mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Examine the following configuration snippet: ```…
Examine the following configuration snippet: ```
interface GigabitEthernet0/0 ip access-group BLOCK_TELNET out
!
ip access-list extended BLOCK_TELNET deny tcp any any eq 23 permit ip any any
``` What is the effect of applying this ACL outbound on GigabitEthernet0/0?
⚠ Common exam trap
Cisco often tests the distinction between inbound and outbound ACL application, and the trap here is that candidates mistakenly think an outbound ACL filters traffic entering the interface rather than leaving it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It blocks Telnet traffic leaving the interface, but permits all other IP traffic.
The ACL is applied outbound on GigabitEthernet0/0, meaning it filters traffic as it leaves the interface. The first rule denies TCP traffic destined for port 23 (Telnet), and the second rule permits all other IP traffic. Therefore, Telnet sessions initiated from inside the network and exiting this interface are blocked, while all other traffic is allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It blocks Telnet traffic entering the interface from the network.
Why it's wrong here
Applying the ACL outbound on GigabitEthernet0/0 filters traffic *leaving* the interface, not entering it; the `out` keyword evaluates packets after the routing decision, so Telnet traffic sourced from inside the network toward an external host is denied, whereas the stem asks about blocking Telnet *entering* the interface. This option is tempting because an ACL with `deny tcp any any eq 23` is indeed the correct method to block Telnet, but the misapplication of the `out` direction instead of `in` causes it to fail the stated requirement.
- ✓
It blocks Telnet traffic leaving the interface, but permits all other IP traffic.
Why this is correct
Correct. The outbound ACL denies Telnet and permits all other IP traffic.
- ✗
It permits Telnet traffic and blocks all other IP traffic.
Why it's wrong here
Incorrect. The ACL denies Telnet and permits all other IP traffic.
- ✗
It has no effect because the ACL is missing a sequence number.
Why it's wrong here
Incorrect. Named ACLs do not require sequence numbers; the configuration is valid.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.