mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip access-group OUTBOUND out ! interface GigabitEthernet0/2 ip address 10.0.0.1 255.255.255.0 ip access-group INBOUND in ! access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80 access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443 access-list 100 deny ip any any ! access-list 110 permit tcp any host 10.0.0.10 eq 22 access-list 110 permit icmp any host 10.0.0.10 echo-reply access-list 110 deny ip any any
Refer to the exhibit. An administrator configures the above ACLs on a router. The goal is to allow internal users (192.168.1.0/24) to browse the web, and to allow SSH management from the internet to a server at 10.0.0.10. However, users report that they cannot browse external websites. What is the most likely reason?
⚠ Common exam trap
ISC2 often tests the concept that ACL direction is relative to the interface, not the traffic source; the trap here is that candidates assume an outbound ACL on the internal interface will filter traffic leaving the internal network, but it actually filters traffic leaving the router through that interface, which is the opposite direction for internal users' outbound traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ACL 100 is applied outbound on the internal interface, so it does not filter outbound traffic from internal users
ACL 100 is applied outbound on the internal interface (e.g., GigabitEthernet0/0). Outbound ACLs filter traffic leaving the interface, but internal users' web traffic originates from the internal network and must be allowed inbound on the internal interface (or outbound on the external interface). Since ACL 100 is applied outbound on the internal interface, it only filters traffic that has already been routed out of that interface, which is not the path for internal users' outbound web requests. The correct approach is to apply the ACL inbound on the internal interface or outbound on the external interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ACL 100 is applied outbound on the internal interface, so it does not filter outbound traffic from internal users
Why this is correct
The access-group is applied outbound on Gi0/1; traffic from internal users to the internet exits Gi0/1 inbound, so ACL 100 is not checked.
- ✗
ACL 100 does not permit DNS traffic, so users cannot resolve domain names
Why it's wrong here
The stem mentions browsing, which could be directly via IP; also DNS is not necessary if using IP addresses.
- ✗
ACL 110 blocks the return traffic from the internet
Why it's wrong here
ACL 110 is applied inbound on Gi0/2; it permits SSH and ICMP echo replies, but does not block return HTTP traffic.
- ✗
The implicit deny at the end of ACL 100 blocks established connections
Why it's wrong here
ACL 100 permits HTTP/HTTPS and then denies all; established connections are not automatically allowed unless stateful inspection is enabled.
Visual reference
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.