300-410 IPv4 Access Control Lists — Timed 10 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show access-lists
Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (10 matches)
    20 deny tcp any host 10.1.1.1 eq 22 (5 matches)
    30 permit icmp any any (2 matches)
    40 deny ip any any (1 match)

Based on this output, which statement is correct?

Accepted Answer

Traffic matching line 10 is permitted and counted correctly.. Option A is correct because the ACL shows 10 matches for line 10, which permits TCP traffic from the 192.168.1.0/24 network to any destination on port 80 (HTTP). The match counter accurately reflects the number of packets that have matched this specific entry, confirming that permitted traffic is being counted correctly.

Answer

All traffic is permitted because line 40 has only 1 match.

Answer

The ACL has no effect because it is not applied to an interface.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet address is 10.1.1.1/24
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is 101
  Inbound access list is not set

Based on this output, which statement is correct?

Accepted Answer

ACL 101 filters traffic leaving the interface.. The command output shows 'Outgoing access list is 101', which indicates that ACL 101 is applied to filter traffic leaving the GigabitEthernet0/1 interface. This is confirmed by the absence of an 'Inbound access list' entry, meaning no ACL is applied to incoming traffic. Therefore, ACL 101 filters traffic leaving the interface.

Answer

ACL 101 filters traffic entering the interface.

Answer

The interface has no ACL applied.

Answer

ACL 101 is applied in both directions.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq www (1000 matches)
    20 permit udp any any eq dns (500 matches)
    30 deny ip any any (200 matches)

Based on this output, what is the problem?

Accepted Answer

The ACL is blocking all traffic except web and DNS, which may be too restrictive.. Option B is correct because the ACL explicitly permits only TCP port 80 (www) and UDP port 53 (dns) traffic, while the final deny ip any any statement blocks all other traffic. With only 1000 matches for web and 500 for DNS, the ACL is likely too restrictive for a production network, as it would drop essential traffic such as routing protocols, management traffic (e.g., SSH, SNMP), or other application flows. The output shows the ACL is present and has hit counts, but its restrictive nature is the problem.

Answer

The ACL is correctly permitting web and DNS traffic.

Answer

The ACL has no effect because it is not applied.

Answer

The ACL allows all traffic because of the permit statements.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 130
    10 deny ip 192.168.1.0 0.0.0.255 any (0 matches)
    20 permit ip any any (1000 matches)

Based on this output, which statement is correct?

Accepted Answer

Traffic from 192.168.1.0/24 is being permitted.. Option B is correct because the ACL processes packets sequentially: line 10 denies traffic from 192.168.1.0/24 but has 0 matches, meaning no packets from that source have been evaluated. Line 20 permits all other traffic and has 1000 matches, so traffic from 192.168.1.0/24 is implicitly permitted by the permit any any statement since it is never denied.

Answer

Traffic from 192.168.1.0/24 is being denied.

Answer

The ACL is blocking all traffic.

Answer

The ACL is misconfigured because line 10 is not needed.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 140
    10 deny tcp any host 10.1.1.1 eq 23 (15 matches)
    20 permit tcp any host 10.1.1.1 eq 22 (20 matches)
    30 permit ip any any (5 matches)

Based on this output, what is the problem?

Accepted Answer

Telnet to 10.1.1.1 is being denied, which may be intentional.. Option B is correct because the ACL explicitly denies TCP traffic to host 10.1.1.1 on port 23 (Telnet) with line 10, and the match count of 15 confirms that Telnet attempts are being blocked. While this may be intentional to enforce secure management via SSH (permitted on port 22), the question asks for the problem, and the output shows Telnet is being denied. The ACL does not block SSH (line 20 permits it), so the issue is specifically that Telnet access is denied.

Answer

SSH to 10.1.1.1 is being denied.

Answer

All traffic is permitted because of line 30.

Answer

The ACL is not applied to any interface.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit ip 10.0.0.0 0.255.255.255 any (500 matches)
    20 deny ip any any (100 matches)

Based on this output, which statement is correct?

