How many Access Control List (ACL) Scenarios questions are on this page?

This page has 15 Access Control List (ACL) Scenarios scenario questions for the 200-201 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-201 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 200-201 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

scenario questions

200-201

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Practice scenarios

Question 1mediummultiple choice

Study the full ACL explanation →

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Exhibit

Refer to the exhibit.

! Output from show access-list 101
! Extended IP access list 101
!    10 permit tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 443
!    20 deny ip any any log
!

A
The deny statement with logging may generate excessive logs, potentially masking attacks.
Excessive logging can bury important alerts in noise.
B
The ACL is applied inbound on the outside interface, which could allow external traffic.
Why wrong: The exhibit does not indicate the direction; it just shows the ACL content.
C
The permit statement does not have logging enabled, so traffic is not monitored.
Why wrong: Logging on permit is optional; the issue is the deny log.
D
The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on any port.
Why wrong: It only permits port 443, not all ports.

Access Control List (ACL) Scenarios

How to approach access control list (acl) scenarios

Quick answer

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Concepts practice questions

Security Monitoring practice questions

Host-Based Analysis practice questions

Network Intrusion Analysis practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Practice scenarios

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Exhibit

Refer to the exhibit. An analyst configures an ACL to block traffic to a malicious host on port 443. After applying it inbound on the external interface, the analyst sees the ACL counters. What does the output indicate?

Exhibit

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Exhibit

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

Exhibit

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

Refer to the exhibit. What traffic is the router permitting?

Exhibit

Based on the exhibit, which traffic is permitted?

Exhibit

Exhibit

Refer to the exhibit. A security policy states that all remote desktop (RDP) and Telnet access from external networks must be blocked. Does the above access-list comply with the policy?

Exhibit

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

Exhibit

Refer to the exhibit. A Cisco router is configured with the shown access list applied inbound on the external interface. An external attacker sends a packet with source IP 10.0.0.1, destination IP 192.168.1.100, destination port 22. What will the router do?

Exhibit

Refer to the exhibit. A security analyst views these log entries from a Cisco router. What conclusion can be drawn about ACL 101?

Exhibit

According to the principles of least privilege, which THREE of the following access controls should be implemented for a typical user account? (Choose three.)

During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?

Refer to the exhibit. A network administrator applied this ACL inbound on the external interface of a firewall. An attacker sends a TCP SYN packet with source IP 192.0.2.1 to destination 10.1.1.100 port 80. Which statement accurately describes the packet's treatment?

Exhibit