350-601 Security Practice Question
During a security audit, you discover that a Cisco Nexus 9000 switch is allowing traffic between two ports in the same VLAN despite having a VLAN ACL that should deny it. The VACL is applied correctly, and the ACL entries are properly configured. What is the most likely reason for this behavior?
⚠ Common exam trap
Cisco often tests the misconception that VACLs filter all traffic within a VLAN, when in fact they only apply to traffic crossing VLAN boundaries, leading candidates to overlook the intra-VLAN limitation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VACLs only filter traffic between VLANs, not within the same VLAN.
VLAN ACLs (VACLs) operate at Layer 2 and filter traffic entering or leaving a VLAN, but they only apply to traffic that crosses VLAN boundaries (i.e., inter-VLAN routing). Traffic between two ports within the same VLAN is bridged at Layer 2 and never traverses the VACL enforcement point, so the ACL entries have no effect on intra-VLAN communication. This is a fundamental design limitation of VACLs on Cisco Nexus switches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VACLs only filter traffic between VLANs, not within the same VLAN.
Why this is correct
VACLs filter inter-VLAN traffic; intra-VLAN traffic is not affected.
- ✗
The VACL requires Layer 3 inspection to be enabled.
Why it's wrong here
VACLs work at Layer 2 and do not require L3 inspection.
- ✗
The switch does not support hardware VACL processing.
Why it's wrong here
Nexus 9000 supports hardware VACL processing.
- ✗
Spanning-tree is bypassing the VACL for PortFast ports.
Why it's wrong here
Spanning-tree does not bypass VACLs.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.