easyMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command to troubleshoot an…
A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:
R1# show ip access-lists 101
Extended IP access list 101
10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (12 matches)
20 deny tcp any any eq 443 (5 matches)
30 permit ip any any (100 matches)What does this output indicate?
⚠ Common exam trap
Cisco often tests the misconception that an explicit deny statement (like line 20) blocks all traffic, when in fact it only blocks the specific protocol and port, and subsequent permit entries can still allow other traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is permitting TCP traffic from 192.168.1.0/24 to any destination on port 80, denying all TCP traffic to port 443, and permitting all other IP traffic.
The ACL explicitly permits TCP traffic from source 192.168.1.0/24 to any destination on port 80 (line 10), denies TCP traffic from any source to any destination on port 443 (line 20), and then permits all other IP traffic (line 30). The match counts confirm that traffic matching each line has been processed, and the implicit deny at the end is never reached because line 30 permits everything else.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL is permitting TCP traffic from 192.168.1.0/24 to any destination on port 80, denying all TCP traffic to port 443, and permitting all other IP traffic.
Why this is correct
The ACL lines and match counts confirm this behavior.
- ✗
The ACL is denying all traffic because line 20 is an explicit deny.
Why it's wrong here
Line 30 permits all IP traffic, so not all traffic is denied.
- ✗
The ACL is applied inbound on an interface and is blocking all traffic to port 443.
Why it's wrong here
The ACL permits all other traffic, including to port 443 from 192.168.1.0/24? No, line 20 denies all TCP to port 443, but line 30 permits all IP, so TCP to 443 is denied.
- ✗
The ACL has no effect because the match counts are too low.
Why it's wrong here
Match counts are valid and show the ACL is being used.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.