How many Access Control List (ACL) Scenarios questions are on this page?

This page has 15 Access Control List (ACL) Scenarios scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 350-701 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Practice scenarios

Question 1easymultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

A
show crypto ipsec sa
Displays IPsec security associations and packet/error counters.
B
show crypto engine statistics
Why wrong: Shows crypto engine utilization, not SA details.
C
debug crypto isakmp
Why wrong: Debug command that can impact performance; not a verification show command.
D
show crypto isakmp sa
Why wrong: Shows IKE phase 1 SAs, not IPsec phase 2 SAs.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

A financial company has a data center with Cisco FTD firewalls in a high-availability pair. They use Cisco ISE for network access control and Cisco Stealthwatch for network visibility. Recently, they deployed a new web application that is accessed by both internal employees and external customers. The application uses HTTPS on port 443. After deployment, the security team notices that the FTD is dropping some HTTPS sessions that appear legitimate. The drops are inconsistent and seem to occur only during peak hours. The FTD logs show the drop reason as 'TCP state violation'. The team has verified that the web server and clients are configured correctly. The Stealthwatch reports show no anomalies. What is the most likely cause and solution?

A
Enable SSL decryption to inspect the encrypted traffic
Why wrong: SSL decryption does not solve TCP state violations.
B
Increase the TCP timeout values on the FTD to accommodate longer sessions
Why wrong: Longer timeouts may help but the issue is state mismatch, not timeout.
C
Block all traffic to the web server except from trusted IPs
Why wrong: This is too restrictive and would block legitimate external customers.
D
Configure TCP state bypass on the FTD for the web server traffic
Bypassing state tracking allows packets that may be asymmetric to pass without being dropped.

Full breakdown with real-world context →

Question 3hardmulti select

Full question →

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

A
Profiling
ISE can profile endpoints to identify device type and OS.
B
Posture assessment
ISE checks endpoint compliance with security policies.
C
Guest access management
ISE provides captive portal and guest access policies.
D
Application visibility
Why wrong: Application visibility is provided by Cisco Firepower, not ISE.
E
NetFlow analysis
Why wrong: NetFlow analysis is a feature of Cisco Stealthwatch, not ISE.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?

Exhibit

configure terminal
access-list OUTSIDE extended permit tcp any host 203.0.113.10 eq www
access-list OUTSIDE extended permit udp any host 203.0.113.10 eq domain
nat (inside,outside) source dynamic any interface

A
The NAT rule is missing a static NAT for the server.
Without a static NAT, internal users cannot access the server via the public IP due to lack of hairpinning.
B
The access-list does not permit traffic from inside to outside for that destination.
Why wrong: The ACL is applied on the outside interface, so it does not filter inside-to-outside traffic.
C
The interface ACL is applied inbound on the inside interface.
Why wrong: The ACL is applied to the outside interface, not inside.
D
The default route is missing.
Why wrong: A missing default route would affect traffic to the internet, but not specifically internal access to a public IP.

Full breakdown with real-world context →

Question 5hardmultiple choice

Study the full ACL explanation →

Refer to the exhibit. An engineer has configured the ACL on the GigabitEthernet0/0 interface. Which of the following is true about the effect of this ACL?

Exhibit

interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip access-group INBOUND in
!
ip access-list extended INBOUND
 deny ip 10.0.0.0 0.255.255.255 any
 permit ip any any
!
interface Serial0/0/0
 ip address 172.16.1.1 255.255.255.252
!
router eigrp 100
 network 10.1.1.0 0.0.0.255
 network 172.16.1.0 0.0.0.3

A
It blocks all IP traffic from entering G0/0 because of the deny statement.
Why wrong: The permit any any allows all traffic that is not denied.
B
It blocks traffic sourced from 10.0.0.0/8 entering G0/0, but allows other traffic.
The deny statement blocks source 10.0.0.0/8, and the permit any any allows all else.
C
It permits all traffic because the ACL is misconfigured.
Why wrong: The ACL is correctly configured and will block traffic from 10.0.0.0/8.
D
It blocks traffic destined to 10.0.0.0/8 entering G0/0, but allows other traffic.
Why wrong: The ACL filters on source address, not destination.

