How many Access Control List (ACL) Scenarios questions are on this page?

This page has 15 Access Control List (ACL) Scenarios scenario questions for the 350-401 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-401 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ENCOR 350-401 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 350-401 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

scenario questions

350-401

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Practice scenarios

Question 1mediumdrag order

Study the full ACL explanation →

Drag and drop the steps to configure an extended access control list (ACL) on a Cisco router in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2easymulti select

Full question →

Which TWO features are part of Cisco TrustSec for providing role-based access control?

A
Security Group Access Control Lists (SGACLs)
SGACLs enforce policies based on SGTs.
B
Change of Authorization (CoA)
Why wrong: CoA is used for mid-session policy changes, not a core TrustSec feature.
C
802.1X authentication
Why wrong: 802.1X is an authentication protocol, not a TrustSec feature.
D
Security Group Tags (SGTs)
SGTs are used to classify traffic based on user/device identity.
E
MACsec encryption
Why wrong: MACsec provides encryption, not access control.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit

Refer to the exhibit.

! Running-config on R1
ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq www
 permit tcp 192.168.1.0 0.0.0.255 any eq https
!
interface GigabitEthernet0/0
 ip access-group FILTER out
!

A
HTTP and HTTPS traffic from 192.168.1.0/24
The ACL permits www and https.
B
ICMP traffic from any source
Why wrong: ICMP is not permitted.
C
FTP traffic from 192.168.1.0/24
Why wrong: FTP is not permitted.
D
SSH traffic from 192.168.1.0/24
Why wrong: SSH is not permitted.

Full breakdown with real-world context →

Question 4mediummultiple choice

Open the full BGP breakdown →

router bgp 65000

bgp router-id 10.0.0.1

neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 route-map SET_ORIGIN in

! route-map SET_ORIGIN permit 10 set origin incomplete ! What is the effect of this configuration?

A
Routes received from 10.0.0.2 will have their origin set to incomplete, making them less preferred compared to IGP origin.
Correct. Incomplete origin is the least preferred.
B
Routes sent to 10.0.0.2 will have their origin set to incomplete.
Why wrong: Incorrect. The 'in' keyword applies to inbound updates.
C
The router will not advertise any routes with origin incomplete to other peers.
Why wrong: Incorrect. The origin is changed, but routes are still advertised.
D
The configuration is invalid because origin cannot be changed with a route-map.
Why wrong: Incorrect. Origin can be set with route-map.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full VLAN trunking answer →

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

A
access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0 any eq 443 access-group INSIDE in interface inside
Why wrong: Transparent mode does not use interface access-groups; global access-list is used.
B
access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any
Why wrong: Permits all IP traffic, not just HTTPS.
C
access-list GLOBAL extended permit tcp any any eq 443
Why wrong: Permits HTTPS from any source, not specific to inside subnet.
D
access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
Correct: global access-list permits traffic from inside subnet to any on port 443.

Full breakdown with real-world context →

Question 6hardmultiple choice

Study the full ACL explanation →

An engineer is configuring a new Cisco 9800 WLC in a branch office. The WLC will manage 50 APs and must provide guest access with a captive portal. The engineer configures a guest SSID with open authentication and a redirect ACL for the captive portal. However, after the configuration, clients can associate to the guest SSID but cannot reach the captive portal page. What is the most likely cause?

A
The guest SSID is configured with open authentication, which does not support captive portal.
Why wrong: Incorrect because open authentication is commonly used with captive portals; the portal handles authentication after association.
B
The redirect ACL is missing entries for DNS and HTTP traffic to the captive portal server.
Correct because the redirect ACL must permit DNS and HTTP traffic to the portal server so that the client's initial HTTP request is redirected to the captive portal.
C
The WLC does not have a dedicated guest interface configured.
Why wrong: Incorrect because a dedicated guest interface is not mandatory; the WLC can use a VLAN interface for guest traffic.
D
The captive portal requires a RADIUS server to be configured on the WLC.
Why wrong: Incorrect because captive portal can use local authentication or an external web server; RADIUS is optional.

Full breakdown with real-world context →

Question 7mediummultiple choice

Study the full ACL explanation →

A network engineer is troubleshooting a site-to-site IPsec VPN tunnel between two Cisco routers. The tunnel is established and IKEv2 Phase 1 is up, but no traffic passes. The engineer checks the crypto map and sees that the ACL is configured to permit traffic between the two LAN subnets. However, 'show crypto ipsec sa' shows that the number of packets encapsulated and decapsulated is zero. What is the most likely cause?

