mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Refer to the exhibit
Exhibit
access-list 100 deny ip any any access-list 100 permit tcp any host 10.0.0.10 eq 80
Refer to the exhibit. A security analyst notices that traffic from external clients to the web server at 10.0.0.10 port 80 is being blocked. Which of the following is the MOST likely cause?
⚠ Common exam trap
The trap here is that candidates focus on the ACL content (deny vs permit) rather than the order of entries, assuming that a permit statement anywhere in the ACL will allow traffic, when in fact the first matching rule determines the action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is misordered (deny before permit)
The ACL is misordered because Cisco ACLs process rules sequentially from top to bottom, and a 'deny any' statement placed before a 'permit' statement will block all traffic, including the desired web traffic to 10.0.0.10 port 80. Since the exhibit shows a deny statement preceding the permit, the permit is never evaluated, causing the block.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL lacks a log statement
Why it's wrong here
Logging is optional and does not affect permit/deny behavior.
- ✓
The ACL is misordered (deny before permit)
Why this is correct
The deny all rule (line 1) blocks all traffic before the permit rule is evaluated.
- ✗
The web server is using port 443
Why it's wrong here
The ACL allows port 80; if the server used 443, traffic would be implicitly denied, but the exhibit shows a port 80 rule.
- ✗
The destination IP is incorrect
Why it's wrong here
The destination IP matches the web server, so this is not the issue.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.