350-601 ACL Implicit Deny Practice Question
Exhibit
ip access-list extended BLOCK_TELNET permit tcp any any eq telnet ! vlan access-map SECURITY 10 match ip address BLOCK_TELNET action drop ! vlan access-map SECURITY 20 action forward ! vlan filter SECURITY vlan-list 10
Refer to the exhibit. What is the effect of this configuration on traffic in VLAN 10?
⚠ Common exam trap
Cisco often tests the implicit deny any any at the end of an ACL, leading candidates to forget that a permit statement must be explicitly added to allow other traffic; here the trap is that the ACL includes a permit ip any any, so the effect is selective denial rather than blanket denial.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Telnet traffic is denied; all other traffic is permitted.
The ACL applied to VLAN 10 contains two entries: the first denies TCP traffic destined for port 23 (Telnet), and the second permits all IP traffic (permit ip any any). As a result, Telnet packets are denied by the first entry, while all other traffic (including other TCP, UDP, ICMP, etc.) is permitted by the second entry. Option C correctly states this behavior. Option A incorrectly says Telnet is permitted. Option B incorrectly says all except telnet is denied; actually all other traffic is permitted. Option D incorrectly says all traffic is permitted; telnet is denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Telnet traffic is permitted; all other traffic is denied.
Why it's wrong here
This option states Telnet traffic is permitted and all other denied. Incorrect because Telnet is denied by the first ACE, and other traffic is permitted by the permit ip any any.
- ✗
All traffic is denied except telnet.
Why it's wrong here
This option states all traffic is denied except telnet. Incorrect because Telnet is denied, not excepted; other traffic is permitted.
- ✓
Telnet traffic is denied; all other traffic is permitted.
Why this is correct
Correct. The ACL denies Telnet (port 23) and permits all other traffic via an explicit permit ip any any.
- ✗
All traffic is permitted.
Why it's wrong here
This option states all traffic is permitted. Incorrect because Telnet is explicitly denied.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-601 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.