CND Network Perimeter Protection Practice Question

An administrator is configuring a Cisco ASA firewall and needs to allow internal users to initiate outbound HTTP/HTTPS sessions while ensuring that return traffic is permitted through the stateful inspection engine without opening explicit inbound rules. Which object-group and access-list construct properly permits outbound web traffic?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

access-list INSIDE_IN extended permit tcp any any eq www and access-list INSIDE_IN extended permit tcp any any eq 443, applied via access-group INSIDE_IN in interface inside

Stateful firewalls automatically track outbound connections, so allowing outbound traffic on ports 80 and 443 via an access-list applied to the inside interface is sufficient.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
access-list OUTBOUND extended permit tcp any any eq 80 and access-group OUTBOUND in interface outside
Why it's wrong here
Applying an inbound rule to the outside interface would block outbound traffic initiated from the inside.
✗
static (inside,outside) tcp interface 80 192.168.1.10 80 netmask 255.255.255.255
Why it's wrong here
A static NAT mapping exposes an internal server inbound, which is not required for outbound browsing.
✗
object network WEB_PORTS; range 80 443; nat (inside,outside) dynamic interface
Why it's wrong here
NAT translates IP addresses, not ports in this manner for outbound dynamic session inspection.
✓
access-list INSIDE_IN extended permit tcp any any eq www and access-list INSIDE_IN extended permit tcp any any eq 443, applied via access-group INSIDE_IN in interface inside
Why this is correct
This correctly permits outbound web traffic originating from the inside interface.

About these practice questions

This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official EC-Council exam blueprint

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Scored practice sessions

Quick scored rounds with instant marking and a written explanation per question.

CND Practice Exam 4 — 20 Questions→CND Practice Test 5 — 25 Questions→

Practice by domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Network Perimeter Protection Network Attacks And Defense Strategies Application And Data Protection

Filter by question format

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Go deeper on a topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Network Perimeter Protection practice questions CND fundamentals practice questions Network Security Controls Protocols And Devices practice questions Enterprise Cloud Virtual And Wireless Network Protection practice questions

Where to go next

All EC-Council practice questions All CND questions CND practice test

This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.