hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An ACL implicit deny is blocking management…
An ACL implicit deny is blocking management traffic due to route summarization. Router R1 has:
access-list 100 permit ip 10.0.0.0 0.0.3.255 any
!
interface GigabitEthernet0/0 ip access-group 100 in
!
router eigrp 100 network 10.0.0.0
! R1 also has:
interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip summary-address eigrp 100 10.0.0.0 255.255.252.0
! A management station at 10.0.1.100 cannot SSH to R1's loopback 0 (10.0.0.1). What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The summary route changes the return path for traffic to the management station, and the return interface has an ACL with implicit deny blocking the SSH reply.
The ACL permits traffic from 10.0.0.0/22 (10.0.0.0-10.0.3.255) to any, but the summary route is also 10.0.0.0/22. However, the ACL is applied inbound on GigabitEthernet0/0. The management station's traffic comes from 10.0.1.100, which is within the permitted range, so the ACL should allow it. But the summary route may cause the return traffic to be sent via a different interface, and if that interface has an ACL with implicit deny, the SSH session fails. The root cause is that the summary route changes the path, and the return path has an ACL blocking traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The summary route changes the return path for traffic to the management station, and the return interface has an ACL with implicit deny blocking the SSH reply.
Why this is correct
The summary can cause asymmetric routing, and the return path ACL blocks the traffic.
- ✗
The ACL does not permit SSH traffic (port 22).
Why it's wrong here
The ACL permits all IP traffic from the source range.
- ✗
The summary route is not installed, so traffic is dropped.
Why it's wrong here
The summary is installed.
- ✗
EIGRP is not advertising the loopback route.
Why it's wrong here
The loopback is reachable.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.