A
The crypto map is not applied to the correct interface.
Why wrong: Incorrect. If the crypto map were not applied, Phase 1 would not come up. Phase 1 is up, so the crypto map is applied correctly.
B
The IPsec transform set uses ESP with SHA-1, but the remote router expects AES-GCM.
Correct. A mismatch in the transform set (e.g., encryption or authentication algorithms) will prevent Phase 2 from establishing, even though Phase 1 (which uses a different proposal) may succeed.
C
The ACL on the crypto map is missing the 'permit ip' statement for the return traffic.
Why wrong: Incorrect. The ACL only needs to match the traffic that will be encrypted; it is not required to permit return traffic explicitly because IPsec uses the same SA for both directions if configured correctly.
D
The tunnel interface is down due to a routing issue.
Why wrong: Incorrect. The tunnel interface is not used in a crypto map-based VPN; it is a site-to-site VPN using physical interfaces. The tunnel interface is not relevant here.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full VPN explanation →

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252

tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.2 tunnel mode ipsec ipv4 !

crypto isakmp policy 10

authentication pre-share encryption aes 256 hash sha group 14 lifetime 86400 !

crypto isakmp key cisco123 address 203.0.113.2

crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac

mode tunnel !

crypto map CMAP 10 ipsec-isakmp

set peer 203.0.113.2 set transform-set TSET match address 100 !

interface GigabitEthernet0/0
 crypto map CMAP

access-list 100 permit ip 10.0.0.0 0.0.0.3 10.0.0.4 0.0.0.3

What is the effect of this configuration?

A
The configuration creates an IPsec VTI that encrypts traffic between the two tunnel endpoints.
Correct. The tunnel mode ipsec ipv4 and crypto map create a secure tunnel, and the ACL matches the tunnel subnets.
B
The configuration will fail because the crypto map must be applied to the tunnel interface, not the physical interface.
Why wrong: Incorrect. For IPsec VTI, the crypto map is applied to the physical interface to protect the tunnel.
C
The configuration will only encrypt traffic from 10.0.0.0/30 to 10.0.0.4/30, but not the reverse.
Why wrong: Incorrect. The ACL is symmetric and will match traffic in both directions.
D
The configuration uses IKEv2 because of the transform-set and crypto map.
Why wrong: Incorrect. The crypto isakmp policy indicates IKEv1; IKEv2 uses 'crypto ikev2' commands.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full NAT/PAT explanation →

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat outside

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

access-list 1 permit 192.168.1.0 0.0.0.255

ip nat inside source list 1 interface GigabitEthernet0/0 overload

What is the effect of this configuration?

A
All traffic from 192.168.1.0/24 will be translated to the IP address of GigabitEthernet0/0 using PAT.
Correct. The 'overload' keyword enables PAT, translating multiple inside hosts to a single outside IP.
B
Only one host from 192.168.1.0/24 can access the internet at a time.
Why wrong: Incorrect. PAT allows multiple hosts to share the same IP address by using different port numbers.
C
Traffic from the outside interface will be translated to 192.168.1.0/24.
Why wrong: Incorrect. This is source NAT; destination NAT would require 'ip nat outside source'.
D
The configuration will fail because the access list must be applied to an interface.
Why wrong: Incorrect. The access list is referenced by the NAT command and does not need to be applied to an interface.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

A
The access list used for NAT does not permit the web server's IP address.
Why wrong: Incorrect because the access list is used to identify which inside local addresses are eligible for translation; it does not affect static mappings.
B
The engineer forgot to add the ip nat inside source static command for the web server.
Correct because a static NAT entry is required to map the public IP to the internal web server's private IP, allowing inbound connections.
C
The ip nat inside and ip nat outside commands are applied on the wrong interfaces.
Why wrong: Incorrect because the scenario does not indicate an interface misapplication; the issue is the lack of a static mapping.
D
The global configuration mode is missing the ip nat pool command.
Why wrong: Incorrect because a pool is not required for static NAT; it is used for dynamic NAT with multiple addresses.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

A
The access list 100 does not permit the 172.16.0.0/16 network.
Correct because the NAT configuration only translates traffic that matches the access list; hosts not in the list are not translated.
B
The router's interface GigabitEthernet0/0 is not configured with ip nat outside.
Why wrong: Incorrect because if the outside interface were missing the command, no translations would work at all.
C
The 172.16.0.0/16 hosts have a default gateway pointing to a different router.
Why wrong: Incorrect because the engineer verified connectivity to the router, implying the default gateway is correct.
D
The NAT pool is exhausted for the 172.16.0.0/16 network.
Why wrong: Incorrect because the configuration uses overload (PAT), which does not require a pool; it uses the interface IP.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full NAT/PAT explanation →

