300-410 IPv4 Access Control Lists — Timed 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show access-lists
Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (10 matches)
    20 deny tcp any host 10.1.1.1 eq 22 (5 matches)
    30 permit icmp any any (2 matches)
    40 deny ip any any (1 match)

Based on this output, which statement is correct?

Accepted Answer

Traffic matching line 10 is permitted and counted correctly.. Option A is correct because the ACL shows 10 matches for line 10, which permits TCP traffic from the 192.168.1.0/24 network to any destination on port 80 (HTTP). The match counter accurately reflects the number of packets that have matched this specific entry, confirming that permitted traffic is being counted correctly.

Answer

All traffic is permitted because line 40 has only 1 match.

Answer

The ACL has no effect because it is not applied to an interface.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet address is 10.1.1.1/24
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is 101
  Inbound access list is not set

Based on this output, which statement is correct?

Accepted Answer

ACL 101 filters traffic leaving the interface.. The command output shows 'Outgoing access list is 101', which indicates that ACL 101 is applied to filter traffic leaving the GigabitEthernet0/1 interface. This is confirmed by the absence of an 'Inbound access list' entry, meaning no ACL is applied to incoming traffic. Therefore, ACL 101 filters traffic leaving the interface.

Answer

ACL 101 filters traffic entering the interface.

Answer

The interface has no ACL applied.

Answer

ACL 101 is applied in both directions.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq www (1000 matches)
    20 permit udp any any eq dns (500 matches)
    30 deny ip any any (200 matches)

Based on this output, what is the problem?

Accepted Answer

The ACL is blocking all traffic except web and DNS, which may be too restrictive.. Option B is correct because the ACL explicitly permits only TCP port 80 (www) and UDP port 53 (dns) traffic, while the final deny ip any any statement blocks all other traffic. With only 1000 matches for web and 500 for DNS, the ACL is likely too restrictive for a production network, as it would drop essential traffic such as routing protocols, management traffic (e.g., SSH, SNMP), or other application flows. The output shows the ACL is present and has hit counts, but its restrictive nature is the problem.

Answer

The ACL is correctly permitting web and DNS traffic.

Answer

The ACL has no effect because it is not applied.

Answer

The ACL allows all traffic because of the permit statements.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 130
    10 deny ip 192.168.1.0 0.0.0.255 any (0 matches)
    20 permit ip any any (1000 matches)

Based on this output, which statement is correct?

Accepted Answer

Traffic from 192.168.1.0/24 is being permitted.. Option B is correct because the ACL processes packets sequentially: line 10 denies traffic from 192.168.1.0/24 but has 0 matches, meaning no packets from that source have been evaluated. Line 20 permits all other traffic and has 1000 matches, so traffic from 192.168.1.0/24 is implicitly permitted by the permit any any statement since it is never denied.

Answer

Traffic from 192.168.1.0/24 is being denied.

Answer

The ACL is blocking all traffic.

Answer

The ACL is misconfigured because line 10 is not needed.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 140
    10 deny tcp any host 10.1.1.1 eq 23 (15 matches)
    20 permit tcp any host 10.1.1.1 eq 22 (20 matches)
    30 permit ip any any (5 matches)

Based on this output, what is the problem?

Accepted Answer

Telnet to 10.1.1.1 is being denied, which may be intentional.. Option B is correct because the ACL explicitly denies TCP traffic to host 10.1.1.1 on port 23 (Telnet) with line 10, and the match count of 15 confirms that Telnet attempts are being blocked. While this may be intentional to enforce secure management via SSH (permitted on port 22), the question asks for the problem, and the output shows Telnet is being denied. The ACL does not block SSH (line 20 permits it), so the issue is specifically that Telnet access is denied.

Answer

SSH to 10.1.1.1 is being denied.

Answer

All traffic is permitted because of line 30.

Answer

The ACL is not applied to any interface.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit ip 10.0.0.0 0.255.255.255 any (500 matches)
    20 deny ip any any (100 matches)

Based on this output, which statement is correct?

