easyMultiple ChoiceObjective-mapped

CISA Overly permissive ACL Practice Question

Exhibit

Refer to the exhibit.

[admin@fw1]# show rules
Rule 10: allow from 10.0.1.0/24 to 10.0.2.0/24 dst-port 3306
Rule 20: allow from 10.0.1.0/24 to any dst-port 443
Rule 30: allow from any to 10.0.2.0/24 dst-port 22

During a security audit, which rule poses the greatest risk?

⚠ Common exam trap

The trap here is that candidates may focus on rules that deny traffic or are too restrictive, but the greatest risk is actually an overly permissive rule that grants broad access, such as allowing SSH from any source.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Rule 30

Rule 30 is the correct answer because it allows SSH access from any source (0.0.0.0/0) without restriction. In a security audit, an ACL entry that permits SSH from any IP address poses the greatest risk as it exposes the management interface to potential brute-force attacks and unauthorized access, violating the principle of least privilege.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Rule 20
Why it's wrong here
Rule 20 allows HTTPS from a specific source to any destination, which is low risk.
✓
Rule 30
Why this is correct
Rule 30 allows SSH from any source, posing a high risk.
✗
None of the rules pose a risk
Why it's wrong here
Rule 30 is clearly a risk.
✗
Rule 10
Why it's wrong here
Rule 10 restricts access to a specific source and port (MySQL).

Visual reference

Go deeper

CISA Overly permissive ACL Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question