mediumMultiple ChoiceObjective-mapped
ISC2 CC Implicit Deny Practice Question
Exhibit
Refer to the exhibit. ``` [Firewall Config] access-list 100 permit tcp any host 10.0.1.10 eq 443 access-list 100 deny tcp any any eq 22 access-list 100 permit ip any any ```
Refer to the exhibit. A security engineer reviews this firewall ACL. Which of the following best describes the security posture?
⚠ Common exam trap
A common pitfall is believing that standard ACLs end with an implicit permit. In reality, they end with an implicit deny. Also, assuming a later deny is always unreachable if there is an earlier permit; the order of rules matters, and in this ACL the deny for SSH is effective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL correctly allows HTTPS and denies SSH, blocking other traffic
Standard ACLs have an implicit deny all at the end. In this ACL, the explicit deny for SSH (port 22) is reachable because there is no earlier permit rule that matches SSH. The permit for HTTPS (port 443) allows that traffic, and the implicit deny blocks all other traffic. Therefore, the ACL correctly allows HTTPS, denies SSH, and denies everything else, providing a specific security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL is misconfigured because the deny for SSH is never reached
Why it's wrong here
Incorrect. The deny for SSH is reachable because there is no earlier permit rule that matches SSH (port 22). The implicit deny at the end does not affect the explicit deny.
- ✗
The ACL is properly ordered with most specific rules first
Why it's wrong here
Incorrect. The ordering may be proper, but this option does not describe the overall security posture (what traffic is allowed or denied).
- ✗
The ACL should have a deny any any at the end to be secure
Why it's wrong here
Incorrect. Adding an explicit 'deny any any' is redundant because the implicit deny already blocks all other traffic. It does not change the security posture.
- ✓
The ACL correctly allows HTTPS and denies SSH, blocking other traffic
Why this is correct
Correct. The ACL allows HTTPS (permit), denies SSH (explicit deny), and blocks all other traffic (implicit deny).
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Implicit deny
Implicit deny is a security rule that automatically blocks any network traffic that is not explicitly allowed by an access control list or firewall rule.
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.