mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Given this configuration: ``` interface…
Given this configuration: ```
interface GigabitEthernet0/4 ip access-group BLOCK_FTP in
!
ip access-list extended BLOCK_FTP deny tcp any any eq 21 deny tcp any any eq
20
permit ip any any
``` What is the effect of this ACL when applied inbound on GigabitEthernet0/4?
⚠ Common exam trap
Cisco often tests the distinction between inbound and outbound ACL application, and the trap here is that candidates may confuse the direction (in vs out) and incorrectly think the ACL blocks outbound traffic, or they may overlook that the explicit permit ip any any is required to allow other traffic after the deny statements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It blocks all FTP traffic entering the interface, but permits all other IP traffic.
The ACL is applied inbound on GigabitEthernet0/4, meaning it filters traffic as it enters the interface. The first two deny statements block TCP traffic destined for ports 21 (FTP control) and 20 (FTP data), which are the standard ports for FTP. The final permit ip any any allows all other IP traffic. Thus, only FTP traffic is blocked, and all other IP traffic is permitted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It blocks all FTP traffic entering the interface, but permits all other IP traffic.
Why this is correct
Correct. The ACL denies FTP ports and permits everything else.
- ✗
It blocks all FTP traffic leaving the interface.
Why it's wrong here
Incorrect. The ACL is applied inbound, so it filters traffic entering the interface.
- ✗
It permits FTP traffic and blocks all other IP traffic.
Why it's wrong here
Incorrect. The ACL denies FTP traffic and permits all other IP traffic.
- ✗
It has no effect because the ACL is missing a sequence number.
Why it's wrong here
Incorrect. Named ACLs do not require sequence numbers.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.