350-601 Security Practice Question
A network engineer is troubleshooting inter-VLAN routing on a Cisco Nexus 9000 switch. The switch is configured with VLAN 10 and VLAN 20. Hosts in VLAN 10 cannot ping hosts in VLAN 20. The engineer checks the VLAN ACL (VACL) applied to VLAN 10 and finds the following configuration:
ip access-list VACL-FILTER 10 permit ip any any
...
vlan access-map VACL-MAP 10
match ip address VACL-FILTER action forward
vlan filter VACL-MAP vlan-list 10
What is the most likely reason for the connectivity failure?
⚠ Common exam trap
It's easy for candidates to assume VACLs can filter all traffic within a VLAN, including traffic that is routed to another VLAN, but Cisco specifically tests that VACLs only apply to bridged traffic, not to traffic that is routed through an SVI.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VACL does not apply to traffic routed through the SVI; a Router ACL (RACL) must be used instead.
VACLs filter traffic at the ingress of a VLAN, but they only apply to traffic that is bridged within the same VLAN. When traffic is routed between VLANs (inter-VLAN routing), it passes through the SVI (Switch Virtual Interface), and VACLs do not inspect routed traffic. To filter inter-VLAN routed traffic, a Router ACL (RACL) must be applied to the SVI. Since the hosts in VLAN 10 cannot ping VLAN 20, the VACL on VLAN 10 is not blocking the traffic; rather, the traffic is being routed and is not subject to the VACL, so the failure is likely due to a missing or misconfigured RACL or routing issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The access-list permits all, so the VACL should work; perhaps the access-map is missing a default action.
Why it's wrong here
The access-map has action forward, so it permits when matched. Default action is drop, but the ACL matches all, so it should forward. Not the likely cause.
- ✗
The 'vlan filter' command is applied to VLAN 10 only, but the access-map is misconfigured.
Why it's wrong here
The configuration appears correct; the issue is not the VACL configuration itself but its applicability.
- ✗
The VACL is applied only to VLAN 10, so traffic from VLAN 20 to VLAN 10 is not filtered, but this should not cause a failure.
Why it's wrong here
While true that the VACL is only on VLAN 10, the issue is that VACLs do not filter routed traffic, so this is not the root cause.
- ✓
The VACL does not apply to traffic routed through the SVI; a Router ACL (RACL) must be used instead.
Why this is correct
Correct. VACLs are only for Layer 2 bridging. For inter-VLAN routing, apply a RACL on the SVI interface.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.