mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Examine the following partial configuration: ip…
Examine the following partial configuration:
ip access-list extended MGMT_ACCESS permit tcp 10.0.0.0 0.255.255.255 any eq 22 permit tcp 10.0.0.0 0.255.255.255 any eq
443
deny ip any any
!
line vty 0 4
access-class MGMT_ACCESS in transport input ssh login local
What is the effect of the 'access-class' command?
⚠ Common exam trap
Cisco often tests the distinction between `access-class` (applied to VTY lines for management access control) and `access-group` (applied to interfaces for transit traffic), leading candidates to confuse the direction or scope of the ACL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Only SSH and HTTPS connections from the 10.0.0.0/8 network are allowed to the VTY lines.
The `access-class` command applied to VTY lines with the `in` keyword filters inbound Telnet/SSH sessions to the router. The ACL `MGMT_ACCESS` permits TCP ports 22 (SSH) and 443 (HTTPS) from source network 10.0.0.0/8, and denies all other traffic. This restricts management access to only SSH and HTTPS connections originating from the 10.0.0.0/8 network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Only SSH and HTTPS connections from the 10.0.0.0/8 network are allowed to the VTY lines.
Why this is correct
The ACL permits TCP ports 22 and 443 from the specified source, and the access-class filters inbound VTY connections.
- ✗
The ACL filters traffic leaving the VTY lines, allowing SSH and HTTPS from any source.
Why it's wrong here
The 'in' keyword on access-class filters incoming connections to the VTY.
- ✗
All traffic from the 10.0.0.0/8 network is permitted to the router.
Why it's wrong here
Only TCP ports 22 and 443 are permitted; other traffic is denied by the 'deny ip any any'.
- ✗
The configuration is missing 'permit ip any any' to allow other management protocols.
Why it's wrong here
The intent is to restrict access, so the deny is appropriate.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.