350-401 · topic practice
Practise 350-401 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.
Why learners struggle
ACL questions are missed when learners apply the wrong direction, overlook the implicit deny, or confuse standard ACL source-only matching with extended ACL protocol and destination matching. A single out-of-order rule or wrong interface direction makes an otherwise correct ACL fail.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Equivalent to ip access-list extended in IPv4
Equivalent to deny ip in IPv4 extended ACL
Equivalent to permit tcp in IPv4 extended ACL
Equivalent to sequence number in IPv4 named ACL
Equivalent to implicit deny ip in IPv4 ACL
Drag a concept onto its matching description — or click a concept then click the description.
Filters based on source IP address only
Filters based on source/destination IP, protocol, and port numbers
Allows alphanumeric naming for easier identification
Applies time-of-day restrictions to permit or deny traffic
Opens temporary holes for user authentication
Trap 1: CoPP can only be used to rate-limit traffic, not to drop it.
Incorrect because CoPP can both rate-limit and drop traffic using police actions such as 'drop' or 'transmit'.
Trap 2: CoPP is applied to all physical interfaces to protect the data…
Incorrect because CoPP is applied to the control plane, not to physical interfaces; data plane protection is handled by other mechanisms like ACLs on interfaces.
Trap 3: CoPP can only filter IPv4 traffic.
Incorrect because CoPP can filter both IPv4 and IPv6 traffic using appropriate ACLs.
CoPP uses ACLs to match traffic destined for the control plane.
Correct because CoPP relies on ACLs to classify traffic that is sent to the control plane.
CoPP is applied as a service policy on the control plane interface.
Correct because the policy map is applied to the control plane using the 'service-policy' command under 'control-plane' configuration.
CoPP can only be used to rate-limit traffic, not to drop it.
Why wrong: Incorrect because CoPP can both rate-limit and drop traffic using police actions such as 'drop' or 'transmit'.
CoPP is applied to all physical interfaces to protect the data plane.
Why wrong: Incorrect because CoPP is applied to the control plane, not to physical interfaces; data plane protection is handled by other mechanisms like ACLs on interfaces.
CoPP can only filter IPv4 traffic.
Why wrong: Incorrect because CoPP can filter both IPv4 and IPv6 traffic using appropriate ACLs.
Trap 1: ACL entries are processed from bottom to top, with the last match…
Incorrect because ACL entries are processed sequentially from top to bottom; the first match determines the action.
Trap 2: An ACL applied to an inbound interface filters traffic leaving that…
Incorrect because an inbound ACL filters traffic entering the interface; an outbound ACL filters traffic leaving the interface.
Standard ACLs can filter traffic based on source IP address only.
Correct because standard ACLs (numbered 1-99, 1300-1999) examine only the source IP address.
Extended ACLs can filter based on source and destination IP addresses, protocol, and port numbers.
Correct because extended ACLs (numbered 100-199, 2000-2699) support these additional match criteria.
An implicit deny any statement is automatically added at the end of every ACL.
Correct because all ACLs have an implicit deny any at the end, which drops any traffic not explicitly permitted.
ACL entries are processed from bottom to top, with the last match determining the action.
Why wrong: Incorrect because ACL entries are processed sequentially from top to bottom; the first match determines the action.
An ACL applied to an inbound interface filters traffic leaving that interface.
Why wrong: Incorrect because an inbound ACL filters traffic entering the interface; an outbound ACL filters traffic leaving the interface.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
CPU overload from excessive control plane traffic
IP spoofing attacks
Rogue DHCP server
ARP cache poisoning
IP spoofing on access ports
A network engineer runs the following command on Router R1:
R1# show policy-map control-plane
Control Plane
Service-policy input: CoPP-POLICY
Class-map: BGP-CLASS (match-all) 50 packets, 2500 bytes 5 minute offered rate 500 bps Match: access-group name BGP-ACL police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 50 packets, 2500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Class-map: SNMP-CLASS (match-all) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: access-group name SNMP-ACL police: cir 16000 bps, bc 2000 bytes, be 2000 bytes conformed 150 packets, 7500 bytes; actions: transmit exceeded 40 packets, 2000 bytes; actions: drop violated 10 packets, 500 bytes; actions: drop
Class-map: class-default (match-any) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: any police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 100 packets, 5000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Based on this output, what can be concluded?
Trap 1: BGP traffic is being dropped because it exceeds the CIR.
BGP shows all 50 packets conformed, so no drops.
Trap 2: All traffic to the control plane is being dropped.
Only SNMP traffic is being partially dropped; BGP and class-default have no drops.
Trap 3: The control-plane policy is applied in the output direction.
The service-policy is input, so it is inbound.
SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.
The SNMP class shows 150 conformed and 50 dropped (exceeded+violated), while BGP shows all 50 conformed.
BGP traffic is being dropped because it exceeds the CIR.
Why wrong: BGP shows all 50 packets conformed, so no drops.
All traffic to the control plane is being dropped.
Why wrong: Only SNMP traffic is being partially dropped; BGP and class-default have no drops.
The control-plane policy is applied in the output direction.
Why wrong: The service-policy is input, so it is inbound.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: Marking can only be applied to Layer 2 frames using CoS bits.
Incorrect because marking can be applied at Layer 3 using DSCP or IP precedence, not just Layer 2 CoS.
Trap 2: Marking is a congestion avoidance mechanism that uses tail drop.
Incorrect because marking is a classification tool, not a congestion avoidance mechanism; tail drop is used in queuing.
Trap 3: A class map is used to apply marking actions to classified traffic.
Incorrect because class maps only define match criteria; policy maps apply actions like marking.
A class map can match traffic based on DSCP, CoS, IP precedence, or ACL.
