Courseiva
← CC
Full test
mediumMultiple ChoiceObjective-mapped

Access Control List (ACL): Permitting HTTP Traffic While Denying All Other IP Traffic

Exhibit

Refer to the exhibit.

Router# show running-config | section interface GigabitEthernet0/1
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group BLOCK_HTTP in
!
ip access-list extended BLOCK_HTTP
 deny tcp any any eq 80
 permit ip any any

A client at 192.168.1.100 attempts to access a web server at 10.0.0.1. The router's interface IP is 192.168.1.1.

Based on the exhibit, what is the most likely result of the client's HTTP request?

Quick Answer

The correct answer is that the HTTP request is blocked, but other traffic from the client is allowed. This result occurs because the extended ACL is applied inbound on the client’s interface and explicitly permits TCP traffic from the client to the server on port 80 (HTTP), while a subsequent implicit deny statement blocks all other IP traffic. However, the exhibit shows the ACL is misconfigured or applied in reverse order, causing the HTTP permit rule to be bypassed, so the HTTP request is denied, but any non-HTTP traffic from the client—such as DNS or ICMP—is still permitted by the explicit permit statement. On the ISC2 Certified in Cybersecurity CC exam, this tests your ability to read ACL sequence and direction: a common trap is assuming the first matching rule is the only one that matters, but the implicit deny at the end blocks everything not explicitly allowed. Remember the mnemonic “First match wins, but implicit deny is last” to avoid misreading ACL behavior.

⚠ Common exam trap

ISC2 often tests the misconception that if an ACL blocks HTTP traffic from a client, then all traffic from that client is blocked. However, this ACL specifically denies only HTTP (port 80) and permits all other IP traffic, so other traffic like DNS or ICMP is allowed. Candidates may incorrectly choose Option C thinking all traffic is blocked.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The HTTP request is blocked, but other traffic from the client is allowed.

The exhibit shows an extended ACL applied inbound on the client's interface that denies TCP traffic from the client to the server on port 80 (HTTP) but permits all other IP traffic. Therefore, the HTTP request is blocked, but any other traffic from the client (e.g., DNS, ICMP) is allowed. Option D correctly states that the HTTP request is blocked but other traffic is allowed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The HTTP request is permitted because the ACL is applied to the wrong interface.

    Why it's wrong here

    The ACL is correctly applied inbound on the client's subnet interface; it will filter traffic coming from clients.

  • ✗

    The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.

    Why it's wrong here

    The ACL does not filter based on source IP; it blocks TCP port 80 from any source.

  • ✗

    The HTTP request is blocked, and all other traffic from the client is also blocked.

    Why it's wrong here

    The permit ip any any allows all other traffic.

  • ✓

    The HTTP request is blocked, but other traffic from the client is allowed.

    Why this is correct

    The ACL denies TCP port 80, then permits all other IP traffic.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on CC

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. Based on the exhibit, why was the packet denied?

easy
  • A.Source IP is internal
  • B.The packet was blocked by an outbound access list
  • C.Destination IP is external
  • ✓ D.The packet was blocked by an inbound access list

Why D: The exhibit shows an inbound access list applied to the interface, and the packet is denied because its source IP matches a deny entry in that inbound ACL. Inbound access lists filter traffic before it is processed by the router, so the packet is dropped upon arrival. The correct answer is D because the packet was blocked by an inbound access list, as indicated by the ACL configuration and the deny action.

Variation 2. Refer to the exhibit. Based on the exhibit, which traffic will be permitted?

medium
  • A.All traffic from 192.168.1.100
  • B.All traffic from 10.0.1.0/24
  • C.SSH traffic from any source to 192.168.1.100
  • ✓ D.HTTP traffic from any source to 192.168.1.100

Why D: The exhibit shows an access control list (ACL) that permits TCP traffic from any source to destination host 192.168.1.100 on port 80 (HTTP). The ACL entry is `permit tcp any host 192.168.1.100 eq 80`, which matches only HTTP traffic. Therefore, only HTTP traffic from any source to 192.168.1.100 is permitted.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.