easyMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A network administrator is troubleshooting a…
A network administrator is troubleshooting a connectivity issue between two segments separated by a firewall. The firewall rule allows traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. Users in 10.1.1.0/24 can access the web server at 10.2.2.10, but users in 10.2.2.0/24 cannot access a web server in 10.1.1.0/24. What is the most likely cause?
⚠ Common exam trap
ISC2 often tests the misconception that a single firewall rule allowing traffic in one direction automatically permits the return traffic, but in stateless firewalls or when stateful inspection is disabled, you must explicitly create a rule for the reverse direction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall is not stateful and does not automatically allow return traffic; a separate rule is needed.
The firewall rule only permits traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. When users in 10.2.2.0/24 initiate a connection to the web server in 10.1.1.0/24, the firewall sees a new session that does not match the existing rule (source/destination reversed). If the firewall is not stateful, it will not automatically allow the return traffic for the reverse direction, and no separate rule exists to permit that traffic, causing the connectivity failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server in 10.1.1.0 is blocking the IP range of 10.2.2.0/24.
Why it's wrong here
If the server were blocking, users in 10.1.1.0 would also be affected, but they can access it.
- ✗
The firewall rule is incorrectly applied to the wrong interface.
Why it's wrong here
The rule is applied correctly as traffic from 10.1.1.0/24 to 10.2.2.0/24 works, so interface assignment is likely correct.
- ✗
The subnet masks are misconfigured, causing routing issues.
Why it's wrong here
Subnet mask issues would cause bidirectional connectivity problems, not one-way.
- ✓
The firewall is not stateful and does not automatically allow return traffic; a separate rule is needed.
Why this is correct
Without stateful inspection, each direction requires an explicit rule. The existing rule only covers one direction.
Visual reference
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.