ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.
Start Scenario PracticeRefer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?
Explanation: The ACL permits all other traffic (line 40) after denying SSH from other sources. This bypasses any additional restrictions; the intent might be to allow only specific IPs for SSH, but the permit ip any any at the end allows all other traffic, which could include other unwanted protocols. Option A is incorrect because line 40 permits everything. Option B is wrong because the source is correctly the internal subnets. Option C is wrong because ACLs are sequence-dependent, but line 30 only denies SSH from other sources.
During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?
Explanation: MAC provides stricter, system-enforced controls based on classification, which is often adopted in higher-security environments. DAC relies on user discretion and is less secure.
Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)
Explanation: The ACL permits TCP traffic from 10.0.0.0/8 to any destination on ports 80 (HTTP) and 443 (HTTPS). Option B is wrong because only these two ports are permitted. Option C is wrong because it permits only HTTP and HTTPS. Option D is wrong because both HTTP and HTTPS are allowed.
A firewall log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443 with action 'deny'. What does this indicate?
Explanation: The log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443, with the action 'deny'. Port 443 is the default port for HTTPS (HTTP over TLS), which is used for secure web server access. The 'deny' action indicates the firewall blocked this outbound connection, meaning the internal host attempted to reach a secure web server but was prevented by the firewall policy.
A SOC analyst is reviewing firewall logs and sees repeated entries: 'Deny TCP 10.0.0.5:49152 -> 203.0.113.1:22' and 'Deny TCP 10.0.0.5:49153 -> 203.0.113.1:22'. What does this pattern suggest?
Explanation: Multiple denied connection attempts from the same internal IP to the same external IP on port 22 (SSH) with different source ports indicates a brute-force SSH attack. The firewall is denying the connections, but the pattern is indicative of an attack.
+5 more scenario questions available
Practice all Access Control List (ACL) ScenariosACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6. These appear throughout the 200-201 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 200-201. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 200-201 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Access Control List (ACL) Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →