hardMultiple ChoiceObjective-mapped
CISA Practice Question: Refer to the exhibit
Exhibit
access-list extended BLOCK-MALICIOUS deny ip 10.0.1.0 0.0.0.255 any deny tcp any host 192.168.1.100 eq 443 permit ip 10.0.0.0 0.0.255.255 any
Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?
⚠ Common exam trap
It's easy for candidates to assume a broader permit rule (like the third rule) will override a more specific deny rule, but they forget that firewall rules are evaluated top-down and the first match wins, so the deny rule takes precedence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The first rule blocks all traffic from 10.0.1.0/24
The first rule in the exhibit explicitly denies all traffic from the 10.0.1.0/24 subnet, which is the source subnet in the scenario. Since firewall rules are processed sequentially from top to bottom, this deny rule matches the traffic before any subsequent permit rules can be evaluated, making the host at 192.168.1.100:443 unreachable from that subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The first rule blocks all traffic from 10.0.1.0/24
Why this is correct
Correct: The deny rule for the subnet overrides any permit.
- ✗
The second rule blocks HTTPS traffic from any source to the host
Why it's wrong here
Second rule blocks HTTPS from any source, but first rule already blocks all traffic from 10.0.1.0/24.
- ✗
The third rule permits all traffic from the 10.0.0.0/16 subnet
Why it's wrong here
The permit rule applies to a larger subnet, but the first rule is more specific and blocks the 10.0.1.0/24 range.
- ✗
The firewall is misconfigured for TCP traffic
Why it's wrong here
Configuration is explicit; no general misconfiguration.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.