Refer to the exhibit. An engineer must configure the Cisco ASA firewall to allow the client with IP indicated configuration was applied to the firewall and public DNS 4.4.4.4 is used for name…

Question

Exhibit

Options

• ARemove rule 3
• BMove rule 5 to the top
• CRemove rule 7
• DMove rule 6 to the top

• A
  66% (21)
• B
  19% (6)
• C
  9% (3)
• D
  6% (2)

Explanation

Removing rule 3 is correct because Cisco ASA processes ACL rules top-down, first-match wins. Rule 3 is an explicit deny that matches the client's traffic (likely blocking DNS to 4.4.4.4 or HTTP/HTTPS to the destination URL) before any permit rule further down the list can take effect. Since the deny hits first, the client is blocked regardless of the permit rules below it - removing rule 3 lets the traffic fall through to the correct permit rule.

Why the distractors are wrong:

• B (Move rule 5 to top): Even if rule 5 is a valid permit, the real problem is rule 3's deny - moving a permit above a deny it doesn't conflict with doesn't solve the root cause.
• C (Remove rule 7): Rule 7 appears later in the list and never gets evaluated for this client's traffic because rule 3 already matched and denied it first; removing rule 7 changes nothing.
• D (Move rule 6 to top): Same logic as B - reordering a permit rule doesn't help when an earlier deny is still present and still matches the traffic.

Memory tip: On ASA ACL questions, always ask "what rule matches first?" - a stray deny rule above your permit is the classic gotcha. When a client is blocked despite a permit existing, look for a shadowing deny higher in the list, not a missing permit lower in the list.

No community discussion yet for this question.