Full breakdown with real-world context →

Question 6mediummultiple choice

Study the full ACL explanation →

A company has a site-to-site VPN between two ASA firewalls using IKEv2. The tunnel was working but after an upgrade, it fails. The engineer verifies that the pre-shared keys match, IKE proposals are compatible, and the crypto ACL is correctly defined. What is the next likely cause to investigate?

A
The firewall rules on the intermediate devices are blocking ISAKMP traffic.
Intermediate firewall changes during upgrade can block UDP ports 500 and 4500, preventing IKE negotiation. This is a common cause.
B
The ACL for interesting traffic is missing.
Why wrong: If the crypto ACL were missing, the tunnel would not have been triggered. But since it was working, it's likely still present.
C
The crypto map is not applied to the correct interface.
Why wrong: If the crypto map were not applied, the tunnel would not have been working before the upgrade. Since it was working, the map application is likely correct.
D
The MTU is too high.
Why wrong: MTU issues can cause problems but typically affect traffic after tunnel is up, not tunnel establishment.

Full breakdown with real-world context →

Question 7mediummultiple choice

Study the full ACL explanation →

A company has a Cisco ASA firewall configured with multiple access-lists applied to the outside interface. The security team is investigating reports that legitimate HTTPS traffic to a public web server located on a DMZ is intermittently being blocked. The firewall configuration includes an ACL that permits traffic to the web server's IP address on TCP 443, but also includes a general deny rule for all other traffic. The engineer notices that the permit rule is placed after a deny rule that blocks traffic from a specific source subnet that is used by internal users for testing. The internal users report that they can access the web server, but external users sometimes experience timeouts. What is the most likely cause of the intermittent blocking?

A
The permit rule for HTTPS is not hitting because traffic is being matched by a preceding deny rule.
If a deny rule earlier in the ACL matches the traffic, the permit rule is never evaluated, causing blocking.
B
The external users are hitting the firewall's connection limit.
Why wrong: Connection limits would affect both internal and external users equally, not just external.
C
The ASA is performing NAT incorrectly for the web server traffic.
Why wrong: NAT issues would affect all users consistently, not cause intermittent blocking for external only.
D
The ASA is experiencing high CPU utilization causing packet drops.
Why wrong: High CPU could cause drops, but intermittent block for only external users and not internal suggests an ACL ordering issue.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

An engineer is troubleshooting traffic drops on a Cisco Firepower Threat Defense (FTD) device. The traffic is allowed by the access control policy but is being dropped. Which feature should the engineer check to identify the cause of the drop?

A
Check the 'show access-list' output for the hit count.
Why wrong: Shows if the ACL matches, but not where drops occur.
B
Check the 'show route' output for routing issues.
Why wrong: Routing issues may cause drops, but not the only cause.
C
Use the 'capture' command with trace option to see packet flow and drop reason.
Captures packets and shows the disposition, including drops.
D
Check the 'show conn' output for the connection state.
Why wrong: Shows active connections, not drops.

Full breakdown with real-world context →

Question 9hardmultiple choice

Full question →

During a security audit, a penetration tester discovers that a Cisco ASA firewall is configured with a rule that permits traffic from the inside interface with a source IP address in the RFC 1918 range to the outside interface. The rule uses the 'inspect' command for HTTP and FTP. Which potential vulnerability does this configuration introduce?

A
FTP inspection permits anonymous login commands
Why wrong: FTP inspection does not permit anonymous login; it handles NAT and state tracking for FTP.
B
The configuration allows traffic without network address translation (NAT)
Why wrong: Lack of NAT is not a vulnerability; it may be intentional for internal networks.
C
The HTTP inspection may allow SQL injection attacks to bypass the firewall
Why wrong: HTTP inspection does not inherently allow SQL injection; it parses HTTP traffic but does not prevent application-layer attacks like SQL injection.
D
The firewall may allow IP spoofing if antispoofing is not enabled
Permitting RFC 1918 addresses from the inside without antispoofing checks can allow an attacker to spoof internal IP addresses.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

A company uses Cisco ISE for network access control. They want to allow employee-owned devices to access the guest network after a simple registration, while corporate devices get full access. Which ISE configuration best achieves this?

