350-601 Security Practice Question
Exhibit
Refer to the exhibit.
! Nexus 9000 ACL configuration
ip access-list BLOCK_MGMT
10 permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
20 deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
30 permit ip any any
interface Ethernet1/1
ip access-group BLOCK_MGMT in
description Management access to servers
! Output of 'show ip access-list BLOCK_MGMT'
IP access list BLOCK_MGMT
statistics per-entry
10 permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22 (0 matches)
20 deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255 (0 matches)
30 permit ip any any (0 matches)A network administrator implements the ACL shown. After verifying the ACL statistics, all counters show 0 matches. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that ACL counters being 0 is always due to a missing 'permit ip any any' or wrong entry order, but the real trap is that the ACL may simply not be processing any traffic because it is applied to the wrong interface or direction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is applied to the wrong interface.
If the ACL is applied to the wrong interface, traffic never traverses that interface, so the ACL counters remain at 0. ACLs must be applied to the interface where traffic enters (inbound) or exits (outbound) the device; applying to an interface that does not carry the relevant traffic results in no matches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL entries are in the wrong order.
Why it's wrong here
Order is proper: permit SSH first, deny rest, then permit all.
- ✓
The ACL is applied to the wrong interface.
Why this is correct
Ethernet1/1 is a management interface; production traffic likely uses other interfaces.
- ✗
The 'permit ip any any' entry causes all traffic to be permitted before inspection.
Why it's wrong here
Sequence number 30 is last; it would only match after previous entries are evaluated.
- ✗
The ACL is applied outbound instead of inbound.
Why it's wrong here
The configuration shows 'in', so it is inbound.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.