Knowledge + Practice

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

Access Control List (ACL) Scenarios

Practise 300-410 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.

Start full practice test Read exam guide

15

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach access control list (acl) scenarios

ACL questions test your ability to read, write, and place access lists correctly. They appear as configuration tasks, troubleshooting scenarios, and exhibit-based questions showing ACL output. The CCNA covers standard and extended ACLs for both IPv4 and IPv6.

Quick answer

ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.

Standard versus extended ACL behaviour.

Top-down processing and the implicit deny rule.

Source, destination, protocol and port matching.

Inbound versus outbound ACL placement.

Related practice questions

Related 300-410 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Layer 3 Technologies practice questions

Practise 300-410 questions linked to Layer 3 Technologies.

VPN Technologies practice questions

Work through 300-410 questions on VPN Technologies.

Infrastructure Security practice questions

Work through 300-410 questions on Infrastructure Security.

Infrastructure Services practice questions

Infrastructure Services practice questions for 300-410.

300-410 fundamentals practice questions

Targeted 300-410 practice covering 300-410 fundamentals.

300-410 scenario practice questions

Work through 300-410 questions on 300-410 scenario.

300-410 troubleshooting practice questions

Practise 300-410 questions linked to 300-410 troubleshooting.

Practice set

Practice scenarios

Question 1hardmultiple choice

Study the full ACL explanation →

When using the 'access-group' command to apply an ACL to an interface, what is the default direction if none is specified?

A
Inbound
Why wrong: No default direction; the keyword is mandatory.
B
Outbound
Why wrong: No default direction; the keyword is mandatory.
C
The command defaults to inbound.
Why wrong: Cisco IOS requires explicit direction.
D
The command is rejected without a direction keyword.
The access-group command syntax requires either 'in' or 'out'.

Full breakdown with real-world context →

Question 2hardmultiple choice

Study the full ACL explanation →

An engineer configures an IPsec VPN between two routers using a transform-set with ESP encryption (AES 256) and ESP authentication (SHA-256). The engineer also applies an IPv4 ACL to define interesting traffic that matches all IP traffic. After configuration, the VPN tunnel comes up, but only ICMP traffic is encrypted; other traffic like HTTP is sent in clear text. What is the most likely explanation?

A
The ACL for interesting traffic only permits ICMP, so only ICMP is encrypted.
IPsec uses the ACL to determine which traffic to protect; if only ICMP is permitted, other traffic is not encrypted.
B
The transform-set does not support HTTP traffic due to port filtering.
Why wrong: Transform-set defines encryption and authentication algorithms, not traffic selection.
C
The IPsec SA is only established for ICMP; other traffic requires a separate SA.
Why wrong: The SA is triggered by the ACL; if the ACL is narrow, only matched traffic creates SAs.
D
The router has a NAT rule that bypasses IPsec for HTTP traffic.
Why wrong: NAT can interfere, but the question does not mention NAT.

Full breakdown with real-world context →

Question 3hardmultiple choice

Study the full ACL explanation →

On a DMVPN Phase 2 hub-and-spoke network, an engineer applies an inbound IPv4 ACL on the tunnel interface of a spoke router to permit only traffic from specific spoke IPs. After the ACL is applied, the spoke cannot establish a direct spoke-to-spoke tunnel with another spoke, even though NHRP resolution succeeds. What is the most likely explanation?

A
The ACL is filtering the outer IP header of the mGRE tunnel, blocking spoke-to-spoke traffic.
The ACL on the tunnel interface filters the encapsulated packets; if it only permits the hub's IP, traffic from other spokes is denied.
B
The ACL is filtering NHRP packets, preventing spoke-to-spoke resolution.
Why wrong: NHRP resolution succeeds, so NHRP packets are not blocked.
C
The spoke has a misconfigured NHRP authentication key.
Why wrong: Authentication mismatch would prevent NHRP registration, but resolution succeeds.
D
The ACL is applied outbound, filtering outgoing traffic.
Why wrong: Outbound ACL would affect traffic leaving the spoke, not incoming spoke-to-spoke traffic.

Full breakdown with real-world context →

Question 4hardmultiple choice

Review the full OSPF breakdown →

An engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes for the same prefix. The engineer also applies an inbound ACL on the OSPF interface to deny certain routes from being learned via OSPF. After the ACL is applied, the router still has the prefix in the routing table, but it is learned via EIGRP instead of OSPF. What is the most likely explanation?

