Question 190
An ACL applied inbound to a user VLAN has `deny ip any any` as sequence 10 and `permit tcp 10.10.5.0 0.0.0.255 host 192.0.2.50 eq 443` as sequence 20. Users cannot reach HTTPS. What must change?
Explanation
Correct Answer
Cisco ACLs use first matching entry. A broad deny at the top matches every packet, making the later permit unreachable; reorder or narrow it deliberately.
Incorrect Answers
A duplicate permit after an unconditional deny remains unreachable. The ordering problem must be fixed before the specific permitted flow can match.
Changing HTTPS to TCP 80 would match ordinary HTTP, not the required destination port 443, and still would not bypass the earlier unconditional deny.
ACL name text is not part of packet matching and cannot affect whether execution reaches a later line after an earlier deny.





Cisco Certified Network Associate (CCNA) (200-301) Practice Tests