ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.
Start Scenario PracticeDrag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.
Explanation: Sequence numbers allow editing named ACLs without re-entering all entries. The correct order is: view current entries, insert a new entry at a specific sequence, then verify the updated ACL.
A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 150 10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches) 20 deny tcp any any eq 23 (8 matches) 30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches) 40 deny tcp any any eq 22 (1 match) 50 permit ip any any (15 matches) Based on this output, what can be concluded?
Explanation: The ACL 150 processes entries sequentially. Telnet (TCP port 23) from 192.168.1.0/24 is not explicitly permitted by the first permit statement (which only allows source 10.0.0.0/8) and is denied by the subsequent deny statement (line 20). SSH (TCP port 22) from 10.0.0.0/8 is permitted by line 10 only for Telnet, not SSH; line 30 permits SSH only from 172.16.0.0/16, so SSH from 10.0.0.0/8 hits line 40 (deny) and is denied. The implicit deny at the end would also block unmatched traffic, but here explicit denies apply.
Examine the following partial Cisco IOS-XE configuration: interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 ip access-group ACL_IN in spanning-tree portfast What is the effect of this configuration?
Explanation: The configuration enables PortFast on an access port, allowing it to transition directly to forwarding state, bypassing the listening and learning phases. This is commonly used for end-host ports to avoid delays caused by spanning-tree convergence.
Drag and drop each IPv6 ACL feature on the left to its matching IPv4 ACL equivalent on the right.
Explanation: IPv6 ACLs use similar logic but with IPv6-specific syntax: deny/ipv6, permit/ipv6, sequence numbers, and implicit deny.
Drag and drop each ACL type on the left to its matching capability on the right.
Explanation: Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow alphanumeric naming; Time-based ACLs restrict based on time of day.
+6 more scenario questions available
Practice all Access Control List (ACL) ScenariosACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6. These appear throughout the 350-401 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 350-401. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 350-401 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Access Control List (ACL) Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →