The correct answer is that the ACL is misconfigured because the SSH deny rule is never reached. This is due to the firewall ACL evaluation order, which processes rules from top to bottom and applies the first matching rule. In this ACL, the rule "permit tcp any any eq 443" appears before the "deny tcp any any eq 22" rule, and because HTTPS traffic on port 443 is matched first, the SSH deny rule is skipped for all traffic. However, the critical flaw is that the ACL lacks an explicit deny at the end, so any traffic not matching the first two rules—including SSH—is implicitly permitted by the default "permit ip any any" that follows. On the ISC2 Certified in Cybersecurity CC exam, this tests your understanding of ACL logic and implicit permit behavior, a common trap where candidates assume a deny rule later in the list will block traffic. Remember the mnemonic: "First match wins, last rule bites"—always check the order and the implicit final action.
ISC2 CC Security Operations Practice Question
This CC practice question tests your understanding of security operations. Compare every option against the stated constraints before choosing — the best answer satisfies all requirements, not just the most obvious one. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```
[Firewall Config]
access-list 100 permit tcp any host 10.0.1.10 eq 443
access-list 100 deny tcp any any eq 22
access-list 100 permit ip any any
```
Refer to the exhibit. A security engineer reviews this firewall ACL. Which of the following best describes the security posture?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Refer to the exhibit.
```
[Firewall Config]
access-list 100 permit tcp any host 10.0.1.10 eq 443
access-list 100 deny tcp any any eq 22
access-list 100 permit ip any any
```
A
The ACL is misconfigured because the deny for SSH is never reached
The permit any any after the deny SSH will match SSH traffic, allowing it.
B
The ACL is properly ordered with most specific rules first
Why wrong: Order is correct, but the permit any any negates the deny.
C
The ACL should have a deny any any at the end to be secure
Why wrong: While a deny any any is good practice, the issue is the permit any any before it.
D
The ACL correctly allows HTTPS and denies SSH, blocking other traffic
Why wrong: The last line permits all traffic, so SSH is not blocked.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is misconfigured because the deny for SSH is never reached
Option A is correct because the ACL is evaluated top-down, and the first matching rule is applied. Since the 'permit tcp any any eq 443' rule appears before the 'deny tcp any any eq 22' rule, SSH traffic (TCP/22) is actually permitted by the implicit 'permit ip any any' that follows the explicit permit for HTTPS, or more accurately, the SSH deny is never reached because the permit for HTTPS matches all TCP traffic to port 443, but SSH traffic on port 22 is not matched by that rule; however, the key point is that the ACL lacks an explicit deny at the end, so any traffic not matching the first two rules (including SSH) is implicitly permitted by the default 'permit ip any any' at the end of the ACL, making the SSH deny rule ineffective.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The ACL is misconfigured because the deny for SSH is never reached
Why this is correct
The permit any any after the deny SSH will match SSH traffic, allowing it.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The ACL is properly ordered with most specific rules first
Why it's wrong here
Order is correct, but the permit any any negates the deny.
✗
The ACL should have a deny any any at the end to be secure
Why it's wrong here
While a deny any any is good practice, the issue is the permit any any before it.
✗
The ACL correctly allows HTTPS and denies SSH, blocking other traffic
Why it's wrong here
The last line permits all traffic, so SSH is not blocked.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the misconception that ACLs have an implicit 'deny any any' at the end, when in fact extended ACLs applied to interfaces have an implicit 'permit ip any any' unless a 'deny any any' is explicitly added.
Detailed technical explanation
How to think about this question
Cisco ACLs have an implicit 'permit ip any any' at the end of the ACL by default (for standard and extended ACLs applied to interfaces), unless an explicit 'deny any any' is added. This means that any traffic not matching an explicit deny rule will be permitted. In this scenario, SSH traffic (TCP/22) does not match the 'permit tcp any any eq 443' rule, so it falls through to the implicit permit, making the 'deny tcp any any eq 22' rule unreachable because it is placed after the permit rule but before the implicit permit, yet the implicit permit still applies after all explicit rules. The correct ordering should place the deny for SSH before any permit that could match it, and include a 'deny ip any any' at the end to block all other traffic.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The ACL is misconfigured because the deny for SSH is never reached — Option A is correct because the ACL is evaluated top-down, and the first matching rule is applied. Since the 'permit tcp any any eq 443' rule appears before the 'deny tcp any any eq 22' rule, SSH traffic (TCP/22) is actually permitted by the implicit 'permit ip any any' that follows the explicit permit for HTTPS, or more accurately, the SSH deny is never reached because the permit for HTTPS matches all TCP traffic to port 443, but SSH traffic on port 22 is not matched by that rule; however, the key point is that the ACL lacks an explicit deny at the end, so any traffic not matching the first two rules (including SSH) is implicitly permitted by the default 'permit ip any any' at the end of the ACL, making the SSH deny rule ineffective.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.