ISC2 CC ACL Direction Practice Question
Exhibit
Refer to the exhibit. ! Configuration snippet from router R1 access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80 access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443 access-list 100 deny ip any any log ! interface GigabitEthernet0/0 ip access-group 100 in !
Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?
⚠ Common exam trap
ISC2 often tests the concept that an ACL applied to the wrong interface or direction can cause selective service failures, leading candidates to mistakenly focus on missing permit statements or the implicit deny rather than the ACL placement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is applied to the wrong interface or direction.
The exhibit shows an ACL that permits both HTTP (TCP 80) and HTTPS (TCP 443) inbound on the outside interface. However, the issue is that internal users cannot initiate outbound HTTPS connections. Since the ACL is applied inbound on the outside interface, it only controls incoming traffic, not outgoing. Therefore, the most likely cause is that the ACL is applied to the wrong interface or direction. The implicit deny at the end of the ACL would block any traffic not explicitly permitted, but because the ACL correctly permits HTTPS inbound, the failure of outbound HTTPS suggests a placement error. This is a common scenario where an ACL that should be applied outbound on the inside interface is mistakenly applied inbound on the outside interface, resulting in asymmetric filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL is applied to the wrong interface or direction.
Why this is correct
If the ACL is applied inbound on the internal interface, it should work; if applied outbound on the external interface, it may block return traffic. The most likely issue is misapplication.
- ✗
The implicit deny at the end of the ACL blocks HTTPS traffic.
Why it's wrong here
The permit for port 443 comes before the deny, so HTTPS is allowed.
- ✗
The ACL is missing a permit statement for TCP port 443 return traffic.
Why it's wrong here
ACLs filter based on source/destination; return traffic is handled separately.
- ✗
The ACL explicitly denies TCP port 443.
Why it's wrong here
The ACL permits port 443.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.