easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security architect reviews this Cisco router…
Exhibit
Refer to the exhibit. ``` interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip access-group OUTSIDE_IN in ! ip access-list extended OUTSIDE_IN permit tcp any host 192.168.1.100 eq 80 permit tcp any host 192.168.1.100 eq 443 deny ip any any log ! interface GigabitEthernet0/1 ip address 10.0.0.1 255.255.255.0 ip access-group INSIDE_OUT out ! ip access-list extended INSIDE_OUT permit ip 10.0.0.0 0.0.0.255 any deny ip any any log ```
A security architect reviews this Cisco router ACL configuration. The web server at 192.168.1.100 is accessible from the internet. What additional security measure should be implemented to protect the internal network (10.0.0.0/24)?
⚠ Common exam trap
A common misconception is that adding more ACL rules or applying them on additional interfaces is sufficient for security, when the real gap is the lack of stateful inspection that a firewall provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the ACLs with a stateful firewall that inspects connection states
A stateful firewall (option C) tracks the state of active connections and dynamically permits return traffic for legitimate sessions, whereas a stateless ACL only filters based on static 5-tuple criteria. In this scenario, the ACL on the outside interface allows inbound web traffic to 192.168.1.100 but does not inspect session state, leaving the internal network (10.0.0.0/24) vulnerable to spoofed or unsolicited inbound packets that match permit rules. A stateful firewall would enforce that only packets belonging to established sessions initiated from the internal network are allowed back in, providing defense against IP spoofing and session-hijacking attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the log statement from the deny rules to improve performance
Why it's wrong here
Removing logging reduces visibility without improving security; logging is important for monitoring.
- ✗
Add an ACL on GigabitEthernet0/1 to limit outbound traffic to web ports only
Why it's wrong here
Limiting outbound to web ports may be too restrictive and not address all threats; stateful firewall is better.
- ✓
Replace the ACLs with a stateful firewall that inspects connection states
Why this is correct
A stateful firewall provides deeper inspection and can prevent various attacks.
- ✗
Apply the same OUTSIDE_IN ACL to GigabitEthernet0/1 inbound
Why it's wrong here
This would block all incoming traffic, including legitimate internal traffic, and is not appropriate.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.