ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.
Start Scenario PracticeYou need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?
Explanation: A dACL is an ordered list of ACEs evaluated top-down, and IOS ACLs have an implicit 'deny ip any any' at the end. To deny a specific subnet while permitting all other traffic, you place the deny ACE for 10.1.1.0/24 first, then explicitly permit everything else with 'permit ip any any' as the final line. Without that explicit permit, the implicit deny would block all remaining traffic.
When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?
Explanation: When you create a downloadable ACL in Cisco ISE, the ACE entries must be written in Cisco IOS-style extended ACL syntax (e.g., 'permit tcp any host 10.1.1.5 eq 443'). ISE does not translate from other formats — it passes the ACE text verbatim to the NAD inside the RADIUS cisco-av-pair attribute, so the syntax must match what the switch's IOS parser expects.
You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?
Explanation: A common reason a permitted command still fails is that the switch's local configuration blocks it. For example, local command authorization, privilege-level restrictions, or AAA command authorization configured locally on the device can deny a command even when ISE's Command Set permits it. The device's local policy takes precedence or acts as an additional gate.
A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?
Explanation: Even if a Command Set permits all commands, the user must have a sufficient privilege level on the device to execute privileged commands like 'reload'. If the Shell Profile assigns a low privilege level (for example, priv-lvl 1), the device will reject 'reload' with 'Access Denied' regardless of the Command Set.
A network administrator is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network devices. The administrator wants to allow users in the 'NetOps' group to execute only 'show' commands and deny all other commands. The policy set for TACACS+ device administration is already configured with the correct conditions. Where in ISE should the administrator define the permitted commands and associate them with the 'NetOps' group?
Explanation: For TACACS+ command authorization in Cisco ISE, you define a Command Set that lists the allowed commands, and then reference that Command Set in an Authorization Policy rule. The rule's condition matches the user's group, such as 'NetOps'. This approach ensures that only the commands in the Command Set are permitted, and any command not explicitly allowed is denied. The other options describe incorrect locations or methods for defining command permissions.
+1 more scenario questions available
Practice all Access Control List (ACL) ScenariosACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6. These appear throughout the SISE and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the SISE. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free SISE scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Access Control List (ACL) Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →