Troubleshooting Access Lists for Secure Server Access

300-410 By islever Editorial Last updated

Short answer

C Permit tcp port 443 to allow secure HTTPS access to the server as implied by the requirement.

Question

Exhibit: Troubleshooting Access Lists for Secure Server Access
Refer to the Exhibit. The access-lists are configured on the network device. There is a server behind the network device. User are trying to access the server securely however they are not able to access it. What changes would you recommend to the above configuration?
  1. Permit tcp port 465
  2. Permit tcp port 3389
  3. Permit tcp port 443 Correct Answer
  4. Permit tcp any any

Key Takeaways

The main trap is misidentifying the protocol associated with 'secure access'; HTTPS (443) is the standard, not RDP or SMTPS.

This question tests knowledge of standard secure network ports. The correct solution involves permitting TCP port 443 for HTTPS access.

Common mistake: Candidates often choose 'any any' (D) thinking it's the easiest fix, ignoring the principle of least privilege, or select RDP (B) assuming remote management.

Expert Analysis

The scenario describes users attempting to access a server 'securely' but failing due to an access-list configuration. In Cisco certification contexts, the term 'securely' when referring to general user-to-server access almost invariably implies HTTPS (Hypertext Transfer Protocol Secure). The standard port for HTTPS is TCP 443. Therefore, the access list must explicitly permit traffic destined for this port.

Option C suggests permitting TCP port 443. Although the option text in some dumps may be syntactically abbreviated (e.g., 'Permit tcp port 443'), it represents the correct logical action: allowing inbound HTTPS traffic. Option A (port 465) is for SMTPS, which is not the standard secure web access method. Option B (port 3389) is for RDP, which is typically considered remote desktop management rather than general 'secure access' in this context unless specified otherwise. Option D ('any any') is overly permissive and violates the principle of least privilege; while it would technically allow access, it is rarely the recommended configuration change in a troubleshooting exam question that asks for a specific fix to a security policy.

Key Insight: The trap here is interpreting 'securely' broadly. Candidates might think of SSH (22) or RDP (3389), but without further specification, HTTPS (443) is the default assumption for secure client-server communication. Getting this wrong leads to opening unnecessary ports or blocking the actual required service.

Operational Consequence: Failing to permit port 443 results in continued connectivity failure for web-based secure applications. Conversely, permitting 'any any' creates a significant security vulnerability by exposing all TCP services on the server.

Exam Strategy

Always map descriptive terms like 'secure', 'encrypted', or 'private' to their most common standard protocols first. For web access, assume HTTPS (443). For email, consider SMTPS (465/587). Avoid 'any' statements unless the scenario explicitly demands broad access or no other specific port fits.

Frequently Asked Questions

Why is port 443 preferred over 3389 for 'secure access'?

Port 443 is the standard for HTTPS, used for secure web browsing and API calls. Port 3389 is for Remote Desktop Protocol (RDP), which is specific to Windows remote administration, not general secure data access.

Is 'Permit tcp port 443' valid IOS syntax?

Strictly speaking, IOS requires 'permit tcp any any eq 443'. However, exam questions often abbreviate the intent. The core concept is allowing traffic on port 443.

More 300-410 FAQ →

Community Votes

C
50%
D
50%

50% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. ellen_AA 👍 4
    Permit tcp port 443 doesn't exist!! should be: permit tcp ip any any eq 443
  2. forccnp 👍 4
    given answer is correct. same question #125
  3. Rebeen.Ra 👍 1 Answered C
    Secure Access Requirement: Secure web traffic (HTTPS) relies on TCP port 443, not UDP secure TCP-based traffic to the server is blocked. Adding a permit statement for TCP port 443 will resolve the issue.
  4. ciscotopics 👍 1 Answered D
    We have not been told that we are dealing with a web server. It could be a server offering any type of service. The most logical option is to permit all tcp traffic.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Debug IP Packet Timestamps Configuration on R4

S-grade

SNMP ifindex Persist Global vs Interface

S-grade

What Is the Purpose of DHCPv6 Guard?

S-grade

Which Command Enables IP SLA Responder on R201 for TCP Connect?

S-grade

Practice All 300-410 Questions

Access 159 questions with complete answers and detailed explanations.

View Full 300-410 Practice Test →

← Back to 300-410 Study Guide