How many Access Control List (ACL) Scenarios questions are on this page?

This page has 14 Access Control List (ACL) Scenarios scenario questions for the 350-601 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-601 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco DCCOR / CCNP Data Center Core 350-601 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 350-601 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

scenario questions

350-601

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Practice scenarios

Question 1mediummultiple choice

Study the full ACL explanation →

A data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?

A
permit ip any any deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255 permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
Why wrong: Permits all before deny, making deny useless.
B
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22 permit ip any any deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
Why wrong: Permits all traffic after SSH, opening full access.
C
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22 deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255 permit ip any any
Correct order: permit specific, deny source, permit rest.
D
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255 permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22 permit ip any any
Why wrong: Denies management traffic before permitting jump host, blocking SSH.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

A Cisco MDS 9000 switch is used in a storage network. The security policy requires that a junior administrator named 'user1' can view zone configurations but cannot make any changes. Currently, 'user1' is assigned the default 'network-operator' role, which allows read-only access to most configuration, but the engineer wants to ensure that zone modification is explicitly denied. The engineer creates a custom role named 'zone-viewer' and assigns it to 'user1'. The role should permit viewing of the running configuration related to zones but deny any command that modifies zone or zoneset configurations. Which configuration best achieves this objective?

A
role name zone-viewer feature zone; permit command configure terminal ; zone name etc.
Why wrong: Incorrect syntax; 'feature zone' is not a valid command for role configuration.
B
role name zone-viewer permit command show zone*; permit command show zoneset*
Permits show commands for zone and zoneset, denying configuration commands by default.
C
role name zone-viewer rule 1 permit read-write; feature zone
Why wrong: This uses rule-based syntax not applicable to MDS; also read-write would allow changes.
D
role name zone-viewer permit command zone; permit command zoneset; permit command zone-create
Why wrong: These commands are for configuration, which would allow modification.

Full breakdown with real-world context →

Question 3easymultiple choice

Full question →

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

A
RADIUS
Why wrong: RADIUS uses UDP and does not encrypt entire packet; it combines authentication and authorization.
B
LDAP
Why wrong: LDAP is a directory access protocol, not designed for device AAA.
C
SSH
Why wrong: SSH provides secure remote shell access, not AAA services.
D
TACACS+
TACACS+ encrypts entire packet except header and separates AAA functions.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

A network engineer is configuring an ACI contract between an EPG and an external EPG. Which construct is used to permit traffic from the external EPG to the internal EPG?

A
The internal EPG is the provider and the external EPG is the consumer.
Why wrong: That would allow internal to external, not external to internal.
B
Both EPGs are providers.
Why wrong: Contracts have one provider and one consumer.
C
Both EPGs are consumers.
Why wrong: A contract requires a provider.
D
The external EPG is the provider and the internal EPG is the consumer.
Correct direction for inbound traffic.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full VLAN trunking answer →

A data center engineer is troubleshooting connectivity issues between two EPGs in the same tenant on a Cisco ACI fabric. The first EPG 'web_epg' is in VLAN 100 and the second EPG 'db_epg' is in VLAN 200. The contract 'web_to_db' allows TCP port 3306 from web_epg to db_epg. The EPGs are in the same VRF. The engineer has verified that the physical connectivity is correct and the endpoints are learning their IP addresses. However, traffic from web_epg to db_epg is not reaching the destination. The engineer checks the contract and sees that the subject 'mysql_access' has filter 'mysql' with direction 'both'. The provider is db_epg and consumer is web_epg. The engineer also notices that the default action in the contract is 'deny'. What is the most likely cause of the issue?

A
The contract direction is reversed: the provider should be the destination of the traffic. Since web_epg initiates to db_epg, web_epg should be the provider.
In ACI, the provider offers a service; the consumer initiates. Here web_epg initiates, so web_epg should be provider.
B
The VRF is not correctly associated with the EPGs.
Why wrong: EPGs are in the same VRF, so routing is fine.
C
A Layer 3 Outside (L3Out) is required for communication between EPGs in the same VRF.
Why wrong: L3Out is for external connectivity, not internal EPG communication.
D
The filter 'mysql' does not match TCP port 3306.
Why wrong: The filter likely matches 3306, given it's named mysql.

Full breakdown with real-world context →

Question 6easymultiple choice

Full question →

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

A
Create a contract between EPGs with appropriate filters.
Contracts in ACI define allowed communication with filters for specific protocols/ports.
B
Use a tenant to separate the EPGs logically.
Why wrong: Tenants are administrative boundaries, not policy enforcement points.
C
Configure a VRF to isolate traffic between EPGs.
Why wrong: VRF provides routing separation, not granular filtering.
D
Define a bridge domain with L2 policies.
Why wrong: Bridge domain is for Layer 2 forwarding, not access control.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

A
It forwards the traffic to the Cisco ISE for policy decision
Why wrong: Policy is enforced locally on the switch.
B
It applies an IP ACL based on the SGT
Why wrong: SGACL does not rely on IP ACLs.
C
It uses the SGACL to permit HTTP and deny other traffic
SGACLs are directly enforced.
D
It drops all traffic between different SGTs unless a contract exists
Why wrong: SGACL defines allowed traffic.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A data center architect needs to enforce role-based access control for UCS Manager. What is the correct approach?

