Which extended ACL configuration denies HTTP from 192.168.240.0/20 to 10.125.128.32/27 but allows 192.168.240.0/20 to reach the rest of 10.0.0.0/8?

The correct option effectively denies HTTP (port 80) from the source network 192.168.240.0/20 (wildcard 0.0.15.255) to the specific destination 10.125.128.32/27 (wildcard 0.0.0.31) with the first line. The second line then permits all other IP traffic from the 192.168.240.0/20 network to the broader 10.0.0.0/8 network (wildcard 0.255.255.255), ensuring the desired "rest of 10.0.0.0/8" access. The implicit "deny any any" at the end of all ACLs means the explicit "deny ip any any log" on line 30 is redundant but harmless. The first incorrect option uses port 443 (HTTPS) instead of 80 (HTTP) and has incorrect wildcard masks. The third incorrect option reverses source and destination in the first line and uses port 443. The fourth incorrect option includes an unnecessary "deny tcp 192.168.240.0 0.0.15.255 any eq 80" which would block all HTTP traffic, not just to the specific host, and also has an incorrect final deny statement.