The correct answer is A.
* Block HTTP traffic (TCP port 80)
* Source: 10.10.10.1
* Destination: any
* Permit all other traffic
ip access-list extended 100
deny tcp host 10.10.10.1 any eq 80
permit ip any any
* deny tcp host 10.10.10.1 any eq 80 # Blocks HTTP traffic from 10.10.10.1 to any destination
* permit ip any any # Allows all other traffic
This perfectly matches the requirement.
* B. ip access-list extended 10 # Invalid - extended ACLs use ranges 100-199 or named ACLs, not 10
* C. ip access-list extended NO_HTTP # Missing permit ip any any # implicit deny all at the end blocks everything
* D. deny tcp host 10.10.10.1 eq 80 any # Incorrect syntax/order
* eq 80 is applied to destination port, not source
* This line is malformed and does not match HTTP filtering correctly
ACL evaluation rules:
* Top-down processing
* First match wins
* Implicit deny all at the end
Correct pattern for "block one thing, allow rest":
deny < specific traffic >
permit ip any any