Access Control Lists Practice Questions

Answers and explanations appear when you work through the set above.

1. Given this configuration: access-list 1 deny 172.16.2.0 0.0.0.255, followed by access-list 1 permit any, applied outbound on an interface, what traffic does this ACL actually block?

   • All traffic from any source
   • Traffic sourced from the 172.16.2.0/24 network leaving that interface, while permitting all other traffic
   • Traffic destined to 172.16.2.0/24 only
   • Nothing, because the permit any statement overrides the deny

2. A nonempty IPv4 ACL is applied to an interface. A forwarded packet matches none of its explicit entries. What happens to that packet?

   • All traffic is permitted by default since no explicit deny was typed
   • The ACL fails to apply until a permit statement is added
   • All traffic not explicitly permitted is dropped, due to the implicit deny any at the end of every ACL
   • Only broadcast traffic is dropped

3. Which command applies a numbered access list to filter traffic leaving an interface?

   • ip access-group <number> out
   • ip access-class <number> out
   • access-list apply <number> out
   • ip access-list <number> outbound

4. As a general placement rule taught for the CCNA, where should a standard access list be applied relative to the traffic it is meant to restrict?

   • As close to the destination as possible, since it can only filter by source and would otherwise block traffic to unintended destinations
   • As close to the source as possible, since it only filters by source anyway
   • On every interface in the path for redundancy
   • It does not matter where a standard ACL is applied

5. Which wildcard mask correctly matches only the single host address 172.16.1.1 in an access list statement?

   • 0.0.0.0
   • 255.255.255.255
   • 0.0.0.255
   • 0.0.255.255

6. An engineer wants to permit only web traffic (HTTP and HTTPS) from any source to a specific server, while denying all other traffic to that server. Which type of ACL is required?

   • A standard access list
   • An extended access list, since it can match destination address and specific port numbers
   • A VLAN access list only
   • A standard access list applied with the established keyword

7. ACL ONE permits 172.16.1.1 and denies other sources. Unauthorized hosts still reach the protected subnet, and show ip interface reports no outbound ACL on its only router-facing interface. What configuration step is missing?

   • Named ACLs cannot use the permit keyword
   • The statements were entered in the wrong order, so deny any is being evaluated before the permit line
   • Apply ip access-group ONE out on the router interface leading to the protected subnet
   • Standard ACLs cannot be named, only numbered

8. Which command shows the hit counts and statement order of an access list currently configured on a router?

   • show access-lists
   • show ip interface brief
   • show ip nat translations
   • show running-config | section vty

9. A network requires that hosts in 172.16.1.0/24 cannot reach 172.16.2.0/24, and separately that hosts in 172.16.2.0/24 cannot reach 172.16.1.0/24, while both subnets still need normal access to everything else. What is the most straightforward way to implement this with standard ACLs?

   • Create one ACL that denies both subnets and apply it globally
   • Create two separate ACLs, each denying one subnet as the source followed by permit any, applied outbound on the appropriate interfaces
   • Use a single extended ACL denying all IP traffic between the two subnets
   • Disable routing between the two subnets entirely at the router

10. Hosts in 10.1.10.0/24 must be blocked from SSH to server 10.1.99.10, with all other traffic allowed. An AI assistant proposes access-list 10 deny 10.1.10.0 0.0.0.255, applied outbound on the server-facing interface. What is wrong with the proposal?

    • Nothing, because a standard ACL placed close to the destination is the correct design
    • It should be applied inbound instead, and it will then block only SSH from the subnet
    • A standard ACL cannot match the port or destination, and with no permit the implicit deny drops everything
    • The wildcard mask is inverted, so the entry matches every host except 10.1.10.0/24

11. Named ACL WEB-IN ends with sequence 100 deny ip any any log. An AI assistant suggests adding permit tcp any host 203.0.113.10 eq 80 and gives the command without a sequence number. What happens if you enter it exactly as given?

    • It is inserted as sequence 10 at the top, so it matches before any other entry
    • It is added as sequence 110 after the deny, so it never matches; give it a lower number such as 90
    • IOS rejects the command, because named ACLs require an explicit sequence number
    • It replaces sequence 100, because only one entry can follow the last permit statement