easyMultiple ChoiceObjective-mapped
ACL Application Direction and Common Pitfalls
A network engineer is configuring ACLs on a Cisco router to filter traffic between two subnets. The engineer wants to allow HTTP traffic from subnet 10.1.1.0/24 to subnet 10.2.2.0/24, but deny all other traffic. The engineer applies an ACL inbound on the interface connected to subnet 10.1.1.0/24. The ACL has a permit statement for TCP port 80 from 10.1.1.0/24 to 10.2.2.0/24, followed by a deny ip any any. However, hosts in subnet 10.1.1.0/24 can still ping hosts in subnet 10.2.2.0/24. What is the most likely reason?
Quick Answer
The answer is that the ACL is most likely applied outbound on the interface, not inbound. When an ACL is applied inbound, it filters traffic as it enters the interface, meaning any packet arriving from subnet 10.1.1.0/24 is evaluated against the permit and deny statements before being routed. Since the configured ACL only permits HTTP (TCP port 80) and denies everything else, inbound application should block ICMP ping traffic. However, if the ACL is applied outbound, it only filters traffic leaving the interface, so ping packets from 10.1.1.0/24 would be routed normally and only filtered when exiting toward 10.2.2.0/24, which explains why they still reach their destination. On the ENCOR 350-401 exam, this tests your understanding of ACL application direction—a common trap where engineers misapply the ACL to the wrong interface side. A reliable memory tip is “inbound inspects arrivals, outbound checks departures”; always verify the direction relative to the traffic source.
⚠ Common exam trap
Candidates often confuse the direction of ACL application. An inbound ACL filters traffic coming into the interface, while an outbound ACL filters traffic leaving the interface. This question tests the understanding that an ACL applied outbound on the ingress interface will not filter incoming traffic from the connected subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is applied outbound on the interface, not inbound, so it filters traffic leaving the interface, not entering.
The ACL is applied outbound on the interface, not inbound. An inbound ACL filters traffic entering the interface, while an outbound ACL filters traffic leaving the interface. If the ACL were correctly applied inbound on the interface connected to subnet 10.1.1.0/24, the 'deny ip any any' would block all non-HTTP traffic, including ICMP (ping). However, since ping is still reaching subnet 10.2.2.0/24, the ACL must not be filtering inbound traffic; it is likely applied outbound on that same interface, which does not affect traffic entering the router from subnet 10.1.1.0/24. This misapplication allows ICMP traffic to pass unhindered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL is applied outbound on the interface, not inbound, so it filters traffic leaving the interface, not entering.
Why this is correct
Correct because if the ACL is applied outbound, it filters traffic leaving the interface; ping traffic from 10.1.1.0/24 to 10.2.2.0/24 would be leaving the interface, but the ACL permits only HTTP, so ping should be denied. However, if the ACL is applied outbound, the deny ip any any would block ping, so this might not be the issue. Actually, the most likely reason is that the ACL is applied outbound, but the scenario says inbound, so the engineer might have misapplied it.
- ✗
The ACL is missing a deny statement for ICMP, so ICMP traffic is implicitly permitted.
Why it's wrong here
Incorrect because ACLs have an implicit deny at the end, so ICMP would be denied.
- ✗
The ACL permits HTTP, but ping uses ICMP, which is not HTTP, so ping should be denied.
Why it's wrong here
Incorrect because this would not explain why ping is allowed; it should be denied.
- ✗
The ACL is applied to the wrong interface; it should be applied to the interface connected to subnet 10.2.2.0/24.
Why it's wrong here
Incorrect because applying the ACL to the interface connected to 10.1.1.0/24 is correct for filtering traffic from that subnet.
Visual reference
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Examine the following configuration snippet: interface GigabitEthernet0/1 ip access-group FILTER_IN in ! ip access-list extended FILTER_IN deny icmp any any echo permit ip any any What is the effect of this configuration?
medium- A.It blocks all ICMP traffic inbound on GigabitEthernet0/1.
- ✓ B.It blocks inbound ICMP Echo requests on GigabitEthernet0/1.
- C.It blocks all inbound traffic on GigabitEthernet0/1.
- D.It blocks outbound ICMP Echo requests on GigabitEthernet0/1.
Why B: The access list FILTER_IN explicitly denies ICMP packets with the 'echo' type (ping requests) while permitting all other IP traffic. Applied inbound on GigabitEthernet0/1, this blocks only inbound ICMP Echo requests, not all ICMP traffic (e.g., Echo replies, TTL-exceeded messages are permitted). The 'permit ip any any' at the end ensures all other traffic is allowed.
Variation 2. Given the following configuration: ip access-list extended FILTER permit tcp any host 10.1.1.1 eq 22 permit icmp any any echo-reply ! interface GigabitEthernet0/4 ip access-group FILTER in What traffic is permitted?
medium- A.Only SSH traffic to 10.1.1.1 is permitted.
- ✓ B.SSH to 10.1.1.1 and ICMP Echo Reply are permitted.
- C.All ICMP traffic is permitted.
- D.Only traffic from host 10.1.1.1 is permitted.
Why B: The access list FILTER permits TCP traffic to destination host 10.1.1.1 on port 22 (SSH) and ICMP packets of type Echo Reply. Since the list is applied inbound on GigabitEthernet0/4, only these two types of traffic are allowed into the interface. Option B correctly identifies both permitted traffic types.
Variation 3. Review the ACL configuration: ip access-list extended TEST permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 deny ip any any ! interface GigabitEthernet0/3 ip access-group TEST in What is missing or incorrect?
medium- A.The ACL should use a wildcard mask of 255.255.255.0 instead of 0.0.0.255.
- ✓ B.The deny ip any any is redundant because ACLs have an implicit deny at the end.
- C.The ACL must be applied outbound to filter incoming traffic.
- D.The ACL should use the keyword 'established' to allow return traffic.
Why B: The `deny ip any any` line is redundant. Cisco ACLs have an implicit deny all at the end of every ACL, so adding an explicit deny is unnecessary and does not change the behavior. The configuration is otherwise valid for filtering inbound traffic on GigabitEthernet0/3.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.