A
Create user roles with specific privileges in UCS Manager
UCS Manager native RBAC allows granular control.
B
Enable CoPP for management access
Why wrong: CoPP is not related to RBAC.
C
Use TACACS+ to assign roles
Why wrong: TACACS+ can be used but native RBAC is more granular.
D
Use RADIUS for authentication only
Why wrong: RADIUS does not provide RBAC in UCS.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

A
Filter with action deny
Why wrong: Filters are part of contracts, not standalone.
B
Taboo contract
Taboo contracts enforce a deny-all policy between EPGs.
C
QoS policy
Why wrong: QoS is for quality, not security.
D
VRF with route leaking
Why wrong: VRF does not deny traffic.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full AAA explanation →

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

A
TACACS+
Why wrong: TACACS+ is used for device administration, not 802.1X.
B
RADIUS
RADIUS is the standard protocol for 802.1X authentication.
C
LDAP
Why wrong: LDAP is for directory queries, not 802.1X.
D
DIAMETER
Why wrong: DIAMETER is an evolution of RADIUS but not commonly used in Cisco data center environments for 802.1X.

Full breakdown with real-world context →

Question 11mediummultiple choice

Open the full VLAN trunking answer →

A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?

A
ip access-group ACL_NAME in on VLAN interface
The correct syntax is applied to the VLAN interface.
B
ip access-group ACL_NAME on VLAN
Why wrong: Missing 'in' or 'out' direction.
C
access-list ACL_NAME in on VLAN interface
Why wrong: Incorrect command syntax.
D
vlan access-group ACL_NAME in
Why wrong: This is not a valid Nexus command.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?

A
Taboo contract
Taboo contracts explicitly deny specified traffic between EPGs.
B
No contract
Why wrong: Without a contract, no traffic is permitted; but the requirement is to deny specifically, not to block all.
C
Regular contract with a deny filter
Why wrong: Regular contracts only permit traffic; they cannot deny.
D
Intra-EPG contract
Why wrong: Intra-EPG contracts are for traffic within the same EPG.

Full breakdown with real-world context →

Question 13mediummultiple choice

Full question →

A data center administrator is implementing Cisco TrustSec on a Nexus 7000 switch to enforce role-based access control. After configuring a security group tag (SGT) classification policy, users report that traffic between two servers is not being tagged. What is the most likely cause?

A
DHCP snooping is not enabled on the VLAN.
Why wrong: DHCP snooping is unrelated to SGT classification.
B
The ingress interface is missing the 'sgt' or 'ip policy' command to classify traffic.
Ingress interface must have 'sgt' or 'ip policy' to assign SGTs.
C
The switch ASIC does not support TrustSec in hardware.
Why wrong: Nexus 7000 generally supports TrustSec in hardware.
D
The SGT is assigned on the egress interface instead of ingress.
Why wrong: SGT classification happens on ingress.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

A
Context (default)
Why wrong: Context scope restricts contract application to EPGs within the same bridge domain; cross-bridge-domain traffic would be denied regardless of contract.
B
Application-profile
Why wrong: Application-profile is not a valid contract scope in ACI.
C
Global
Why wrong: Global scope would allow contracts to apply across VRFs, which is too permissive and not typically recommended.
D
VRF
VRF scope allows contracts to apply across bridge domains within the same VRF; without a contract, traffic is denied, and with a contract, permitted.

Full breakdown with real-world context →

These 350-601 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-601 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Access Control List (ACL) Scenarios

How to approach access control list (acl) scenarios

Quick answer

Related 350-601 topic practice pages

Network practice questions

Storage Network practice questions

Automation practice questions

Compute practice questions

Security practice questions

350-601 fundamentals practice questions

350-601 scenario practice questions

350-601 troubleshooting practice questions

Practice scenarios

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

A network engineer is configuring an ACI contract between an EPG and an external EPG. Which construct is used to permit traffic from the external EPG to the internal EPG?

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

A data center architect needs to enforce role-based access control for UCS Manager. What is the correct approach?

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?

In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?

A data center administrator is implementing Cisco TrustSec on a Nexus 7000 switch to enforce role-based access control. After configuring a security group tag (SGT) classification policy, users report that traffic between two servers is not being tagged. What is the most likely cause?

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?