ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.
Start Scenario PracticeA data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?
Explanation: ACLs are processed top-down, and the first match wins. The explicit permit for SSH from the jump host (10.10.1.100) must come before the deny for the entire 10.10.0.0/16 range to ensure the exception is honored. The final permit ip any any allows all other non-management traffic, which is necessary to avoid dropping legitimate traffic on the management interface.
A Cisco MDS 9000 switch is used in a storage network. The security policy requires that a junior administrator named 'user1' can view zone configurations but cannot make any changes. Currently, 'user1' is assigned the default 'network-operator' role, which allows read-only access to most configuration, but the engineer wants to ensure that zone modification is explicitly denied. The engineer creates a custom role named 'zone-viewer' and assigns it to 'user1'. The role should permit viewing of the running configuration related to zones but deny any command that modifies zone or zoneset configurations. Which configuration best achieves this objective?
Explanation: It uses the 'permit command' statements with wildcard patterns ('show zone*' and 'show zoneset*') to explicitly allow only show commands related to zones and zonesets. By not including any 'permit' or 'deny' statements for configuration commands (like 'configure terminal', 'zone', or 'zoneset'), the role implicitly denies all other commands, including those that modify zone or zoneset configurations. This matches the requirement to allow viewing but deny modifications.
A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?
Explanation: TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.
A network engineer is configuring an ACI contract between an EPG and an external EPG. Which construct is used to permit traffic from the external EPG to the internal EPG?
Explanation: In Cisco ACI, the provider EPG exposes a contract, and the consumer EPG consumes it. To permit traffic from an external EPG to an internal EPG, the internal EPG must be the consumer (initiating the communication) and the external EPG must be the provider (offering the contract). This aligns with the default directionality of contracts, where the provider's filter rules allow inbound traffic from the consumer.
A data center engineer is troubleshooting connectivity issues between two EPGs in the same tenant on a Cisco ACI fabric. The first EPG 'web_epg' is in VLAN 100 and the second EPG 'db_epg' is in VLAN 200. The contract 'web_to_db' allows TCP port 3306 from web_epg to db_epg. The EPGs are in the same VRF. The engineer has verified that the physical connectivity is correct and the endpoints are learning their IP addresses. However, traffic from web_epg to db_epg is not reaching the destination. The engineer checks the contract and sees that the subject 'mysql_access' has filter 'mysql' with direction 'both'. The provider is db_epg and consumer is web_epg. The engineer also notices that the default action in the contract is 'deny'. What is the most likely cause of the issue?
Explanation: In Cisco ACI, the provider EPG is the one that offers a service (the destination of the traffic), and the consumer EPG is the one that initiates the connection. Since web_epg initiates TCP traffic to db_epg, db_epg should be the provider and web_epg the consumer. The contract is reversed, so the default deny action blocks the traffic because the consumer (web_epg) is not allowed to initiate toward the provider (db_epg) under the reversed roles.
+9 more scenario questions available
Practice all Access Control List (ACL) ScenariosACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6. These appear throughout the 350-601 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 350-601. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 350-601 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Access Control List (ACL) Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →