mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show ip access-lists
Extended IP access list 140
10 deny tcp any host 10.1.1.1 eq 23 (15 matches)
20 permit tcp any host 10.1.1.1 eq 22 (20 matches)
30 permit ip any any (5 matches)Based on this output, what is the problem?
⚠ Common exam trap
Cisco often tests the misconception that a 'permit ip any any' at the end of an ACL overrides earlier deny statements, but candidates must remember that ACLs are processed sequentially and the first match wins.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Telnet to 10.1.1.1 is being denied, which may be intentional.
The ACL explicitly denies TCP traffic to host 10.1.1.1 on port 23 (Telnet) with line 10, and the match count of 15 confirms that Telnet attempts are being blocked. While this may be intentional to enforce secure management via SSH (permitted on port 22), the question asks for the problem, and the output shows Telnet is being denied. The ACL does not block SSH (line 20 permits it), so the issue is specifically that Telnet access is denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSH to 10.1.1.1 is being denied.
Why it's wrong here
Line 20 permits SSH with 20 matches.
- ✓
Telnet to 10.1.1.1 is being denied, which may be intentional.
Why this is correct
Line 10 denies Telnet with 15 matches, so Telnet traffic is blocked.
- ✗
All traffic is permitted because of line 30.
Why it's wrong here
Line 30 permits any any, but only after the deny statements; Telnet is still denied.
- ✗
The ACL is not applied to any interface.
Why it's wrong here
The match counts indicate the ACL is active.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.