mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Consider the following partial configuration: ip…
Consider the following partial configuration:
ip access-list extended SECURE_ACCESS permit icmp any any echo permit icmp any any echo-reply permit tcp any host 192.168.1.1 eq 22 permit tcp any host 192.168.1.1 eq
443
deny ip any any
!
interface GigabitEthernet0/0 ip access-group SECURE_ACCESS in
!
interface GigabitEthernet0/1 ip access-group SECURE_ACCESS out
What is a potential issue with this ACL placement?
⚠ Common exam trap
Cisco often tests the concept that applying an ACL in both directions (inbound on one interface and outbound on another) can cause unintended filtering of traffic that must pass through the router, leading candidates to overlook the fact that the ACL is evaluated twice and that the permit entries may not cover all necessary flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL may block traffic that needs to pass between the two interfaces because it is applied in both directions.
The ACL SECURE_ACCESS is applied inbound on GigabitEthernet0/0 and outbound on GigabitEthernet0/1. This means traffic entering G0/0 is filtered by the ACL, and traffic exiting G0/1 is also filtered by the same ACL. Since the ACL denies all IP traffic by default (via the 'deny ip any any' at the end), any packet that must traverse from G0/0 to G0/1 will be checked twice: once inbound on G0/0 and again outbound on G0/1. If the packet matches a permit statement on the inbound check, it may still be denied on the outbound check if the source/destination or protocol does not match the permit entries from the perspective of the outbound interface. In this configuration, the ACL permits only ICMP echo/echo-reply and TCP to 192.168.1.1 on ports 22 and 443; all other traffic is denied. Therefore, legitimate traffic between the two interfaces that does not match these specific permits will be blocked, potentially disrupting connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL may block traffic that needs to pass between the two interfaces because it is applied in both directions.
Why this is correct
Traffic from Gi0/0 to Gi0/1 is filtered inbound on Gi0/0 and outbound on Gi0/1, potentially blocking non-matching traffic.
- ✗
The ACL is missing a 'permit ip any any' statement, so all traffic is denied.
Why it's wrong here
The explicit deny at the end denies all traffic not permitted, which is intentional for security.
- ✗
The ACL should be applied only inbound on both interfaces.
Why it's wrong here
Applying outbound is valid, but the combination may cause issues.
- ✗
The ACL permits ICMP echo and echo-reply, which could allow ping floods.
Why it's wrong here
While possible, this is not the primary issue with placement.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.