CCNA Plan

CCNA practice question: Security Fundamentals

Security FundamentalsDifficulty 3/5

Which ACL entry permits only hosts in 10.1.2.0/24 to reach server 10.9.9.9 on HTTPS?

  1. Aaccess-list 110 permit ip host 10.9.9.9 10.1.2.0 0.0.0.255
  2. Baccess-list 110 permit tcp any host 10.9.9.9 eq 80
  3. Caccess-list 10 permit 10.1.2.0 0.0.0.255
  4. Daccess-list 110 permit tcp 10.1.2.0 0.0.0.255 host 10.9.9.9 eq 443
Show answer and rationale

Correct: D. An extended ACL matches protocol, source, destination and port. The wildcard 0.0.0.255 covers the /24 source, 'host 10.9.9.9' is the destination and 'eq 443' is HTTPS. The implicit deny drops everything else.

  • C — A standard ACL cannot match destination or port.
  • A — Source and destination are reversed, and 'ip' allows all protocols.
  • B — 'any' allows every source and 80 is HTTP.

Concept being tested

Threats and mitigation, device access control, password policy, IPsec/VPN concepts, ACLs, Layer 2 security (DHCP snooping, DAI, port security), AAA, wireless security and WPA2/WPA3. — 15% of the exam. Study guide for Security Fundamentals.

Related questions

Practice this topic

Blueprint-mapped questions with full rationales for every choice.

Start practice

Primary references

  1. CCNA Exam v1.1 (200-301) Exam Topics — Cisco Systems · primary · retrieved 2026-09-21, verified 2026-09-21
Draft — pending editorial reviewHow we verify facts