ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.
Start Scenario PracticeWhich TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?
Explanation: In Cisco Firepower Management Center, an Access Control Rule's Logging tab lets you choose when to generate connection events for traffic matching the rule, and the two available timing settings are 'Log at Beginning' (option E) and 'Log at End' (option D). 'Log at Beginning' generates a connection event when the connection is first seen, which is useful for capturing attempted connections even if they are later blocked or never complete. 'Log at End' generates the event when the connection closes, providing full session details such as bytes sent/received and duration. 'Log to Cloud' (A) is not a logging-timing option in the Access Control Rule Logging tab, and 'Log every packet' (B) and 'Log at Middle' (C) are not valid settings for this tab.
Which option in the Access Control Policy rule allows you to define a specific application, such as 'Facebook', to be blocked?
Explanation: The 'Applications' tab in an Access Control Rule allows selection of specific applications for blocking or monitoring.
An administrator integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. After successful registration, the administrator wants to create an Access Control policy rule that blocks traffic from users in the 'Contractors' Security Group Tag. Where in the FMC rule creation wizard should the administrator configure this condition?
Explanation: In FMC Access Control policies, user and tag-based criteria are added under the 'Users' tab of the rule configuration, where Security Group Tags learned via pxGrid can be selected.
An engineer is configuring an Identity Policy in FMC to enforce user-based access control. Active Directory integration has been established via User Agent, but the engineer notices that some users authenticated via remote access VPN are not being resolved to their IP addresses. Which feature must be integrated into the identity configuration to capture IP-to-user mappings for remote access VPN users?
Explanation: Remote access VPN users are authenticated by the VPN headend (e.g., Cisco ASA/FTD or ISE), and their IP-to-user mappings are not learned by the User Agent, which relies on Active Directory security event log parsing on domain controllers. To capture these mappings, FMC must integrate with Cisco ISE via pxGrid or receive RADIUS Accounting records, which provide the user-to-IP binding at the time of VPN session establishment. This allows the Identity Policy to resolve VPN users to their assigned IP addresses.
Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)
Explanation: In Cisco FMC, an Access Control rule can match traffic using criteria such as URL Categories (C), which let you filter based on reputation or category of requested web destinations; Applications (D), which identify traffic by application or application group via Snort/App-ID; and Security Zones (E), which match the ingress/egress interfaces assigned to zones. These three are all valid match conditions on the rule's main criteria tabs. Intrusion Policy Signatures (A) are not a match criterion — an Intrusion Policy is an inspection action applied to traffic that already matched the rule. Device Platform Settings (B) are also not a match condition; platform settings are applied via a Platform Settings policy to managed devices, not used to select traffic in an access rule.
+10 more scenario questions available
Practice all Access Control List (ACL) ScenariosACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6. These appear throughout the 300-710 SNCF and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 300-710 SNCF. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 300-710 SNCF scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Access Control List (ACL) Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →