How many Access Control List (ACL) Scenarios questions are on this page?

This page has 10 Access Control List (ACL) Scenarios scenario questions for the 200-201 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-201 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 200-201 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

scenario questions

200-201

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Practice scenarios

Question 1hardmultiple choice

Study the full ACL explanation →

Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?

Exhibit

Refer to the exhibit.

```
Router# show ip access-list EXTENDED_FILTER
Extended IP access list EXTENDED_FILTER
    10 permit tcp 10.1.1.0 0.0.0.255 any eq 22
    20 permit tcp 10.1.2.0 0.0.0.255 any eq 22
    30 deny tcp any any eq 22
    40 permit ip any any
```

A
The destination 'any' allows SSH to any external server, which is too permissive
Why wrong: The policy is to allow SSH to external servers, so destination any might be intentional.
B
The ACL permits SSH from unauthorized IP addresses
Why wrong: Lines 10 and 20 permit only the authorized subnets; line 30 denies all other SSH.
C
The ACL sequence is illogical; line 30 should be before lines 10 and 20
Why wrong: ACLs process in sequence; lines 10 and 20 permit first, so line 30 only catches others. This is correct logic.
D
The permit ip any any at the end allows all unexamined traffic, potentially bypassing other security controls
A broad permit all at the end can mask unintended traffic. Better practice is to explicitly deny any traffic not permitted.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?

A
DAC because it is more flexible
Why wrong: Flexibility is not the primary driver; security is.
B
Both can coexist
Why wrong: A single policy is required, coexistence leads to inconsistency.
C
MAC because it is more secure
MAC offers stronger security enforcement, suitable for merged policies.
D
A new hybrid model combining both
Why wrong: Hybrid models are complex and rarely adopted in practice.

Full breakdown with real-world context →

Question 3mediummultiple choice

Review the full routing breakdown →

Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)

Exhibit

Building configuration...
Current configuration : 2345 bytes
!
interface GigabitEthernet0/1
 description Internal Network
 ip address 192.168.1.1 255.255.255.0
 no ip redirects
 no ip proxy-arp
 ip access-group INBOUND in
!
ip access-list extended INBOUND
 permit tcp 10.0.0.0 0.255.255.255 any eq 80
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any

A
HTTP and HTTPS traffic only
The ACL explicitly permits TCP traffic to ports 80 and 443.
B
All TCP traffic
Why wrong: The ACL only permits specific TCP ports, not all TCP.
C
All IP traffic from 10.0.0.0/8
Why wrong: The ACL denies all other IP traffic after the permit statements.
D
Only HTTP traffic
Why wrong: Both HTTP and HTTPS are permitted.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

A firewall log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443 with action 'deny'. What does this indicate?

A
The connection was successfully encrypted.
Why wrong: The log does not indicate encryption status, only that it was blocked.
B
The firewall allowed the connection.
Why wrong: 'Deny' means blocked, not allowed.
C
The external host attempted to access the internal host.
Why wrong: The source is internal (192.168.1.100), so the internal host initiated the connection.
D
The internal host attempted to access a secure web server but was blocked.
Port 443 is HTTPS; the attempt was denied.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A SOC analyst is reviewing firewall logs and sees repeated entries: 'Deny TCP 10.0.0.5:49152 -> 203.0.113.1:22' and 'Deny TCP 10.0.0.5:49153 -> 203.0.113.1:22'. What does this pattern suggest?

A
An SSH brute-force attack from the internal host
The repeated connection attempts to port 22 with varying source ports is characteristic of a brute-force attempt.
B
DNS tunneling
Why wrong: DNS tunneling uses port 53, not 22.
C
A legitimate SSH session
Why wrong: Legitimate SSH connections would not generate multiple denied attempts with different source ports.
D
A port scan from the external host
Why wrong: The source is internal (10.0.0.5), not external.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

You are a security analyst for a medium-sized enterprise. The network includes a DMZ with a web server (10.0.1.10) and a database server (10.0.2.10) in the internal network. Users access the web server via HTTPS from the internet. The web server queries the database server on TCP 3306. Recently, users reported that the web application sometimes returns database errors. You review firewall logs and see the following:

- Allowed inbound HTTPS to 10.0.1.10 from various external IPs. - Denied outbound from 10.0.1.10 to 10.0.2.10 on port 3306. - Allowed outbound from 10.0.1.10 to external IPs on port 443.

You also notice that the web server's outbound traffic to the database server is being blocked. The firewall has a default deny rule. Which action should you take to restore normal operation while maintaining security?