Accepted Answer

Traffic not from 10.0.0.0/8 is denied.. The ACL 150 has a permit entry for source 10.0.0.0/8 (wildcard 0.255.255.255) followed by a deny any any. Traffic matching the permit (from 10.0.0.0/8) is allowed, while all other traffic is denied by the implicit deny or the explicit deny entry. Thus, traffic not from the 10.0.0.0/8 network is denied, making option B correct.

Answer

Traffic from 10.0.0.0/8 is denied.

Answer

All traffic is permitted.

Answer

The ACL has no effect.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 160
    10 permit tcp any any established (200 matches)
    20 permit udp any any (100 matches)
    30 deny ip any any (50 matches)

Based on this output, what is the problem?

Accepted Answer

The ACL blocks all traffic except established TCP and UDP.. The ACL 160 permits only established TCP sessions (using the 'established' keyword, which matches TCP segments with the ACK or RST bit set) and all UDP traffic, while denying everything else. This means non-established TCP traffic (e.g., initial SYN packets) is blocked, so the ACL effectively blocks all traffic except established TCP and UDP, making option B correct.

Answer

The ACL allows all UDP traffic.

Answer

The ACL permits all TCP traffic.

Answer

The ACL is correctly configured for a firewall.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 170
    10 permit icmp any any echo (100 matches)
    20 permit icmp any any echo-reply (80 matches)
    30 deny ip any any (10 matches)

Based on this output, which statement is correct?

Accepted Answer

Only ICMP echo and echo-reply are permitted; all other IP traffic is denied.. The ACL 170 explicitly permits only ICMP echo (type 8) and echo-reply (type 0) traffic, as shown by the match counters. The final deny ip any any statement blocks all other IP traffic, including other ICMP types and non-ICMP IP protocols. Therefore, only ICMP echo and echo-reply are permitted; all other IP traffic is denied, making option B correct.

Answer

All ICMP traffic is permitted.

Answer

The ACL permits all IP traffic.

Answer

The ACL is not applied.

Question 9

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 180
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (50 matches)
    20 permit tcp 192.168.2.0 0.0.0.255 any eq 443 (30 matches)
    30 deny ip any any (5 matches)

Based on this output, what is the problem?

Accepted Answer

Traffic from 192.168.1.0/24 to port 80 is permitted.. Option A is correct because the ACL explicitly permits TCP traffic from the 192.168.1.0/24 network to any destination on port 80, as shown by the first entry with 50 matches. The output confirms that this traffic is being allowed, so there is no problem with that specific rule.

Answer

Traffic from 192.168.2.0/24 to port 443 is denied.

Answer

All traffic from 192.168.1.0/24 is permitted.

Answer

The ACL is correctly configured to allow only specific web traffic.

Question 10

Consider the following partial configuration on router R1:
```
interface GigabitEthernet0/1
 ip access-group MY_ACL in
!
ip access-list extended MY_ACL
 permit tcp 10.1.1.0 0.0.0.255 any eq 80
 permit icmp any any echo
 deny   ip any any
```
What is the effect of this ACL when applied inbound on GigabitEthernet0/1?

Accepted Answer

It permits HTTP requests from 10.1.1.0/24 and ICMP Echo requests from any source; all other IP traffic is denied.. The ACL is applied inbound on GigabitEthernet0/1. The first permit statement allows TCP traffic from source network 10.1.1.0/24 to any destination on port 80 (HTTP). The second permit statement allows ICMP Echo requests (type 8) from any source. The final deny statement blocks all other IP traffic. Therefore, only HTTP requests from 10.1.1.0/24 and ICMP Echo requests from any source are permitted; all other IP traffic is denied.

Answer

It permits HTTP requests from 10.1.1.0/24 and all ICMP traffic; all other IP traffic is denied.

Answer

It permits HTTP requests from any source to 10.1.1.0/24 and ICMP Echo requests; all other traffic is denied.

Answer

It permits HTTP requests from 10.1.1.0/24 and ICMP Echo replies; all other IP traffic is denied.

Question 11

Examine the following configuration snippet:
```
interface GigabitEthernet0/0
 ip access-group BLOCK_TELNET out
!
ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
```
What is the effect of applying this ACL outbound on GigabitEthernet0/0?

