How many Access Control List (ACL) Scenarios questions are on this page?

This page has 9 Access Control List (ACL) Scenarios scenario questions for the 200-201 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-201 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 200-201 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

scenario questions

200-201

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Practice scenarios

Question 1hardmultiple choice

Full question →

You are a security analyst for a medium-sized enterprise. The network includes a DMZ with a web server (10.0.1.10) and a database server (10.0.2.10) in the internal network. Users access the web server via HTTPS from the internet. The web server queries the database server on TCP 3306. Recently, users reported that the web application sometimes returns database errors. You review firewall logs and see the following:

- Allowed inbound HTTPS to 10.0.1.10 from various external IPs. - Denied outbound from 10.0.1.10 to 10.0.2.10 on port 3306. - Allowed outbound from 10.0.1.10 to external IPs on port 443.

You also notice that the web server's outbound traffic to the database server is being blocked. The firewall has a default deny rule. Which action should you take to restore normal operation while maintaining security?

A
Create a rule allowing inbound traffic on TCP 3306 to the database server from any source.
Why it fails: The denial is outbound from the web server, so an inbound rule on TCP 3306 never matches that traffic. Inbound database rules are for external clients connecting to a database, not for a DMZ host initiating queries to an internal server.
B
Move the database server to the DMZ to avoid firewall restrictions.
Why it fails: Relocating the database into the DMZ exposes it directly to internet-facing threats and breaks the tiered design; the block is an outbound DMZ-to-internal rule, not a placement issue. DMZ placement suits servers that must accept untrusted inbound connections directly.
C
Create a rule allowing all outbound traffic from the DMZ to the internal network.
Why it fails: Allowing all outbound DMZ-to-internal traffic restores database connectivity but grants the web server unrestricted reach into the internal network, violating DMZ segmentation. The denied log shows only TCP 3306 to 10.0.2.10 is required. Broad DMZ-to-internal rules suit trusted management subnets, not internet-facing hosts.
D
Create a rule allowing outbound traffic from the web server IP (10.0.1.10) to the database server IP (10.0.2.10) on TCP 3306.
The default deny rule is dropping the web server's database queries, causing the application errors. A rule permitting only 10.0.1.10 to reach 10.0.2.10 on TCP 3306 restores that specific flow while keeping all other outbound traffic blocked, preserving the DMZ segmentation.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

Which security principle ensures that a user cannot deny having performed an action?

A
Availability
Why it fails: Availability ensures systems and data remain accessible to authorised users, addressing uptime and denial-of-service resilience. It cannot bind an action to an individual, so it never prevents denial of that action. Availability is correct when the requirement concerns service continuity or redundancy rather than accountability.
B
Confidentiality
Why it fails: Confidentiality restricts data access to authorised parties through encryption and access controls; it says nothing about proving who performed an action. Non-repudiation provides that proof through signatures and tamper-evident logs. Confidentiality is the right principle when the requirement is preventing unauthorised disclosure.
C
Non-repudiation
Non-repudiation uses cryptographic evidence such as digital signatures to bind an action to a specific identity, so the actor cannot later credibly deny performing it. This directly satisfies the requirement that a user be unable to deny an action.
D
Integrity
Why it fails: Integrity guarantees data is unaltered in transit, detecting modification rather than linking an action to its originator. Non-repudiation is the principle that prevents a party denying having sent or performed something, typically via digital signatures and audit logs. Integrity is the right answer when tamper detection is the requirement.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

A mid-sized financial firm has a segmented network with a DMZ hosting a web server, an internal network with a database server, and an employee LAN. The security infrastructure includes a next-generation firewall (NGFW) with IPS, an endpoint detection and response (EDR) solution, and a SIEM. Over the past week, the SIEM has generated alerts for unusual outbound connections from the database server to an external IP address 198.51.100.33 on TCP port 443 during non-business hours. The EDR shows no malware on the database server, but a process named 'sqlsrv.exe' (the legitimate SQL Server process) is making these connections. The server's file integrity monitoring indicates that the sqlsrv.exe file has not been modified, but a memory dump reveals injected code that appears to be a reverse shell. The firewall logs show that the outbound connections are allowed because they match an existing rule permitting the database server to reach external update servers. The IP 198.51.100.33 is not on any threat intelligence feed as malicious, but it is geolocated to a country with known cybercrime activity. Which action should the security analyst take FIRST?

