Which ACL sequence permits only TCP destination ports 22–443 while excluding port 80?

The correct answer deny tcp any any eq 80 permit tcp any any range 22 443 works because ACLs are processed sequentially from top to bottom. The first line explicitly denies TCP traffic on destination port 80. The second line then permits TCP traffic within the range of ports 22 to 443. Since port 80 was already denied by the first statement, it is effectively excluded from the permitted range. The option deny tcp any any eq 80 permit tcp any any gt 21 lt 444 is functionally similar but uses gt (greater than) and lt (less than) which can be less precise than range for a continuous block. The option permit tcp any any range 22 443 deny tcp any any eq 80 is incorrect because the permit statement for the range 22-443 would be processed first, allowing port 80 traffic before the deny statement for port 80 is ever reached. The option permit tcp any any eq 80 is incorrect as it only permits port 80, which is the opposite of the requirement.