hardMultiple ChoiceObjective-mapped
CISA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. SW1(config)# access-list 101 permit tcp any host 10.0.0.100 eq 443 SW1(config)# access-list 101 deny tcp any host 10.0.0.100 eq 80 SW1(config)# access-list 101 permit ip any any SW1(config)# interface vlan 10 SW1(config-if)# ip access-group 101 in
Refer to the exhibit. An administrator applied this ACL to a VLAN interface. The server at 10.0.0.100 hosts a web application. What is the effect of this ACL?
⚠ Common exam trap
The trap here is that candidates often overlook the 'permit ip any any' at the end of the ACL and incorrectly assume that only the explicitly permitted HTTPS traffic is allowed, missing that this catch-all statement permits all other traffic, including HTTP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allows HTTPS, but HTTP is allowed as well due to the permit ip any any
The ACL shown permits HTTPS (TCP port 443) from any source to the server at 10.0.0.100, and then has a 'permit ip any any' statement at the end. Because ACLs are processed top-down, the first match wins; HTTPS traffic matches the first line and is permitted, while HTTP (TCP port 80) is not explicitly denied, so it matches the 'permit ip any any' line and is also allowed. Thus, both HTTP and HTTPS are permitted, making option A correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Allows HTTPS, but HTTP is allowed as well due to the permit ip any any
Why this is correct
The permit ip any any overrides the deny.
- ✗
Allows HTTPS, blocks HTTP, and blocks all other traffic
Why it's wrong here
The permit ip any any allows all other traffic.
- ✗
Blocks both HTTP and HTTPS
Why it's wrong here
HTTPS is permitted.
- ✗
Only allows HTTP and blocks HTTPS
Why it's wrong here
Opposite of intended.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.