A
Isolate the database server from the network immediately to prevent data exfiltration.
Isolating the host halts the injected reverse shell's command-and-control channel and any exfiltration, containing an active compromise confirmed by the memory dump. The legitimate process name and clean file hash indicate fileless injection, so network isolation takes priority over further triage or blocking the single external IP.
B
Contact the software vendor to verify the digital signature of sqlsrv.exe.
Why it fails: File integrity monitoring already confirms sqlsrv.exe is unmodified, so signature verification adds nothing; the injected code lives in memory, not the binary. Vendor verification suits suspected tampering or supply-chain compromise of the executable itself, not a reflective in-memory reverse shell.
C
Add a firewall rule to block outbound connections to 198.51.100.33.
Why it fails: Blocking one IP leaves the injected reverse shell resident in memory, so the attacker simply reconnects to another endpoint. Firewall blocking suits containing known-bad command-and-control infrastructure during active incident response, not eradicating an established in-memory implant.
D
Run a full antivirus scan on the database server using an updated signature database.
Why it fails: Signature-based scanning matches on-disk files; the file is unmodified and the payload exists only as injected memory code, so the scan returns clean. Antivirus scanning suits commodity malware with known file signatures, not fileless injection requiring memory analysis and process termination.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

Refer to the exhibit. A security analyst is reviewing the ASA configuration. Which traffic will be permitted from the outside interface?

Exhibit

access-list OUT extended permit tcp any host 10.1.1.1 eq 80
access-list OUT extended deny ip any any
access-group OUT in interface outside

A
Any IP traffic to host 10.1.1.1
Why it fails: Any IP traffic to host 10.1.1.1 is broader than the exhibit's actual permit, which restricts specific protocols or ports to that host. It is tempting because a host-specific permit resembles a typical static NAT or DMZ rule, and would be correct if the ACL permitted all IP protocols to that address.
B
All traffic from the outside to the inside network
Why it fails: The ASA's outside interface applies an inbound ACL; permitting all traffic to the inside network contradicts the implicit deny and any specific permit statements shown. It is tempting because an any-any rule appears permissive, and would be correct only if the exhibit explicitly contained a permit ip any any entry.
C
TCP traffic to host 10.1.1.1 on port 80
The access list permits TCP from any source to host 10.1.1.1 on port 80, so only that specific web traffic is allowed inbound. Other protocols, ports, or destinations are implicitly denied by the trailing ACL rule.
D
HTTP traffic from internal hosts to the outside
Why it fails: HTTP from internal hosts to the outside describes outbound inspection from a higher-security interface, not inbound traffic arriving on the outside interface. It is tempting because it matches a common web-browsing policy, and would be correct if the question asked what the inside hosts may initiate outward.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full network assurance explanation →

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

A
HTTP traffic
Why it fails: Port 123 is the syslog message's source and destination, identifying NTP, not HTTP (port 80/443). HTTP is tempting because analysts habitually associate denied traffic with web browsing, and blocking outbound HTTP would be the correct finding if the log showed tcp/80 or tcp/443.
B
SNMP traffic
Why it fails: Port 123 denotes NTP, whereas SNMP uses udp/161 and udp/162. SNMP is tempting because it is also UDP-based management traffic that firewalls commonly deny, and this log would indicate SNMP if the ports read 161 or 162 rather than 123.
C
NTP traffic
Both source and destination ports are 123, the well-known port for Network Time Protocol. The ASA deny message therefore identifies NTP traffic, not DNS, SNMP or syslog, which use ports 53, 161 and 514 respectively.
D
DNS traffic
Why it fails: DNS uses UDP port 53.

Full breakdown with real-world context →

Question 6easymultiple choice

Full question →

Which principle ensures that a user cannot deny having performed an action?

A
Authentication
Why it fails: Authentication verifies a claimed identity at login; it establishes who someone is but does not by itself prevent them later repudiating an action. It is tempting because identity is a prerequisite for non-repudiation, but authentication would be correct if the question asked how a user's identity is verified.
B
Accountability
Why it fails: Accountability ties actions to an identified subject through logging and audit trails, but it does not itself prevent a user from denying an action; non-repudiation, backed by cryptographic evidence, does. It is tempting because accountability and non-repudiation are closely related, but accountability would be correct if the question asked who is answerable for an action.
C
Authorization
Why it fails: Authorization determines what an authenticated subject is permitted to do; it grants or denies access and records nothing about proving who acted. It is tempting because access control is central to security, but authorization would be the answer if the question asked what limits a user's permitted actions after login.
D
Non-repudiation
Non-repudiation uses cryptographic evidence such as digital signatures and audit logs to prove an action originated from a specific party. It prevents that party from later denying having performed the action, which is precisely the guarantee the question describes.

Full breakdown with real-world context →

Question 7hardmulti select

Full question →

According to the principles of least privilege, which THREE of the following access controls should be implemented for a typical user account? (Choose three.)