Accepted Answer

It blocks Telnet traffic leaving the interface, but permits all other IP traffic.. The ACL is applied outbound on GigabitEthernet0/0, meaning it filters traffic as it leaves the interface. The first rule denies TCP traffic destined for port 23 (Telnet), and the second rule permits all other IP traffic. Therefore, Telnet sessions initiated from inside the network and exiting this interface are blocked, while all other traffic is allowed.

Answer

It blocks Telnet traffic entering the interface from the network.

Answer

It permits Telnet traffic and blocks all other IP traffic.

Answer

It has no effect because the ACL is missing a sequence number.

Question 12

Given the following configuration:
```
interface GigabitEthernet0/2
 ip access-group FILTER_SSH in
!
ip access-list extended FILTER_SSH
 permit tcp any host 192.168.1.10 eq 22
 permit udp any host 192.168.1.10 eq 22
```
What is the issue with this ACL?

Accepted Answer

The ACL permits UDP port 22, which is not used by SSH; this could allow unwanted UDP traffic.. The ACL permits both TCP and UDP traffic to destination port 22. SSH uses only TCP port 22; UDP port 22 is not used by SSH. The second permit statement allows any UDP traffic to port 22, which could be unwanted (e.g., UDP-based attacks or non-SSH services). This is the issue.

Answer

The ACL is missing a deny statement at the end to block other traffic.

Answer

The ACL should use the 'established' keyword to allow return traffic.

Answer

The ACL should be applied outbound instead of inbound.

Question 13

Consider this configuration on router R2:
```
interface GigabitEthernet0/0
 ip access-group RESTRICT_ACCESS in
!
ip access-list extended RESTRICT_ACCESS
 permit ip 10.0.0.0 0.255.255.255 any
 deny   ip any any
```
What traffic will be permitted inbound on GigabitEthernet0/0?

Accepted Answer

All traffic from the 10.0.0.0/8 network.. The access list RESTRICT_ACCESS uses a wildcard mask of 0.255.255.255, which matches the first octet exactly and ignores the remaining three octets. This effectively permits all traffic from the 10.0.0.0/8 network (10.0.0.0 through 10.255.255.255). The explicit deny ip any any at the end blocks all other traffic, so only traffic sourced from the 10.0.0.0/8 range is permitted inbound on GigabitEthernet0/0.

Answer

Only traffic from source 10.0.0.0/24.

Answer

All traffic from any source.

Answer

Only traffic from source 10.0.0.0/16.

Question 14

Examine the following configuration:
```
interface GigabitEthernet0/3
 ip access-group WEB_ONLY out
!
ip access-list extended WEB_ONLY
 permit tcp any any eq 80
 permit tcp any any eq 443
```
What is the effect of this ACL when applied outbound on GigabitEthernet0/3?

Accepted Answer

It permits only HTTP and HTTPS traffic to leave the interface; all other traffic is denied.. The ACL named WEB_ONLY explicitly permits TCP traffic destined for ports 80 (HTTP) and 443 (HTTPS). When applied outbound on GigabitEthernet0/3, it filters traffic leaving the interface. Since every ACL has an implicit deny any at the end, only HTTP and HTTPS traffic is permitted outbound; all other traffic is denied.

Answer

It permits all web traffic entering the interface.

Answer

It permits all TCP traffic to any destination.

Answer

It has no effect because the ACL is missing a deny statement.

Question 15

Given this configuration:
```
interface GigabitEthernet0/4
 ip access-group BLOCK_FTP in
!
ip access-list extended BLOCK_FTP
 deny tcp any any eq 21
 deny tcp any any eq 20
 permit ip any any
```
What is the effect of this ACL when applied inbound on GigabitEthernet0/4?

Accepted Answer

It blocks all FTP traffic entering the interface, but permits all other IP traffic.. The ACL is applied inbound on GigabitEthernet0/4, meaning it filters traffic as it enters the interface. The first two deny statements block TCP traffic destined for ports 21 (FTP control) and 20 (FTP data), which are the standard ports for FTP. The final permit ip any any allows all other IP traffic. Thus, only FTP traffic is blocked, and all other IP traffic is permitted.

Answer

It blocks all FTP traffic leaving the interface.

Answer

It permits FTP traffic and blocks all other IP traffic.

Answer

It has no effect because the ACL is missing a sequence number.