Accepted Answer

Traffic not from 10.0.0.0/8 is denied.. The ACL 150 has a permit entry for source 10.0.0.0/8 (wildcard 0.255.255.255) followed by a deny any any. Traffic matching the permit (from 10.0.0.0/8) is allowed, while all other traffic is denied by the implicit deny or the explicit deny entry. Thus, traffic not from the 10.0.0.0/8 network is denied, making option B correct.

Answer

Traffic from 10.0.0.0/8 is denied.

Answer

All traffic is permitted.

Answer

The ACL has no effect.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 160
    10 permit tcp any any established (200 matches)
    20 permit udp any any (100 matches)
    30 deny ip any any (50 matches)

Based on this output, what is the problem?

Accepted Answer

The ACL blocks all traffic except established TCP and UDP.. The ACL 160 permits only established TCP sessions (using the 'established' keyword, which matches TCP segments with the ACK or RST bit set) and all UDP traffic, while denying everything else. This means non-established TCP traffic (e.g., initial SYN packets) is blocked, so the ACL effectively blocks all traffic except established TCP and UDP, making option B correct.

Answer

The ACL allows all UDP traffic.

Answer

The ACL permits all TCP traffic.

Answer

The ACL is correctly configured for a firewall.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 170
    10 permit icmp any any echo (100 matches)
    20 permit icmp any any echo-reply (80 matches)
    30 deny ip any any (10 matches)

Based on this output, which statement is correct?

Accepted Answer

Only ICMP echo and echo-reply are permitted; all other IP traffic is denied.. The ACL 170 explicitly permits only ICMP echo (type 8) and echo-reply (type 0) traffic, as shown by the match counters. The final deny ip any any statement blocks all other IP traffic, including other ICMP types and non-ICMP IP protocols. Therefore, only ICMP echo and echo-reply are permitted; all other IP traffic is denied, making option B correct.

Answer

All ICMP traffic is permitted.

Answer

The ACL permits all IP traffic.

Answer

The ACL is not applied.

Question 9

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 180
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (50 matches)
    20 permit tcp 192.168.2.0 0.0.0.255 any eq 443 (30 matches)
    30 deny ip any any (5 matches)

Based on this output, what is the problem?

Accepted Answer

Traffic from 192.168.1.0/24 to port 80 is permitted.. Option A is correct because the ACL explicitly permits TCP traffic from the 192.168.1.0/24 network to any destination on port 80, as shown by the first entry with 50 matches. The output confirms that this traffic is being allowed, so there is no problem with that specific rule.

Answer

Traffic from 192.168.2.0/24 to port 443 is denied.

Answer

All traffic from 192.168.1.0/24 is permitted.

Answer

The ACL is correctly configured to allow only specific web traffic.

Question 10

Consider the following partial configuration on router R1:
```
interface GigabitEthernet0/1
 ip access-group MY_ACL in
!
ip access-list extended MY_ACL
 permit tcp 10.1.1.0 0.0.0.255 any eq 80
 permit icmp any any echo
 deny   ip any any
```
What is the effect of this ACL when applied inbound on GigabitEthernet0/1?

Accepted Answer

It permits HTTP requests from 10.1.1.0/24 and ICMP Echo requests from any source; all other IP traffic is denied.. The ACL is applied inbound on GigabitEthernet0/1. The first permit statement allows TCP traffic from source network 10.1.1.0/24 to any destination on port 80 (HTTP). The second permit statement allows ICMP Echo requests (type 8) from any source. The final deny statement blocks all other IP traffic. Therefore, only HTTP requests from 10.1.1.0/24 and ICMP Echo requests from any source are permitted; all other IP traffic is denied.

Answer

It permits HTTP requests from 10.1.1.0/24 and all ICMP traffic; all other IP traffic is denied.

Answer

It permits HTTP requests from any source to 10.1.1.0/24 and ICMP Echo requests; all other traffic is denied.

Answer

It permits HTTP requests from 10.1.1.0/24 and ICMP Echo replies; all other IP traffic is denied.