A
Administrative rights to the local machine
Why it fails: Granting local administrative rights lets a typical user alter system files, install drivers and disable protections, directly violating least privilege. It is tempting because administrators genuinely need it for troubleshooting and software deployment, but that is a privileged account scenario, not a standard user baseline.
B
Ability to change their own password
Allowing users to change their own password supports least privilege by removing reliance on administrators for routine credential management, limiting administrative exposure. It grants no access beyond the account itself, so it does not widen the user's privileges across systems or data.
C
Ability to install software
Why it fails: Allowing ordinary users to install software permits unvetted executables, licence violations and malware persistence, exceeding their job requirements. It is tempting because IT staff and developers legitimately need installation rights, but for a typical user, software deployment should be handled centrally by administrators.
D
Write access to their own home directory
Write access confined to the user's own home directory grants exactly the storage needed for daily work without permitting modification of system files, other users' data or shared resources. This scoping embodies least privilege by restricting write permissions to a single isolated location.
E
Read access to shared company calendar
Read access to a shared company calendar provides the scheduling visibility typical users need while withholding write permissions that could alter or delete others' entries. Read-only sharing satisfies the business requirement without granting unnecessary modification rights, consistent with least privilege.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full ACL explanation →

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Exhibit

Refer to the exhibit.

Extended ACL 101:
10 permit tcp 192.168.1.0 0.0.0.255 any eq 80
20 permit tcp 192.168.1.0 0.0.0.255 any eq 443
30 deny tcp any any eq 22
40 permit ip any any

Interface GigabitEthernet0/0:
 ip access-group 101 out

A
All outbound traffic is denied except HTTP and HTTPS.
Why it fails: Line 40 permits all traffic, so nothing is denied except SSH.
B
Only HTTP and HTTPS traffic is allowed.
Why it fails: Line 40 permits all other traffic, so more than just HTTP/HTTPS is allowed.
C
HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.
HTTP and HTTPS are permitted because the ACL explicitly matches TCP ports 80 and 443, satisfying the requirement to allow web browsing outbound. SSH is denied since port 22 is absent from the permit statements and the implicit deny any catches it, blocking remote shell access from 192.168.1.0/24 to the internet.
D
SSH traffic is only denied if it originates from the 192.168.1.0/24 network.
Why it fails: Line 30 denies SSH from any source, not just the internal network.

Full breakdown with real-world context →

Question 9mediummultiple choice

Review the full routing breakdown →

A company has implemented a role-based access control (RBAC) policy for its network devices. A network engineer needs temporary access to configure a router in a different region. According to the RBAC policy, what is the appropriate procedure?

A
Have the root password shared via encrypted email to the engineer
Why it fails: Emailing the root password distributes a privileged credential and defeats RBAC's identity-based authorisation and audit trail. It is tempting because it is fast and needs no directory change, and would suit a legacy device lacking centralised authentication — but the policy requires granting the engineer a temporary role, not sharing secrets.
B
Use the shared admin account for the duration of the task
Why it fails: A shared admin account destroys individual accountability and violates RBAC's least-privilege, per-identity model. It is tempting because it grants immediate access without waiting for approval, and would fit a break-glass emergency with no other route in — but routine temporary access requires a time-bound role assignment to the engineer's own account.
C
Ask another engineer with access to perform the configuration changes
Why it fails: Delegating to another engineer bypasses the RBAC policy rather than following it, leaving the requesting engineer without auditable, least-privilege access. It is tempting because it avoids granting standing rights, and would suit an emergency where no elevation mechanism exists — but RBAC expects a formal temporary role assignment instead.
D
Submit a request to the security team for temporary role elevation with a specified time limit
RBAC grants permissions by role, so a cross-region router change exceeds the engineer's assigned role. Requesting time-limited role elevation from the security team preserves least privilege while granting the necessary access, matching the policy's temporary requirement.

Full breakdown with real-world context →

These 200-201 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-201 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Access Control List (ACL) Scenarios

How to approach access control list (acl) scenarios

Quick answer

Related 200-201 topic practice pages

Security Monitoring practice questions

Security Policies and Procedures practice questions

Network Intrusion Analysis practice questions

Host-Based Analysis practice questions

Security Concepts practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Practice scenarios

Which security principle ensures that a user cannot deny having performed an action?

Refer to the exhibit. A security analyst is reviewing the ASA configuration. Which traffic will be permitted from the outside interface?

Exhibit

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

Which principle ensures that a user cannot deny having performed an action?

According to the principles of least privilege, which THREE of the following access controls should be implemented for a typical user account? (Choose three.)

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Exhibit

A company has implemented a role-based access control (RBAC) policy for its network devices. A network engineer needs temporary access to configure a router in a different region. According to the RBAC policy, what is the appropriate procedure?