A
Use 802.1X with PEAP and machine certificates for all devices.
Why wrong: Guest devices may not support 802.1X.
B
Use MAB for unknown devices, then perform posture assessment; redirect to registration portal if needed.
MAB captures MAC, posture checks compliance, registration portal allows onboarding.
C
Use MAB only for corporate devices and deny all others.
Why wrong: Does not allow guest access.
D
Configure a single PSK for the guest SSID.
Why wrong: PSK is shared and does not provide per-device control.

Full breakdown with real-world context →

Question 11easymultiple choice

Study the full ACL explanation →

After applying a new extended ACL inbound on an interface, users report they can no longer reach a critical server on a different subnet. The ACL permits the server's IP and required ports. What is the most likely cause?

A
The router has run out of memory for ACL processing.
Why wrong: Unlikely in a typical scenario.
B
The ACL is applied in the outbound direction instead of inbound.
Why wrong: Direction change might cause issues but not typical for access.
C
The ACL is applied to the wrong interface.
Why wrong: Could be, but users report they can't reach server, likely ACL blocking.
D
The ACL is missing a permit for necessary traffic (e.g., return traffic or ARP), triggering the implicit deny.
Extended ACLs end with implicit deny; missing permit for other traffic blocks communication.

Full breakdown with real-world context →

Question 12mediummultiple choice

Full question →

A security analyst notices that a Cisco Firepower Threat Defense (FTD) device is not applying file policies to detect malware in HTTP traffic. The access control policy has an HTTPS decryption rule that decrypts traffic from external sources. The file policy is associated with the same rule. What is the missing configuration?

A
The file policy is set to 'Detect' but not 'Block' for malware.
Why wrong: Detection mode would still show events, not miss them entirely.
B
The HTTP inspection is not enabled in the access control policy's advanced settings.
File policies require the HTTP inspector to be enabled to scan files in HTTP streams.
C
SSL decryption is not configured for the internal network.
Why wrong: SSL decryption is already configured for external sources.
D
The URL category is not defined in the file policy.
Why wrong: File policies apply to all traffic matching the rule, regardless of URL category.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full wireless explanation →

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

A
Profiling policy
Why wrong: Profiling policy is used to identify device attributes, not to grant access.
B
Authentication policy
Why wrong: Authentication policy only determines how users are authenticated, not the resulting access.
C
Authorization policy
Authorization policy defines what access is granted after authentication.
D
Policy set
Why wrong: Policy set is a container that groups authentication and authorization policies; it does not directly enforce access.

Full breakdown with real-world context →

Question 14mediumdrag order

Study the full AAA explanation →

Drag and drop the steps to configure a Cisco ISE as a RADIUS server for network access control into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15easymultiple choice

Study the full ACL explanation →

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

A
show access-list
Why wrong: Shows ACL hit counts but not drop reasons.
B
show asp drop
Displays packet drop counters with reasons, including ACL and inspection drops.
C
show conn
Why wrong: Shows active connections, not drop reasons.
D
show service-policy
Why wrong: Shows inspection policy statistics but not specific drop reasons.

Full breakdown with real-world context →

These 350-701 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-701 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Access Control List (ACL) Scenarios

How to approach access control list (acl) scenarios

Quick answer

Related 350-701 topic practice pages

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?

Exhibit

Refer to the exhibit. An engineer has configured the ACL on the GigabitEthernet0/0 interface. Which of the following is true about the effect of this ACL?

Exhibit

A company has a site-to-site VPN between two ASA firewalls using IKEv2. The tunnel was working but after an upgrade, it fails. The engineer verifies that the pre-shared keys match, IKE proposals are compatible, and the crypto ACL is correctly defined. What is the next likely cause to investigate?

An engineer is troubleshooting traffic drops on a Cisco Firepower Threat Defense (FTD) device. The traffic is allowed by the access control policy but is being dropped. Which feature should the engineer check to identify the cause of the drop?

A company uses Cisco ISE for network access control. They want to allow employee-owned devices to access the guest network after a simple registration, while corporate devices get full access. Which ISE configuration best achieves this?

After applying a new extended ACL inbound on an interface, users report they can no longer reach a critical server on a different subnet. The ACL permits the server's IP and required ports. What is the most likely cause?

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Drag and drop the steps to configure a Cisco ISE as a RADIUS server for network access control into the correct order.

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?