Consider the following configuration snippet: ```

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/2
 ip address 203.0.113.1 255.255.255.0
 ip nat outside

ip nat inside source list 1 interface GigabitEthernet0/2 overload
access-list 1 permit 192.168.1.0 0.0.0.255

``` What is the effect of this configuration?

A
It translates all traffic from 192.168.1.0/24 to the IP address 203.0.113.1, using port address translation.
Correct. The 'overload' keyword enables PAT, and the interface IP is used as the translated address.
B
It performs static NAT for each host in 192.168.1.0/24 to a unique IP in the 203.0.113.0/24 network.
Why wrong: Incorrect. This is dynamic NAT with overload, not static NAT.
C
It translates only traffic from 192.168.1.1 to the outside interface IP.
Why wrong: Incorrect. Access-list 1 permits the entire subnet, not just the host.
D
The configuration is invalid because 'ip nat inside' and 'ip nat outside' are on the wrong interfaces.
Why wrong: Incorrect. The inside/outside assignment is correct for typical NAT scenarios.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full NAT/PAT explanation →

Analyze this NAT configuration: ```

ip nat pool GLOBAL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool GLOBAL overload
access-list 1 permit 192.168.1.0 0.0.0.255

``` Which statement is correct?

A
Traffic from 192.168.1.0/24 is translated to addresses in the range 203.0.113.10-20, using PAT.
Correct. The pool provides the translated addresses, and overload enables PAT.
B
Each host in 192.168.1.0/24 gets a unique IP from the pool without port translation.
Why wrong: Incorrect. Overload means PAT is used, so multiple hosts share addresses.
C
The pool must include the outside interface IP address.
Why wrong: Incorrect. The pool can be any range, not necessarily including the interface IP.
D
Access-list 1 is used to filter inbound traffic.
Why wrong: Incorrect. The access-list identifies inside source addresses to be translated.

Full breakdown with real-world context →

Question 14mediummultiple choice

Study the full multicast explanation →

Given the following partial configuration on a Cisco IOS-XE router:

ip pim rp-address 10.0.0.1 10
access-list 10 permit 224.0.0.0 0.255.255.255

interface GigabitEthernet0/0
 ip pim sparse-mode

What is the effect of this configuration?

A
The router will use 10.0.0.1 as the RP for all multicast groups from 224.0.0.0 to 224.255.255.255, and the interface will operate in sparse-mode.
Correct. The static RP is defined for the group range specified in ACL 10, and the interface is in sparse-mode.
B
The router will ignore the static RP because the ACL includes the reserved link-local range (224.0.0.0/24).
Why wrong: Incorrect. The router will still use the static RP for all groups in the ACL, including the link-local range, though this is not recommended.
C
The interface must also be configured with 'ip pim dense-mode' for the RP to work.
Why wrong: Incorrect. PIM sparse-mode is required for RP-based multicast. Dense-mode does not use an RP.
D
The RP address 10.0.0.1 must be configured on a loopback interface on the same router.
Why wrong: Incorrect. The RP can be any reachable IP address, not necessarily on the same router.

Full breakdown with real-world context →

Question 15mediummultiple choice

Study the full multicast explanation →

Examine the following configuration snippet:

ip pim send-rp-announce Loopback0 scope 10 group-list 10
ip pim send-rp-discovery scope 10
access-list 10 permit 239.0.0.0 0.255.255.255

interface Loopback0
 ip address 192.168.0.1 255.255.255.255
 ip pim sparse-mode

What is the purpose of this configuration?

A
The router will act as both a candidate RP for groups 239.0.0.0/8 and a mapping agent for Auto-RP within a scope of 10 hops.
Correct. The router is configured as both a candidate RP and a mapping agent, with a TTL scope of 10.
B
The router will only act as a mapping agent and will not advertise itself as an RP.
Why wrong: Incorrect. The 'send-rp-announce' command makes it a candidate RP as well.
C
The router will use the IP address of GigabitEthernet0/0 as the RP address.
Why wrong: Incorrect. The RP address is taken from the interface specified in the 'send-rp-announce' command, which is Loopback0.
D
The router will only accept RP announcements from other routers within 10 hops.
Why wrong: Incorrect. The scope limits the TTL of the announcements sent, not the acceptance of announcements.

Full breakdown with real-world context →

These 350-401 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-401 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Access Control List (ACL) Scenarios

How to approach access control list (acl) scenarios

Quick answer

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Practice scenarios

Drag and drop the steps to configure an extended access control list (ACL) on a Cisco router in the correct order.

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit