hardMultiple Choice
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
rule deny any 10.0.0.0/8 log rule permit any 10.0.0.0/8 any rule deny any any log
Refer to the exhibit. A firewall rule set is shown (first match applies). An analyst reviews these rules. Which of the following best describes the traffic outcome for a packet from source IP 10.0.0.1 to destination 192.168.1.1?
⚠ Common exam trap
ISC2 often tests the 'first match applies' concept by placing a broad deny rule early in the rule set, leading candidates to incorrectly assume that a later permit rule will override it, when in fact the packet is denied immediately upon the first match.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The packet is denied because rule 1 matches and denies it.
Rule 1 matches the source IP 10.0.0.1 (which falls within the 10.0.0.0/8 range) and the destination 192.168.1.1 (within 192.168.1.0/24), and since the action is 'deny', the packet is denied immediately. Firewalls using 'first match applies' logic stop processing as soon as a matching rule is found, so subsequent rules are never evaluated. Therefore, the correct outcome is denial.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The packet is permitted because the last rule permits any any.
Why it's wrong here
The final permit-any rule is never evaluated for this packet, because first-match processing stops at the earlier rule that matches 10.0.0.1 to 192.168.1.1 and drops it. A trailing permit-any is tempting as a catch-all safety net, and would decide the outcome only for traffic matching no preceding rule.
- ✓
The packet is denied because rule 1 matches and denies it.
Why this is correct
Firewall rulesets evaluate top-down and stop at the first match, so rule 1's deny for that source takes effect before any later permit is reached. The packet never reaches subsequent rules, making the outcome a denial rather than an allow.
- ✗
The packet is permitted because rule 2 explicitly permits the traffic.
Why it's wrong here
Rule 2 does not match this packet, so its permit cannot apply; first-match evaluation reaches the rule that does match the 10.0.0.1 to 192.168.1.1 flow and denies it. Explicit permits are tempting because analysts assume any listed permit governs, yet each rule only applies to the addresses in its own source and destination fields.
- ✗
The packet is denied because there is no explicit permit for 10.0.0.0/8 to 192.168.1.0/24.
Why it's wrong here
Denial here comes from an explicit matching deny rule, not from absence of a permit; the rule set's first match for 10.0.0.1 to 192.168.1.1 is a drop entry. Implicit deny-by-default is tempting because it is the standard firewall behaviour, but it applies only after every explicit rule has been checked and none matched.
Go deeper
Related to this question
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.