How should an inbound firewall rule block a malicious IP address?
During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you understand that ACL rules match on source and destination addresses; the common trap is confusing the source and destination direction, which can accidentally block traffic to the IP rather than from it.
This SY0-701 question tests the correct syntax and direction for an inbound ACL rule designed to block a malicious source IP. Community consensus (100% votes) confirms option B as the correct answer, as it denies all traffic from the specified /32 IP to any destination.
The most common wrong answer is option A, which denies traffic destined to 10.1.4.9/32 rather than traffic originating from that IP. This would not block the malicious IP from accessing the network and, in fact, could block internal traffic to that address.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because it uses thedeny action on an inbound ACL, specifies the exact malicious IP as the source using 10.1.4.9/32, and sets the destination to 0.0.0.0/0 to cover any internal host. This matches the requirement to block all incoming traffic from that specific IP address. The /32 prefix length is essential because it identifies the IP as a single host, not a subnet.Why the Other Options Are Wrong
Option A uses the correctdeny action but places the malicious IP as the destination, which would block traffic to 10.1.4.9, not from it. Options C and D use permit, which would allow traffic, directly contradicting the goal of blocking the IP. All three fail to block the source IP from accessing the network.Community Comment Notes
Commenter [1] highlights that10.1.4.9/32 precisely defines the malicious address and 0.0.0.0/0 covers all destinations within the network. Commenter [3] further clarifies that /32 covers all subnets but only that exact host, while 0.0.0.0/0 represents the entire internal address space. The unanimous vote for B reinforces the importance of reading the ACL rule direction carefully. Official Reference
- https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-cr-a1.html
- https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center/200663-Configure-ACL-on-Secure-Firewall.html
Exam Strategy
When creating an inbound ACL rule, always ask: 'What is the source and what is the destination from the perspective of the inbound interface?' For blocking an external malicious IP, the source must be that IP and the destination must be your network. Use /32 for single-host blocking and remember that deny is the action; permit would allow the traffic.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →