Courseiva
← 350-701
Full test
mediumMultiple ChoiceObjective-mapped

350-701 Practice Question: An engineer applies the ACL shown in the exhibit…

Exhibit

Refer to the exhibit.

ip access-list extended BLOCK_TRAFFIC
 deny ip host 10.1.1.100 192.168.0.0 0.0.255.255
 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group BLOCK_TRAFFIC in

An engineer applies the ACL shown in the exhibit to the inbound direction of interface GigabitEthernet0/0. The goal is to block all traffic from host 10.1.1.100 to the 192.168.0.0/16 network. However, traffic from 10.1.1.100 to 192.168.1.1 is still being permitted. What is the most likely reason?

⚠ Common exam trap

It's easy for candidates to assume an ACL applied inbound on one interface will filter all traffic from a source, but Cisco tests the understanding that ACLs are interface- and direction-specific, and traffic can bypass the ACL if it enters through a different interface.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The traffic from 10.1.1.100 is entering through a different interface

ACLs process traffic only on the interface and direction to which they are applied. If the ACL is applied inbound on GigabitEthernet0/0 but the traffic from host 10.1.1.100 to 192.168.1.1 enters through a different interface (e.g., GigabitEthernet0/1), the ACL will never evaluate that traffic, allowing it to pass. This is a fundamental behavior of interface-based ACL filtering in Cisco IOS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The deny entry should be placed after the permit entry

    Why it's wrong here

    ACLs are processed top-down; the deny entry is first, so it should match before the permit.

  • ✗

    The ACL should be applied outbound instead of inbound

    Why it's wrong here

    Inbound ACL filters traffic coming into the interface; if the traffic arrives on that interface, inbound is correct.

  • ✗

    The ACL is applied to the wrong direction; it should be 'out'

    Why it's wrong here

    For blocking inbound traffic, the 'in' direction is correct.

  • ✓

    The traffic from 10.1.1.100 is entering through a different interface

    Why this is correct

    If the traffic does not enter via GigabitEthernet0/0, the ACL will not be applied to it.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.