easyMultiple ChoiceObjective-mapped
SSCP Practice Question: A network administrator implements the firewall…
Exhibit
Refer to the exhibit. Extracted from firewall rulebase: Rule 1: permit src any dst any port 80 (http) Rule 2: permit src any dst any port 443 (https) Rule 3: deny src 10.0.0.0/8 dst any
A network administrator implements the firewall rules above. What is the effect of this rulebase?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed
Firewall rules are processed top-down; the first match applies. Rule 1 permits HTTP/HTTPS traffic from source 10.0.0.0/8 to any destination. Rule 2 permits similar traffic from other networks (but that is irrelevant). Rule 3 denies all traffic from 10.0.0.0/8, but because Rule 1 matches first for HTTP/HTTPS from that network, the deny rule is never evaluated for those protocols. Therefore, HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed, making option B correct. Options A and C are incorrect due to the logic above. Option D is incorrect because the deny rule is not redundant; it blocks non-HTTP/HTTPS traffic from 10.0.0.0/8, which would otherwise be implicitly denied anyway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP and HTTPS traffic from all networks is blocked
Why it's wrong here
Rules 1 and 2 permit HTTP/HTTPS from any source.
- ✓
HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed
Why this is correct
The permit rules (1 and 2) are listed before the deny rule, so they match first.
- ✗
All traffic from the 10.0.0.0/8 network is blocked
Why it's wrong here
The deny rule only blocks traffic that hasn't matched earlier permit rules; HTTP/HTTPS are permitted.
- ✗
The deny rule is redundant because permit rules exist
Why it's wrong here
The deny rule is not redundant; it blocks non-HTTP/HTTPS traffic from that subnet.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.