Access Control Lists Practice Questions

Answers and explanations appear when you work through the set above.

1. Given this configuration: access-list 1 deny 172.16.2.0 0.0.0.255, followed by access-list 1 permit any, applied outbound on an interface, what traffic does this ACL actually block?

   • All traffic from any source
   • Traffic from 172.16.2.0/24 exiting the interface; the rest passes
   • Traffic destined to 172.16.2.0/24 only
   • Nothing, because the permit any statement overrides the deny

2. A nonempty IPv4 ACL is applied to an interface. A forwarded packet matches none of its explicit entries. What happens to that packet?

   • All traffic is permitted by default since no explicit deny was typed
   • The ACL fails to apply until a permit statement is added
   • It is dropped by the implicit deny at the end
   • Only broadcast traffic is dropped

3. Which command applies a numbered access list to filter traffic leaving an interface?

   • ip access-group <number> out, in interface config mode
   • ip access-class <number> out, under line vty 0 4
   • ip access-group <number> in, in interface config mode
   • ip access-list standard <number>, in global config mode

4. As a general placement rule taught for the CCNA, where should a standard access list be applied relative to the traffic it is meant to restrict?

   • Near the destination, to avoid source-based filtering blocking unrelated destinations
   • Near the source, because standard ACLs can distinguish the intended destination subnet from other destinations
   • On every interface in the path for redundancy
   • It does not matter where a standard ACL is applied

5. Which wildcard mask correctly matches only the single host address 172.16.1.1 in an access list statement?

   • 0.0.0.0
   • 255.255.255.255
   • 0.0.0.255
   • 0.0.255.255

6. An engineer wants to permit only web traffic (HTTP and HTTPS) from any source to a specific server, while denying all other traffic to that server. Which type of ACL is required?

   • A standard access list
   • An extended ACL matching destination IP and ports
   • A VLAN access list only
   • A standard access list applied with the established keyword

7. ACL ONE permits 172.16.1.1 and denies other sources. Unauthorized hosts still reach the protected subnet, and show ip interface reports no outbound ACL on its only router-facing interface. What configuration step is missing?

   • Named ACLs cannot use the permit keyword
   • The statements were entered in the wrong order, so deny any is being evaluated before the permit line
   • Apply ip access-group ONE out on the router interface leading to the protected subnet
   • Standard ACLs cannot be named, only numbered

8. Which command shows the hit counts and statement order of an access list currently configured on a router?

   • show access-lists
   • show ip interface brief
   • show ip nat translations
   • show running-config | section vty

9. A network requires that hosts in 172.16.1.0/24 cannot reach 172.16.2.0/24, and separately that hosts in 172.16.2.0/24 cannot reach 172.16.1.0/24, while both subnets still need normal access to everything else. What is the most straightforward way to implement this with standard ACLs?

   • One standard ACL denying both source subnets, applied inbound on both LAN interfaces to preserve access to other networks
   • Two ACLs denying opposite source subnets then permitting any, outbound toward each destination
   • Use a single extended ACL denying all IP traffic between the two subnets
   • Disable routing between the two subnets entirely at the router

10. Hosts in 10.1.10.0/24 must be blocked from SSH to server 10.1.99.10, with all other traffic allowed. An AI assistant proposes access-list 10 deny 10.1.10.0 0.0.0.255, applied outbound on the server-facing interface. What is wrong with the proposal?

    • Nothing, because a standard ACL placed close to the destination is the correct design
    • It should be applied inbound instead, and it will then block only SSH from the subnet
    • It cannot select SSH or the destination, and its implicit deny blocks the rest
    • The wildcard mask is inverted, so the entry matches every host except 10.1.10.0/24

11. Named ACL WEB-IN ends with sequence 100 deny ip any any log. An AI assistant suggests adding permit tcp any host 203.0.113.10 eq 80 and gives the command without a sequence number. What happens if you enter it exactly as given?

    • It is inserted as sequence 10 at the top, so it matches before any other entry
    • It is appended as 110 after the deny and cannot match; use a sequence such as 90
    • IOS rejects the command, because named ACLs require an explicit sequence number
    • It replaces sequence 100, because only one entry can follow the last permit statement