How should an inbound firewall rule block a malicious IP address?

SY0-701 By islever Editorial Last updated

Short answer

B access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0

Question

During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?
  1. access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
  2. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0 Correct Answer
  3. access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
  4. access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32

Key Takeaways

The exam tests whether you understand that ACL rules match on source and destination addresses; the common trap is confusing the source and destination direction, which can accidentally block traffic to the IP rather than from it.

This SY0-701 question tests the correct syntax and direction for an inbound ACL rule designed to block a malicious source IP. Community consensus (100% votes) confirms option B as the correct answer, as it denies all traffic from the specified /32 IP to any destination.

Common mistake: The most common wrong answer is option A, which denies traffic destined to 10.1.4.9/32 rather than traffic originating from that IP. This would not block the malicious IP from accessing the network and, in fact, could block internal traffic to that address.

Expert Analysis

Why the Answer Is Correct

Option B is correct because it uses the deny action on an inbound ACL, specifies the exact malicious IP as the source using 10.1.4.9/32, and sets the destination to 0.0.0.0/0 to cover any internal host. This matches the requirement to block all incoming traffic from that specific IP address. The /32 prefix length is essential because it identifies the IP as a single host, not a subnet.

Why the Other Options Are Wrong

Option A uses the correct deny action but places the malicious IP as the destination, which would block traffic to 10.1.4.9, not from it. Options C and D use permit, which would allow traffic, directly contradicting the goal of blocking the IP. All three fail to block the source IP from accessing the network.

Community Comment Notes

Commenter [1] highlights that 10.1.4.9/32 precisely defines the malicious address and 0.0.0.0/0 covers all destinations within the network. Commenter [3] further clarifies that /32 covers all subnets but only that exact host, while 0.0.0.0/0 represents the entire internal address space. The unanimous vote for B reinforces the importance of reading the ACL rule direction carefully.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When creating an inbound ACL rule, always ask: 'What is the source and what is the destination from the perspective of the inbound interface?' For blocking an external malicious IP, the source must be that IP and the destination must be your network. Use /32 for single-host blocking and remember that deny is the action; permit would allow the traffic.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. dbrowndiver 👍 5 Answered B
    Source: 10.1.4.9/32 specifies the exact malicious IP address to block. Destination: 0.0.0.0/0 indicates all possible destinations within the network. Action: deny specifies that traffic from this source IP should be blocked. • Scenario Application: Blocking Malicious IP: This rule effectively blocks any incoming traffic from the IP address 10.1.4.9 from accessing any part of the network. Inbound Rule: As an inbound rule, it prevents traffic from the specified IP from entering the network, which aligns with the requirement to block the malicious IP. This rule directly addresses the need to block the specified IP address, fulfilling the requirement by denying access to all destinations, effectively preventing any communication from the malicious IP.
  2. SHADTECH123 👍 3 Answered B
    B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0 Explanation: This rule specifically denies all inbound traffic from the malicious IP address 10.1.4.9 to any destination within the network. This is the correct way to block the malicious IP address.
  3. Mehsotopes 👍 2 Answered B
    /32 would cover all possible subnets, & their communicating devices within the IP range, & destination 0.0.0.0/0 would cover the gateway surface of your network.
  4. shady23 👍 1 Answered B
    B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
  5. PukaSudu 👍 1 Answered B
    B. access-list inbound deny ip source 10.1.4.9/32

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide