The answer is to modify the RDP rule to permit only from source host 192.168.1.100. This is correct because the current Cisco ASA access-list named 'outside_in' inadvertently allows RDP from any external source, as the rule order permits traffic before a more specific restriction is applied; by explicitly restricting the source IP, you enforce a principle of least privilege, ensuring only the authorized management station can initiate remote desktop sessions. On the CISSP exam, this tests your understanding of network access control and the proper configuration of a Cisco ASA access-list to restrict RDP to an authorized source, a common scenario where candidates must distinguish between blocking all traffic versus narrowing the permitted source. A frequent trap is choosing to delete unrelated rules or add logging, which does not address the unauthorized access. Remember the mnemonic “Source First” — always specify the permitted source IP before the destination to avoid unintended open access.
CISSP Security Operations Practice Question
This CISSP practice question tests your understanding of security operations. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```
access-list outside_in extended permit tcp any host 10.10.10.10 eq 80 log
access-list outside_in extended permit tcp any host 10.10.10.10 eq 443 log
access-list outside_in extended permit tcp host 192.168.1.100 host 10.10.10.10 eq 3389 log
access-list outside_in extended deny ip any any log
```
Examine the Cisco ASA access-list named 'outside_in'. A penetration tester reports that they were able to establish an RDP session from an external IP address 203.0.113.55 to the internal host 10.10.10.10 on port 3389. Which configuration change would BEST prevent this while still allowing legitimate remote administration from the authorized management station?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the RDP rule to permit only from source host 192.168.1.100
Option C is correct because the current rule permits RDP from any host (192.168.1.100 is just a sample, but the rule actually allows any host due to the order; however the correct fix is to restrict the source to only 192.168.1.100. Option A incorrectly deletes a web rule; Option B blocks all RDP; Option D only adds logging, not restriction.
Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Change the RDP rule to deny any source and add an explicit deny before the permit rules
Why it's wrong here
This would block all RDP, including from the authorized management station.
✗
Add an explicit deny rule for RDP from any source before the existing RDP rule, with logging enabled
Why it's wrong here
This would block all RDP; the authorized host would also be denied.
✗
Delete the second line (the HTTPS rule) and add a rule to deny RDP from all external sources
Why it's wrong here
Deleting HTTPS breaks a legitimate service; denying all RDP would block authorized remote administration.
✓
Modify the RDP rule to permit only from source host 192.168.1.100
Why this is correct
Restricting the source to the authorized host prevents unauthorized external RDP connections.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Standard ACLs match source addresses.
Common exam traps
Common exam trap: ACLs stop at the first match
ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.
Detailed technical explanation
How to think about this question
ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.
KKey Concepts to Remember
Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.
TExam Day Tips
→Check inbound versus outbound direction.
→Read the ACL from top to bottom.
→Look for a broader permit or deny above the intended line.
Key takeaway
ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related CISSP ACL questions on filtering logic and placement.
Security Operations — This question tests Security Operations — Standard ACLs match source addresses..
What is the correct answer to this question?
The correct answer is: Modify the RDP rule to permit only from source host 192.168.1.100 — Option C is correct because the current rule permits RDP from any host (192.168.1.100 is just a sample, but the rule actually allows any host due to the order; however the correct fix is to restrict the source to only 192.168.1.100. Option A incorrectly deletes a web rule; Option B blocks all RDP; Option D only adds logging, not restriction.
What should I do if I get this CISSP question wrong?
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related CISSP ACL questions on filtering logic and placement.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Standard ACLs match source addresses.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.