How many Access Control List (ACL) Scenarios questions are on this page?

This page has 11 Access Control List (ACL) Scenarios scenario questions for the 350-401 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-401 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ENCOR 350-401 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 350-401 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

scenario questions

350-401

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Practice scenarios

Question 1mediumdrag order

Study the full ACL explanation →

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2hardmultiple choice

Review the full routing breakdown →

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 150

10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    
20 deny tcp any any eq 23 (8 matches)
    
30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    
40 deny tcp any any eq 22 (1 match)
    
50 permit ip any any (15 matches)

Based on this output, what can be concluded?

A
Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.
Telnet from 192.168.1.0/24 matches entry 20 (deny), and SSH from 10.0.0.0/8 does not match entry 30 (which permits only from 172.16.0.0/16), so it matches entry 40 (deny).
B
Telnet from 10.0.0.0/8 is denied.
Why wrong: Entry 10 permits Telnet from 10.0.0.0/8.
C
SSH from 172.16.0.0/16 is denied.
Why wrong: Entry 30 permits SSH from 172.16.0.0/16.
D
All traffic is permitted.
Why wrong: Telnet and SSH from unauthorized sources are denied.

Full breakdown with real-world context →

Question 3mediummultiple choice

Open the full VLAN trunking answer →

Examine the following partial Cisco IOS-XE configuration:

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 ip access-group ACL_IN in
 spanning-tree portfast

What is the effect of this configuration?

A
The port will immediately transition to forwarding state, reducing STP convergence time for end hosts.
spanning-tree portfast on an access port causes immediate forwarding, as intended for host ports.
B
The port will become a trunk port and participate in VLAN trunking.
Why wrong: The port is configured as an access port, not a trunk.
C
The port will use Rapid PVST+ and immediately forward after a link failure.
Why wrong: PortFast does not change the STP mode; it only affects initial convergence.
D
The port will block all inbound traffic due to the ACL.
Why wrong: The ACL is applied inbound but does not block all traffic; it filters based on the ACL entries.

Full breakdown with real-world context →

Question 4hardmatching

Study the full ACL explanation →

Drag and drop each IPv6 ACL feature on the left to its matching IPv4 ACL equivalent on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Equivalent to ip access-list extended in IPv4

Equivalent to deny ip in IPv4 extended ACL

Equivalent to permit tcp in IPv4 extended ACL

Equivalent to sequence number in IPv4 named ACL

Equivalent to implicit deny ip in IPv4 ACL

Question 5mediummatching

Study the full ACL explanation →

Drag and drop each ACL type on the left to its matching capability on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters based on source IP address only

Filters based on source/destination IP, protocol, and port numbers

Allows alphanumeric naming for easier identification

Applies time-of-day restrictions to permit or deny traffic

Opens temporary holes for user authentication

Question 6hardmultiple choice

Full question →

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit

Refer to the exhibit.

! Running-config on R1
ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq www
 permit tcp 192.168.1.0 0.0.0.255 any eq https
!
interface GigabitEthernet0/0
 ip access-group FILTER out
!

A
HTTP and HTTPS traffic from 192.168.1.0/24
The ACL permits www and https.
B
ICMP traffic from any source
Why wrong: ICMP is not permitted.
C
FTP traffic from 192.168.1.0/24
Why wrong: FTP is not permitted.
D
SSH traffic from 192.168.1.0/24
Why wrong: SSH is not permitted.

Full breakdown with real-world context →

Question 7mediumdrag order

Read the full network assurance explanation →

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 8mediummatching

Study the full ACL explanation →

Drag and drop each ACL action on the left to its matching result on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Packet is allowed to pass through the ACL

Packet is discarded and not forwarded

Adds a descriptive comment to the ACL entry

Generates a syslog message when a packet matches the entry

Assigns a numeric identifier to the ACL line for insertion/deletion

Question 9mediumdrag order

Read the full network assurance explanation →

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediummultiple choice

Full question →

A network engineer runs the following command on switch SW3:

SW3# show cts role-based permissions

IPv4 Role-based permissions:

Source Group Dest Group Action 10 20 PERMIT 10 30 DENY 20 30 PERMIT

Based on this output, what can be concluded?

A
Traffic from SGT 10 to SGT 20 is denied.
Why wrong: The output shows PERMIT for source 10 to dest 20.
B
Traffic from SGT 10 to SGT 30 is permitted.
Why wrong: The output shows DENY for source 10 to dest 30.
C
Traffic from SGT 20 to SGT 30 is permitted.
The output shows PERMIT for source 20 to dest 30.
D
Traffic from SGT 30 to SGT 10 is denied.
Why wrong: The output does not show a policy for source 30 to dest 10; the table is directional.

Full breakdown with real-world context →

Question 11mediumdrag order

Study the full ACL explanation →

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

These 350-401 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-401 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Access Control List (ACL) Scenarios

How to approach access control list (acl) scenarios

Quick answer

Related 350-401 topic practice pages

Architecture practice questions

Virtualization practice questions

Infrastructure practice questions

Network Assurance practice questions

Security practice questions

Automation practice questions

ENCOR BGP practice questions

ENCOR OSPF practice questions

ENCOR EIGRP practice questions

ENCOR VLANs and trunking practice questions

ENCOR STP practice questions

ENCOR ACLs and CoPP practice questions

Practice scenarios

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Drag and drop each IPv6 ACL feature on the left to its matching IPv4 ACL equivalent on the right.

Drag and drop each ACL type on the left to its matching capability on the right.

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

Drag and drop each ACL action on the left to its matching result on the right.

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.