hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
rule deny any 10.0.0.0/8 log rule permit any 10.0.0.0/8 any rule deny any any log
Refer to the exhibit. A firewall rule set is shown (first match applies). An analyst reviews these rules. Which of the following best describes the traffic outcome for a packet from source IP 10.0.0.1 to destination 192.168.1.1?
⚠ Common exam trap
ISC2 often tests the 'first match applies' concept by placing a broad deny rule early in the rule set, leading candidates to incorrectly assume that a later permit rule will override it, when in fact the packet is denied immediately upon the first match.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The packet is denied because rule 1 matches and denies it.
Rule 1 matches the source IP 10.0.0.1 (which falls within the 10.0.0.0/8 range) and the destination 192.168.1.1 (within 192.168.1.0/24), and since the action is 'deny', the packet is denied immediately. Firewalls using 'first match applies' logic stop processing as soon as a matching rule is found, so subsequent rules are never evaluated. Therefore, the correct outcome is denial.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The packet is permitted because the last rule permits any any.
Why it's wrong here
The last rule denies any any, not permits; also, earlier match prevents further processing.
- ✓
The packet is denied because rule 1 matches and denies it.
Why this is correct
First-match logic: rule 1 matches and denies before rule 2 can permit.
- ✗
The packet is permitted because rule 2 explicitly permits the traffic.
Why it's wrong here
Rule 2 is never reached because rule 1 already matched.
- ✗
The packet is denied because there is no explicit permit for 10.0.0.0/8 to 192.168.1.0/24.
Why it's wrong here
Rule 2 permits all traffic from 10.0.0.0/8 to any, but rule 1 overrides.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.