080 is blocked regardless of source.
- ✓
No clients, because the deny statement blocks all TCP traffic to port 8080
Why this is correct
The first rule denies all TCP traffic to port 8080, making the subsequent permit ineffective for TCP.
- ✗
Only clients sending UDP traffic to port 53
Why it's wrong here
UDP port 53 is permitted, but the application listens on TCP 8080, so this is irrelevant.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.