A
The ACL blocks OSPF updates, so the router learns the prefix via EIGRP with a lower AD.
The ACL prevents OSPF from learning the route, but redistribution allows EIGRP to carry it, and EIGRP's lower AD makes it the best path.
B
The ACL is applied outbound, so it filters OSPF routes being sent to the neighbor.
Why wrong: Outbound ACL would affect outgoing updates, not incoming learning.
C
The router has a static route for the prefix with AD 1.
Why wrong: Static route would override both, but the question does not mention static.
D
The OSPF process has a distribute-list that is filtering the route.
Why wrong: Distribute-list would filter the route from the routing table, but the ACL is the configured filter.

Full breakdown with real-world context →

Question 5mediummultiple choice

Study the full EIGRP explanation →

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

A
The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.
B
The EIGRP router ID is not configured.
Why wrong: Incorrect because the neighbor relationship is established, indicating the router ID is valid.
C
The ACL is applied outbound, blocking the EIGRP updates from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.
D
The EIGRP for IPv6 is not enabled on the interface.
Why wrong: Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Full breakdown with real-world context →

Question 6mediummultiple choice

Study the full IPv6 explanation →

Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?

A
deny ipv6 any 2001:db8:1::/48
This correctly denies all IPv6 traffic from any source to the specified destination prefix.
B
deny ipv6 2001:db8:1::/48 any
Why wrong: This denies traffic from the specified source to any destination, which is the opposite of what is asked.
C
deny ipv6 any host 2001:db8:1::1
Why wrong: This denies traffic to a single host, not the /48 prefix.
D
deny ipv6 2001:db8:1::/48 2001:db8:1::/48
Why wrong: This denies traffic from the prefix to itself, which is not the intended behavior.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full VPN explanation →

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1

protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #send errors 0, #recv errors 0

Based on this output, what is the problem?

A
The IPsec SA is not established; phase 1 is still pending.
Why wrong: The SA is present with a current peer; phase 1 and 2 are complete.
B
The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.
Zero packet counts indicate no traffic has been encapsulated; check the crypto ACL and routing.
C
The remote peer is unreachable; the SA is in a dead state.
Why wrong: The SA is still present; if the peer were unreachable, the SA would be deleted or show errors.
D
The tunnel interface is down; the SA cannot be used.
Why wrong: The output does not show interface state; SA presence suggests tunnel is up.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER

IPv6 access list FILTER

permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence

20

permit ipv6 any any sequence 30

What does this output indicate?

A
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.
Correct. Sequence 10 permits the first prefix, sequence 20 denies the second, and sequence 30 permits everything else.
B
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.
Why wrong: Incorrect. There is an explicit permit any any at sequence 30, so other traffic is permitted.
C
The access list will deny all traffic because of the deny statement.
Why wrong: Incorrect. The deny only applies to the specified prefix; other traffic is permitted by sequence 30.
D
The access list is invalid because IPv6 access lists require implicit deny at the end.
Why wrong: Incorrect. IPv6 access lists do have an implicit deny, but the explicit permit any any overrides it.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full NAT/PAT explanation →

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

!

interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside

!

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

A
All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.
The 'overload' keyword enables PAT, and the ACL matches the inside network.
B
Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.
Why wrong: The ACL permits the entire /24 subnet, not just the router's interface IP.
C
Traffic is translated using static NAT to 203.0.113.1.
Why wrong: The command uses 'ip nat inside source list' which is dynamic NAT, not static.
D
The configuration is incomplete; a NAT pool is required for dynamic translation.
Why wrong: When using an interface with overload, no pool is needed; the interface IP is used.

Full breakdown with real-world context →

Question 10mediummultiple choice

Review the full routing breakdown →

Router R1 has the following configuration:

```

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip policy route-map PBR-OUT

! route-map PBR-OUT permit 10 match ip address 100 set ip next-hop 192.168.1.1 !

access-list 100 permit ip host 10.1.1.100 any

``` What is the effect of this configuration?

