hardMultiple ChoiceObjective-mapped
300-410 A network uses ACLs to filter traffic Practice Question
A network uses ACLs to filter traffic. Router R1 has the following ACL applied to interface GigabitEthernet0/0 in the inbound direction: access-list 100 permit tcp any any eq 22. Router R2, connected to R1, cannot SSH to R1's loopback address. R1 shows: 'show ip interface GigabitEthernet0/0' indicates the ACL is applied. What is the root cause?
⚠ Common exam trap
Cisco often tests the implicit deny at the end of every ACL and how it can break routing protocols (like EIGRP, OSPF, or BGP) when the ACL does not explicitly permit the protocol's traffic, leading candidates to overlook the impact on control plane traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL permits only SSH, but the implicit deny blocks all other traffic, including EIGRP hellos, causing the neighbor relationship to fail and making the loopback unreachable.
The ACL applied inbound on R1's GigabitEthernet0/0 permits only SSH (TCP port 22) and implicitly denies all other traffic. EIGRP uses multicast IP 224.0.0.10 and protocol number 88, which is not TCP and not permitted by the ACL. Without EIGRP hellos, the neighbor relationship between R1 and R2 fails, making R1's loopback unreachable from R2 because EIGRP cannot install the route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL permits only SSH, but the implicit deny blocks all other traffic, including EIGRP hellos, causing the neighbor relationship to fail and making the loopback unreachable.
Why this is correct
Without explicit permit for routing protocols, the ACL blocks them, causing routing failure.
- ✗
The ACL is applied inbound, so it filters traffic entering R1; SSH traffic from R2 to R1's loopback is outbound from R2, so it is not affected.
Why it's wrong here
The ACL is inbound on R1, so it filters traffic entering R1. SSH traffic from R2 to R1's loopback enters R1 via GigabitEthernet0/0, so it is filtered.
- ✗
R2's SSH client uses a source port that is not TCP 22.
Why it's wrong here
SSH uses destination port 22, not source port.
- ✗
R1's loopback interface has a separate ACL that blocks SSH.
Why it's wrong here
No ACL on loopback is mentioned.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.