CAS-004 Practice Question: Refer to the exhibit

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The ACL lacks a log statement

  Why it's wrong here

  A missing log statement only affects whether denied packets are recorded; it does not itself drop traffic, so it cannot cause the block. It is tempting because absent logs make diagnosis harder, and adding logging would be the right action when you need visibility into which ACL entry is denying the traffic.

• ✓

  The ACL is misordered (deny before permit)

  Why this is correct

  ACLs process rules sequentially, so a deny statement placed above the matching permit blocks port 80 traffic before the permit is ever evaluated. The exhibit's external-to-10.0.0.10:80 flow satisfies the deny entry first, producing the observed block despite a valid permit existing lower in the list.

• ✗

  The web server is using port 443

  Why it's wrong here

  Port 443 carries HTTPS, so a server listening there would not block inbound port 80 traffic; the two are independent listeners. It is tempting because web servers commonly redirect HTTP to HTTPS, and this would be correct if the requirement were secure browsing rather than explaining why port 80 is denied.

• ✗

  The destination IP is incorrect

  Why it's wrong here

  The stem already states the web server is at 10.0.0.10, so the destination address in the traffic matches the server and cannot explain the block. It is tempting because a mistyped address is a common cause of failed connections, and this would be correct if the exhibit showed clients targeting an address other than the server's.