A
Packets received on GigabitEthernet0/1 from source 10.1.1.100 are forwarded to next-hop 192.168.1.1.
The route-map is applied inbound, so packets arriving on this interface from 10.1.1.100 are policy-routed to 192.168.1.1.
B
Packets transmitted out of GigabitEthernet0/1 to destination 10.1.1.100 are forwarded to next-hop 192.168.1.1.
Why wrong: PBR is applied to incoming packets, not outgoing. The direction is inbound on the interface.
C
All packets from 10.1.1.100 are dropped because the route-map does not have a permit statement.
Why wrong: The route-map has a permit statement, so matching packets are allowed and policy-routed.
D
The configuration is invalid because the ACL must match destination, not source.
Why wrong: ACLs can match source or destination; matching source is valid for PBR.

Full breakdown with real-world context →

Question 11mediummultiple choice

Study the full ACL explanation →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

A
The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.
Correct because if the ACL referenced in the route map does not exist, the route map will not match any traffic, and PBR will not be applied.
B
The 'set ip next-hop' command is misspelled as 'set ip nexthop'.
Why wrong: Incorrect because a misspelled command would cause a configuration error that the router would reject; the configuration would not be applied.
C
The router is running an older IOS version that does not support PBR.
Why wrong: Incorrect because PBR is supported in most IOS versions; the engineer would know if the router does not support it.
D
The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.
Why wrong: Incorrect because the scenario states the command is applied to interface GigabitEthernet0/0, which is the incoming interface.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full DNS explanation →

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 120

10 permit tcp 10.0.0.0 0.255.255.255 any eq www (1000 matches)
    
20 permit udp any any eq dns (500 matches)
    
30 deny ip any any (200 matches)

Based on this output, what is the problem?

A
The ACL is correctly permitting web and DNS traffic.
Why wrong: While it permits those, the deny all statement may block other needed traffic.
B
The ACL is blocking all traffic except web and DNS, which may be too restrictive.
The deny ip any any with matches shows that other traffic is being denied, which could be a problem.
C
The ACL has no effect because it is not applied.
Why wrong: The match counts indicate the ACL is applied and active.
D
The ACL allows all traffic because of the permit statements.
Why wrong: The deny ip any any overrides and denies all other traffic.

Full breakdown with real-world context →

Question 13easymultiple choice

Study the full ACL explanation →

Which statement is true about the implicit deny any at the end of an IPv4 ACL?

A
It can be overridden by adding a permit any at the end.
Why wrong: A permit any entry will match before the implicit deny, effectively overriding it.
B
It is invisible and applies only to TCP traffic.
Why wrong: The implicit deny applies to all IP traffic for extended ACLs.
C
It is always present and cannot be removed or overridden.
Why wrong: It can be overridden by a permit any entry placed before it.
D
It denies all traffic not explicitly permitted and is always present.
The implicit deny any is a fundamental property of Cisco ACLs.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full NAT/PAT explanation →

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

A
Inside hosts are translated to addresses in the pool using PAT.
Why wrong: No 'overload' keyword means no port multiplexing; it's one-to-one dynamic NAT.
B
Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.
Without overload, each translation consumes one pool address; exhaustion blocks new flows.
C
The router uses the pool address as the source for all outbound traffic, regardless of ACL.
Why wrong: The ACL restricts which inside addresses are eligible for translation.
D
This configuration requires the 'ip nat outside' interface command to function.
Why wrong: While 'ip nat outside' is needed on the outside interface, the question asks about the effect of the given commands alone; the effect is dynamic NAT without overload.

Full breakdown with real-world context →

Question 15mediummultiple choice

Review the full OSPF breakdown →

A network engineer runs the following command to troubleshoot a Route Summarization issue:

R1# show ip access-lists CoPP-ACL

extended IP access list CoPP-ACL

10 permit eigrp any any (100 matches)
    
20 permit ospf any any (50 matches)
    
30 permit bgp any any (200 matches)
    
40 deny ip any any (0 matches)

What does this output indicate?

A
CoPP is permitting routing protocol traffic, including EIGRP, OSPF, and BGP, which are used for route summarization. No drops indicate CoPP is not blocking summarization.
The permit statements with matches show that routing protocol traffic is allowed, and no drops mean CoPP is not interfering.
B
CoPP is dropping all routing protocol traffic, preventing route summarization.
Why wrong: The deny statement has 0 matches, so no traffic is being dropped.
C
CoPP is only allowing BGP traffic, blocking EIGRP and OSPF summarization.
Why wrong: All three protocols have matches, indicating they are permitted.
D
CoPP is not configured because the access list is empty.
Why wrong: The access list has entries with matches.

Full breakdown with real-world context →

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.