The correct configuration is option D because Cisco AAA method lists are processed from left to right. The existing configuration uses the default login and exec authorization method lists with only the TACACS+ group. That means if the TACACS+ server is unreachable, authentication and authorization fail unless another method is explicitly listed after the TACACS+ group. Adding local after group tacacs+ creates a fallback sequence: try TACACS+ first; if no TACACS+ response is available, use the local user database. Option C is wrong because it replaces TACACS+ with local authentication only, removing centralized AAA as the preferred method. Option B creates a named method list called FALLBACK, but it does not apply to the default login or exec process shown in the running configuration. Option A is not valid Cisco IOS AAA syntax for this requirement. This is a device-management security question focused on resilient AAA design. References/topics: ENCOR Infrastructure Security, AAA, TACACS+, local fallback, device administration, authorization method lists.

The correct answer is A.

Block HTTP traffic (TCP port 80)

Source: 10.10.10.1

Destination: any

Permit all other traffic

ip access-list extended 100

deny tcp host 10.10.10.1 any eq 80

permit ip any any

deny tcp host 10.10.10.1 any eq 80 → Blocks HTTP traffic from 10.10.10.1 to any destination

permit ip any any → Allows all other traffic

This perfectly matches the requirement.

B. ip access-list extended 10 ❌ Invalid — extended ACLs use ranges 100–199 or named ACLs, not 10

C. ip access-list extended NO_HTTP ❌ Missing permit ip any any → implicit deny all at the end blocks everything

D. deny tcp host 10.10.10.1 eq 80 any ❌ Incorrect syntax/order

eq 80 is applied to destination port, not source

This line is malformed and does not match HTTP filtering correctly

ACL evaluation rules:

Top-down processing

First match wins

Implicit deny all at the end

Correct pattern for “block one thing, allow rest”:

deny < specific traffic >

permit ip any any