easyMultiple ChoiceObjective-mapped
CISA Practice Question: Uses the access list above on its perimeter…
Exhibit
Refer to the exhibit.
```
# show access-lists
Extended IP access list 101
10 permit tcp 192.168.1.0 0.0.0.255 any eq 443
20 permit tcp 192.168.2.0 0.0.0.255 any eq 80
30 deny ip any any log
```An organization uses the access list above on its perimeter firewall. Which of the following is a valid conclusion?
⚠ Common exam trap
ISACA often tests the implicit deny all rule, where candidates mistakenly assume that traffic not explicitly permitted is allowed, when in fact it is denied by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
All HTTPS traffic from the 192.168.1.0 subnet is allowed.
The access list permits TCP traffic from source network 192.168.1.0/24 to destination port 443 (HTTPS). The permit statement for TCP with eq 443 explicitly allows HTTPS traffic from that subnet, and there is no subsequent deny statement blocking it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All HTTP traffic from the 192.168.2.0 subnet is allowed.
Why it's wrong here
Line 20 permits TCP on port 80, which is HTTP, but it says 'all HTTP traffic' is allowed, correct. Wait - actually it says 'All HTTP traffic' which is true because http is port 80. So B is also true? Let me re-read: line 20 permits tcp ... any eq 80, that is HTTP. So 'All HTTP traffic from 192.168.2.0 subnet' is allowed. That would make both A and B correct? But the question says 'a valid conclusion' singular. We need to ensure only one is correct. Actually both A and B are correct per the ACL. But then options would have two correct. Let me adjust the stem to avoid ambiguity. I'll change option B to 'All traffic from the 192.168.2.0 subnet is allowed.' That would be false because only port 80. Yes. Let's revise option B text to 'All traffic from the 192.168.2.0 subnet is allowed.' That is false. So update B text.
- ✓
All HTTPS traffic from the 192.168.1.0 subnet is allowed.
Why this is correct
Line 10 permits TCP on port 443 from that subnet.
- ✗
All traffic from the 192.168.2.0 subnet is allowed.
Why it's wrong here
Only TCP on port 80 is permitted; other traffic is denied.
- ✗
All traffic from the Internet to internal hosts is denied.
Why it's wrong here
The ACL does not show internet rules; implicit deny would deny, but not all, because the permit lines allow outbound? Actually scenario is perimeter firewall, so this ACL likely applied inbound on external interface? Without direction, it's ambiguous. Better to avoid. I'll change D to 'The ACL allows SSH traffic from 192.168.1.0 subnet.' That is false.
- ✗
All traffic from 192.168.1.0 subnet is allowed on any port.
Why it's wrong here
Only TCP on port 443 is permitted.
- ✗
All traffic from the Internet is denied.
Why it's wrong here
The ACL only shows permit statements for internal subnets; implicit deny at end, but it does not specifically deny all internet traffic, but due to implicit deny, all other traffic is denied. However, 'all traffic from the Internet' is too broad; traffic from internet to internal subnets would be denied? Actually the ACL is applied inbound on external interface? Not specified. Typically on perimeter firewall, this ACL would be applied to inbound interface from internal? But it's ambiguous. To avoid confusion, let's adjust option C to 'All traffic from 192.168.1.0 subnet is allowed on any port.' That is false. I'll modify options to ensure only A correct. Revised options for exhibit 1: A: 'All HTTPS traffic from the 192.168.1.0 subnet is allowed.' (true) B: 'All traffic from the 192.168.2.0 subnet is allowed.' (false, only HTTP) C: 'All traffic from 192.168.1.0 subnet is allowed on any port.' (false, only 443) D: 'All traffic from the Internet to internal hosts is denied.' (false, because permit lines allow outbound? Actually ACL direction matters. Let's keep simple.) I'll keep A correct and others incorrect.
- ✗
The ACL allows SSH traffic from 192.168.1.0 subnet.
Why it's wrong here
Only port 443 is permitted, not SSH.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.