mediumMultiple ChoiceObjective-mapped

CCSP Practice Question: The security team notices that the request above…

Exhibit

Refer to the exhibit. The following is a log entry from a cloud load balancer:

{
  "timestamp": "2025-03-10T14:23:45Z",
  "client_ip": "203.0.113.5",
  "request_method": "POST",
  "request_uri": "/api/login",
  "response_code": 200,
  "user_agent": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
}

The security team notices that the request above is from a known malicious IP address. However, the load balancer did not block it. What is the most likely reason?

⚠ Common exam trap

ISC2 often tests the misconception that encryption (TLS) or response codes can override access control decisions, but the trap here is that candidates forget ACLs operate at a lower layer and are independent of application-layer details like user-agent or HTTP status codes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The load balancer's access control list does not include the IP address

C is correct because a load balancer's access control list (ACL) is a stateless or stateful rule set that explicitly defines which source IP addresses are allowed or denied. If the malicious IP address is not listed in the ACL, the load balancer will not block the traffic, regardless of the request's content or encryption status. The security team's observation that the request was from a known malicious IP but was not blocked directly points to a missing or incomplete ACL entry.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user-agent indicates it is a legitimate search engine
Why it's wrong here
User-agent can be spoofed and should not be trusted for access decisions.
✗
The response code indicates success
Why it's wrong here
The response code is a result, not a cause of blocking.
✓
The load balancer's access control list does not include the IP address
Why this is correct
If the IP is not in the deny list, the request will be allowed.
✗
The request was encrypted with TLS
Why it's wrong here
Encryption does not bypass access controls.

Visual reference

Go deeper

CCSP Practice Question: The security team notices that the request above…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question