easyMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
Mar 15 14:23:45 192.168.1.1 %FW-3-DENY: deny tcp 10.0.0.10:12345 -> 203.0.113.5:80 due to access-group INTERNET_IN
Refer to the exhibit. Based on the exhibit, why was the packet denied?
⚠ Common exam trap
ISC2 often tests the distinction between inbound and outbound ACLs, and the trap here is that candidates may confuse the direction of the ACL application (inbound vs. outbound) or assume that a packet is denied because of the source or destination IP alone, rather than focusing on the ACL rule that explicitly denies the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The packet was blocked by an inbound access list
The exhibit shows an inbound access list applied to the interface, and the packet is denied because its source IP matches a deny entry in that inbound ACL. Inbound access lists filter traffic before it is processed by the router, so the packet is dropped upon arrival. The correct answer is D because the packet was blocked by an inbound access list, as indicated by the ACL configuration and the deny action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Source IP is internal
Why it's wrong here
The source IP 10.0.0.10 is internal, but that is not the reason for denial; the access list denied it.
- ✗
The packet was blocked by an outbound access list
Why it's wrong here
The access-group is named INTERNET_IN, indicating it is an inbound access list.
- ✗
Destination IP is external
Why it's wrong here
The destination is external (203.0.113.5), but that alone does not cause denial; the access list rule caused it.
- ✓
The packet was blocked by an inbound access list
Why this is correct
The message specifies 'due to access-group INTERNET_IN', which is applied inbound.
Visual reference
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
Inbound ACL
An inbound ACL is a set of rules applied to network traffic entering an interface that decides whether to allow or block that traffic based on criteria like source IP, destination port, or protocol.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.