nerdexam
CompTIA

SY0-501 · Question #293

A security analyst is reviewing the following packet capture of an attack directed at a company's server located in the DMZ: Which of the following ACLs provides the BEST protection against the…

The correct answer is C. Deny IP from 192.168.1.10/32 to 0.0.0.0/0. This question tests the ability to write a targeted ACL that blocks all traffic from a specific attacking IP address while minimizing collateral impact on legitimate users and services.

Submitted by satoshi_tk· Mar 4, 2026Security architecture

Question

A security analyst is reviewing the following packet capture of an attack directed at a company's server located in the DMZ:

Which of the following ACLs provides the BEST protection against the above attack and any further attacks from the same IP, while minimizing service interruption?

Options

  • ADENY TCO From ANY to 172.31.64.4
  • BDeny UDP from 192.168.1.0/24 to 172.31.67.0/24
  • CDeny IP from 192.168.1.10/32 to 0.0.0.0/0
  • DDeny TCP from 192.168.1.10 to 172.31.67.4

How the community answered

(69 responses)
  • A
    6% (4)
  • B
    3% (2)
  • C
    80% (55)
  • D
    12% (8)

Why each option

This question tests the ability to write a targeted ACL that blocks all traffic from a specific attacking IP address while minimizing collateral impact on legitimate users and services.

ADENY TCO From ANY to 172.31.64.4

This entry contains a typo ('TCO' instead of 'TCP') and blocks all TCP traffic from any source to the target server, which would disrupt legitimate users accessing the DMZ server.

BDeny UDP from 192.168.1.0/24 to 172.31.67.0/24

Denying UDP from the entire 192.168.1.0/24 subnet is overly broad, blocking legitimate users on that subnet rather than isolating only the attacking host, causing unnecessary service interruption.

CDeny IP from 192.168.1.10/32 to 0.0.0.0/0Correct

Denying all IP traffic (any protocol) from the specific attacking host 192.168.1.10/32 to any destination (0.0.0.0/0) is the most precise and comprehensive block - the /32 host mask ensures only the attacker's IP is affected, not the entire subnet. Using 'IP' covers all protocols (TCP, UDP, ICMP, etc.), preventing the attacker from pivoting to other attack vectors. This minimizes service interruption because no other users or subnets are blocked.

DDeny TCP from 192.168.1.10 to 172.31.67.4

While this targets the correct attacking IP, it only blocks TCP traffic to a single destination host, leaving the attacker free to use other protocols (UDP, ICMP) or target other hosts in the DMZ.

Concept tested: ACL design to block specific attacking host

Source: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

Topics

#ACL#IP filtering#firewall rules#network traffic control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice