hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show ip access-lists
Extended IP access list 160
10 permit tcp any any established (200 matches)
20 permit udp any any (100 matches)
30 deny ip any any (50 matches)Based on this output, what is the problem?
⚠ Common exam trap
Cisco often tests the misconception that an ACL with 'permit tcp any any established' allows all TCP traffic, when in fact it only permits TCP segments with the ACK or RST bit set, blocking initial SYN packets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL blocks all traffic except established TCP and UDP.
The ACL 160 permits only established TCP sessions (using the 'established' keyword, which matches TCP segments with the ACK or RST bit set) and all UDP traffic, while denying everything else. This means non-established TCP traffic (e.g., initial SYN packets) is blocked, so the ACL effectively blocks all traffic except established TCP and UDP, making option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL allows all UDP traffic.
Why it's wrong here
Line 20 permits UDP, but line 30 denies all other IP traffic, so UDP is permitted.
- ✓
The ACL blocks all traffic except established TCP and UDP.
Why this is correct
Line 30 denies all other IP traffic, which may block new TCP connections and other protocols.
- ✗
The ACL permits all TCP traffic.
Why it's wrong here
Only established TCP is permitted; new TCP connections would be denied by line 30.
- ✗
The ACL is correctly configured for a firewall.
Why it's wrong here
Blocking all non-established TCP and non-UDP traffic may be too restrictive.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.