A
Create a rule allowing inbound traffic on TCP 3306 to the database server from any source.
Why wrong: This allows any source to access the database, which is insecure.
B
Move the database server to the DMZ to avoid firewall restrictions.
Why wrong: Moving the DB to DMZ exposes it to internet, increasing attack surface.
C
Create a rule allowing all outbound traffic from the DMZ to the internal network.
Why wrong: This is too permissive and could allow DMZ hosts to access internal resources unnecessarily.
D
Create a rule allowing outbound traffic from the web server IP (10.0.1.10) to the database server IP (10.0.2.10) on TCP 3306.
This specifically allows the needed traffic while minimizing exposure.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

You are a security analyst at a financial services company. The company's security policy mandates that all sensitive data must be encrypted at rest and in transit. A recent internal audit reveals that a database containing customer personally identifiable information (PII) is stored on a server that uses unencrypted storage volumes. The database is accessed by internal applications via unencrypted connections. The policy also requires quarterly vulnerability scans, and the latest scan shows that the server has a critical vulnerability in the database software. Additionally, the server's firewall rules permit inbound traffic from the entire corporate network to the database port. The company's incident response policy requires that any violation of data protection policies be escalated within 24 hours. The IT manager asks you to prioritize actions. What should you do first?

A
Enable encryption on the storage volumes and database connections
Why wrong: This is important but not the most urgent action.
B
Apply the critical security patch to the database software
Patching the critical vulnerability reduces immediate risk of exploitation.
C
Escalate the violation to management within 24 hours
Why wrong: Escalation should happen but after taking immediate action.
D
Restrict firewall access to only authorized application servers
Why wrong: This is a good step but not as urgent as patching.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A large enterprise has a security policy that mandates data classification and strict access controls. An IT administrator, John, has been granted temporary administrative privileges to resolve a server issue. During the maintenance window, John accesses a file server and downloads a spreadsheet containing customer PII (Personally Identifiable Information) classified as 'Confidential'. John then emails the spreadsheet to his personal email account to work from home. The security team receives an alert from the DLP system indicating the email transmission. According to the company's incident response policy, which of the following is the FIRST action the security team should take?

A
Block the email transmission and restore the file from backup
Why wrong: Blocking and restoring are remediation steps that should follow evidence collection to avoid destroying evidence.
B
Revoke John's network access immediately and escalate to HR for disciplinary action
Why wrong: While disciplinary action may be warranted, immediate revocation without preserving evidence could compromise forensic integrity.
C
Interview John to determine his intent and whether it was accidental
Why wrong: Interviewing a suspect before securing evidence can lead to tampering or destruction of digital evidence.
D
Preserve evidence, isolate the affected systems, and initiate the incident response process
This aligns with standard incident response procedures: first preserve evidence, then initiate the formal process.

Full breakdown with real-world context →

Question 9easymultiple choice

Study the full ACL explanation →

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

Exhibit

Refer to the exhibit.

```
interface GigabitEthernet0/0
 ip access-group BLOCK_P2P in
!
ip access-list extended BLOCK_P2P
 deny tcp any any eq 6881 6889
 deny udp any any range 6881 6889
 permit ip any any
```

A
All TCP traffic is blocked
Why wrong: Only TCP on ports 6881-6889 is blocked; other TCP traffic is permitted.
B
Only outgoing BitTorrent traffic is blocked
Why wrong: The ACL is applied inbound, so it affects incoming traffic, not outgoing.
C
Incoming BitTorrent traffic using ports 6881-6889 is blocked
The ACL denies those ports inbound, blocking incoming BitTorrent connections.
D
All BitTorrent traffic is permitted
Why wrong: The ACL specifically denies the ports commonly used by BitTorrent.

Full breakdown with real-world context →

Question 10easymultiple choice

Study the full ACL explanation →

Refer to the exhibit. A security analyst views these log entries from a Cisco router. What conclusion can be drawn about ACL 101?

Exhibit

%SEC-6-IPACCESSLOGS: list 101 denied tcp 192.0.2.5(12345) -> 10.1.1.100(23), 1 packet
%SEC-6-IPACCESSLOGS: list 101 permitted tcp 192.0.2.5(12345) -> 10.1.1.100(80), 1 packet

A
ACL 101 blocks HTTP traffic
Why wrong: HTTP is permitted.
B
ACL 101 applies only to inbound traffic
Why wrong: Direction not indicated in the log.
C
ACL 101 denies Telnet and permits HTTP
Denied to port 23, permitted to port 80.
D
ACL 101 permits all traffic
Why wrong: Denied entries show not all traffic is permitted.

Full breakdown with real-world context →

These 200-201 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-201 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Access Control List (ACL) Scenarios

How to approach access control list (acl) scenarios

Quick answer

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Monitoring practice questions

Network Intrusion Analysis practice questions

Host-Based Analysis practice questions

Security Concepts practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?

Exhibit

During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?

Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)

Exhibit

A firewall log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443 with action 'deny'. What does this indicate?

A SOC analyst is reviewing firewall logs and sees repeated entries: 'Deny TCP 10.0.0.5:49152 -> 203.0.113.1:22' and 'Deny TCP 10.0.0.5:49153 -> 203.0.113.1:22'. What does this pattern suggest?

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

Exhibit

Refer to the exhibit. A security analyst views these log entries from a Cisco router. What conclusion can be drawn about ACL 101?

Exhibit