- A
The routing table on the firewall does not have a return route to the Finance subnet.
Why wrong: Management VLAN can reach the server, so routing is configured correctly.
- B
The firewall lacks a policy permitting traffic from the inside zone to the DMZ zone.
Firewall policies are zone-based; the inside-to-DMZ policy is missing, blocking Finance traffic.
- C
The DMZ ACL is blocking traffic from the Finance subnet because it only permits from Management subnet.
Why wrong: The DMZ ACL permits TCP/443 from any, so it does not block Finance.
- D
An ACL applied inbound on the inside interface is blocking Finance traffic but allowing Management traffic.
Why wrong: The stem states there is no ACL on the inside interface, and even if there were, it would need to differentiate between VLANs, which is not typical.
Quick Answer
The answer is that the firewall lacks a policy permitting traffic from the inside zone to the DMZ zone. This is the most likely cause because the firewall uses a default-deny policy between security zones, meaning that even with correct routing and a permissive ACL on the DMZ interface, traffic from the Finance VLAN (inside zone) to the DMZ server is silently dropped by the stateful inspection engine unless an explicit zone-based policy allows it. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of zone-based firewall architecture, where policies govern inter-zone traffic separately from interface ACLs—a common trap is assuming that a permissive ACL on the destination interface alone is sufficient. Remember the memory tip: “Zones before ACLs—if the zone policy denies, the ACL never gets a say.”
ISC2 CC Network Security Practice Question
This CC practice question tests your understanding of network security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are the network security lead for a medium-sized financial firm with 500 employees. The network consists of a core switch, distribution switches, and access switches. There are three main VLANs: VLAN 10 (Management - 192.168.10.0/24), VLAN 20 (Finance - 192.168.20.0/24), and VLAN 30 (Guest Wi-Fi - 192.168.30.0/24). The network uses a single firewall with three interfaces: inside (trusted), outside (untrusted), and DMZ. The firewall is configured with default-deny rules. Recently, the helpdesk reported that employees in the Finance VLAN cannot access a web-based accounting application hosted on a server at 10.0.0.5, which is in the DMZ. The server's default gateway is the firewall's DMZ interface (10.0.0.1). The accounting application runs on HTTPS (TCP 443). Employees in the Management VLAN can access the application without issue. You have verified that the Finance VLAN has connectivity to the firewall's inside interface (192.168.20.1). The firewall's inside interface has an IP of 192.168.20.1. There is no ACL on the inside interface. The firewall's DMZ interface has an ACL permitting TCP/443 from any to 10.0.0.5. The firewall's routing table shows a route to 10.0.0.0/24 via DMZ interface. What is the most likely cause of the issue?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"most likely"Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
The firewall lacks a policy permitting traffic from the inside zone to the DMZ zone.
The firewall uses a default-deny policy between zones. Even though the inside interface has no ACL and the DMZ ACL permits HTTPS from any source, the firewall still requires an explicit policy rule allowing traffic from the inside (Finance) zone to the DMZ zone. Without this policy, packets from VLAN 20 to the DMZ server are dropped by the firewall's stateful inspection engine, regardless of interface ACLs or routing.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The routing table on the firewall does not have a return route to the Finance subnet.
Why it's wrong here
Management VLAN can reach the server, so routing is configured correctly.
- ✓
The firewall lacks a policy permitting traffic from the inside zone to the DMZ zone.
Why this is correct
Firewall policies are zone-based; the inside-to-DMZ policy is missing, blocking Finance traffic.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
The DMZ ACL is blocking traffic from the Finance subnet because it only permits from Management subnet.
- ✗
An ACL applied inbound on the inside interface is blocking Finance traffic but allowing Management traffic.
Why it's wrong here
The stem states there is no ACL on the inside interface, and even if there were, it would need to differentiate between VLANs, which is not typical.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between interface ACLs and zone-based firewall policies, trapping candidates into thinking that permissive ACLs alone allow traffic, when in fact a zone-pair policy is required for inter-zone communication.
Detailed technical explanation
How to think about this question
In a zone-based firewall (ZBF) or similar stateful firewall, traffic between zones must be explicitly permitted by a policy map that defines allowed traffic flows. Even if interface ACLs are permissive, the firewall's control plane will drop packets that do not match a zone-pair policy. This is a common misconfiguration when moving from a legacy ACL-only design to a zone-based security model, where the default action between zones is deny.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Network Security — study guide chapter
Learn the concepts, then practise the questions
- →
Network Security practice questions
Targeted practice on this topic area only
- →
All CC questions
500 questions across all exam domains
- →
ISC2 Certified in Cybersecurity CC study guide
Full concept coverage aligned to exam objectives
- →
CC practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CC practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Access Controls Concepts practice questions
Practise CC questions linked to Access Controls Concepts.
Business Continuity, DR & Incident Response practice questions
Practise CC questions linked to Business Continuity, DR & Incident Response.
Security Principles practice questions
Practise CC questions linked to Security Principles.
Network Security practice questions
Practise CC questions linked to Network Security.
Security Operations practice questions
Practise CC questions linked to Security Operations.
CC fundamentals practice questions
Practise CC questions linked to CC fundamentals.
CC scenario practice questions
Practise CC questions linked to CC scenario.
CC troubleshooting practice questions
Practise CC questions linked to CC troubleshooting.
Practice this exam
Start a free CC practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CC question test?
Network Security — This question tests Network Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The firewall lacks a policy permitting traffic from the inside zone to the DMZ zone. — The firewall uses a default-deny policy between zones. Even though the inside interface has no ACL and the DMZ ACL permits HTTPS from any source, the firewall still requires an explicit policy rule allowing traffic from the inside (Finance) zone to the DMZ zone. Without this policy, packets from VLAN 20 to the DMZ server are dropped by the firewall's stateful inspection engine, regardless of interface ACLs or routing.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More CC practice questions
- A security analyst discovers that a user's account has been used to access sensitive data outside of normal business hou…
- An organization wants to ensure that data remains unaltered during transmission over the internet. Which security goal i…
- A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job…
- A company's network uses 802.1X authentication with PEAP-MSCHAPv2 on wired ports. Users report that after a recent switc…
- During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field…
- A security operations team is implementing a new SIEM solution. They want to ensure that logs from all critical systems…
Last reviewed: Jun 30, 2026
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.