Correct because class maps support multiple match criteria including DSCP, CoS, IP precedence, and ACLs.
Marking should be performed as close to the source as possible, typically at the access layer.
Correct because marking at the access layer ensures consistent treatment throughout the network.
Marking can only be applied to Layer 2 frames using CoS bits.
Why wrong: Incorrect because marking can be applied at Layer 3 using DSCP or IP precedence, not just Layer 2 CoS.
Marking is a congestion avoidance mechanism that uses tail drop.
Why wrong: Incorrect because marking is a classification tool, not a congestion avoidance mechanism; tail drop is used in queuing.
A class map is used to apply marking actions to classified traffic.
Why wrong: Incorrect because class maps only define match criteria; policy maps apply actions like marking.
Trap 1: CoPP is used to police traffic in the data plane to protect against…
Incorrect because CoPP protects the control plane, not the data plane. Data plane policing is done by other features like ACLs or QoS on interfaces.
Trap 2: CoPP is applied directly to physical interfaces using the…
Incorrect because CoPP is applied to the control plane using 'service-policy input' under 'control-plane' configuration, not directly to interfaces.
CoPP uses Modular QoS CLI (MQC) to define traffic classes and policies.
Correct because CoPP is configured using MQC with class maps, policy maps, and the 'service-policy' command applied to the control plane.
CoPP is used to police traffic in the data plane to protect against DoS attacks.
Why wrong: Incorrect because CoPP protects the control plane, not the data plane. Data plane policing is done by other features like ACLs or QoS on interfaces.
CoPP can rate-limit or drop certain types of control plane traffic to prevent CPU overload.
Correct because CoPP can apply policing actions (e.g., drop, transmit, or set a rate limit) to control plane traffic to mitigate attacks.
CoPP classifies traffic into categories such as critical, normal, and management.
Correct because CoPP typically defines classes for different types of control plane traffic (e.g., routing protocols, SSH, ICMP) with appropriate policies.
CoPP is applied directly to physical interfaces using the 'service-policy' command.
Why wrong: Incorrect because CoPP is applied to the control plane using 'service-policy input' under 'control-plane' configuration, not directly to interfaces.
Trap 1: CoPP is applied to traffic transiting the router, not to traffic…
Incorrect because CoPP applies to traffic destined to the router, not transiting traffic.
Trap 2: The default action for CoPP is to permit all control-plane traffic.
Incorrect because the default action for CoPP is to drop unmatched traffic, not permit.
CoPP applies QoS policy-map logic to traffic that is destined to the control plane of the router.
Correct because CoPP uses QoS policy-maps to police traffic destined to the control plane.
CoPP is configured under the 'control-plane' global configuration mode.
Correct because CoPP is configured in the 'control-plane' configuration mode.
CoPP can be applied to both IPv4 and IPv6 traffic in a single policy-map.
Correct. CoPP allows a single policy-map to include multiple class-maps for different protocols, including both IPv4 and IPv6.
CoPP is applied to traffic transiting the router, not to traffic originated by the router.
Why wrong: Incorrect because CoPP applies to traffic destined to the router, not transiting traffic.
The default action for CoPP is to permit all control-plane traffic.
Why wrong: Incorrect because the default action for CoPP is to drop unmatched traffic, not permit.
Trap 1: Extended ACLs can filter based on source MAC addresses.
Incorrect because MAC address filtering is done by MAC ACLs, not IP extended ACLs.
Trap 2: Extended ACLs only filter traffic based on the source IP address.
Incorrect because extended ACLs can filter on both source and destination, as well as protocol and port.
Extended ACLs can filter based on source and destination IP addresses.
Correct because extended ACLs evaluate both source and destination addresses.
Extended ACLs can filter based on TCP or UDP port numbers.
Correct because extended ACLs can specify protocol and port information for TCP/UDP.
Extended ACLs are processed in order until a matching permit or deny statement is found.
Correct because ACLs use first-match logic.
Extended ACLs can filter based on source MAC addresses.
Why wrong: Incorrect because MAC address filtering is done by MAC ACLs, not IP extended ACLs.
Extended ACLs only filter traffic based on the source IP address.
Why wrong: Incorrect because extended ACLs can filter on both source and destination, as well as protocol and port.
Trap 1: The ACL is applied in the wrong order; the deny statement should be…
Incorrect because ACL order is evaluated sequentially; a permit before deny would permit the specific peer, but the deny for others would still be processed.
Trap 2: BGP uses UDP port 179, not TCP, so the ACL does not match BGP…
Incorrect because BGP uses TCP port 179.
Trap 3: CoPP does not affect BGP sessions because they are established…
Incorrect because CoPP applies to all control plane traffic, including BGP, regardless of when the session was established.
The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.
Correct because CoPP only applies to traffic matched by the class-map; if the ACL denies traffic, it is not matched, and the default class (often permit) allows it.
The ACL is applied in the wrong order; the deny statement should be before the permit statement.
Why wrong: Incorrect because ACL order is evaluated sequentially; a permit before deny would permit the specific peer, but the deny for others would still be processed.
BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.
Why wrong: Incorrect because BGP uses TCP port 179.
CoPP does not affect BGP sessions because they are established before the policy is applied.
Why wrong: Incorrect because CoPP applies to all control plane traffic, including BGP, regardless of when the session was established.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Acls And Copp sessions
Every question in these sessions is drawn from the Acls And Copp domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Sharpen your 350-401 knowledge of Architecture.
Work through 350-401 questions on Virtualization.
Practise 350-401 questions linked to Infrastructure.
Sharpen your 350-401 knowledge of Network Assurance.
Security practice questions for 350-401.
Work through 350-401 questions on Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
A free account saves results across sessions and highlights which topics need work.
Sign up free