IPv4 Access Control Lists practice questions

A network engineer runs the following command on Router R1:

R1# show access-lists

Extended IP access list 101

10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (10 matches)
    
20 deny tcp any host 10.1.1.1 eq 22 (5 matches)
    
30 permit icmp any any (2 matches)
    
40 deny ip any any (1 match)

Based on this output, which statement is correct?

Trap 1: All traffic is permitted because line 40 has only 1 match.

Line 40 is a deny statement; its matches indicate traffic being denied, not permitted.

Trap 2: The ACL has no effect because it is not applied to an interface.

The output does not indicate whether the ACL is applied; it only shows the ACL contents and match counts.

A
Traffic matching line 10 is permitted and counted correctly.
Line 10 has 10 matches and is a permit statement, so traffic matching it is permitted.
B
All traffic is permitted because line 40 has only 1 match.
Why wrong: Line 40 is a deny statement; its matches indicate traffic being denied, not permitted.
C
Line 20 denies SSH traffic to host 10.1.1.1, and 5 packets matched.
Line 20 denies TCP port 22 (SSH) to host 10.1.1.1, with 5 matches.
D
The ACL has no effect because it is not applied to an interface.
Why wrong: The output does not indicate whether the ACL is applied; it only shows the ACL contents and match counts.

Question 2easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1

GigabitEthernet0/1 is up, line protocol is up Internet address is 10.1.1.1/24 Broadcast address is 255.255.255.255 Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is 101 Inbound access list is not set

Based on this output, which statement is correct?

Trap 1: ACL 101 filters traffic entering the interface.

The inbound access list is not set, so no ACL filters incoming traffic.

Trap 2: The interface has no ACL applied.

There is an outbound ACL applied.

Trap 3: ACL 101 is applied in both directions.

Only outbound ACL is set; inbound is not set.

A
ACL 101 filters traffic entering the interface.
Why wrong: The inbound access list is not set, so no ACL filters incoming traffic.
B
ACL 101 filters traffic leaving the interface.
The output shows 'Outgoing access list is 101', so traffic exiting is filtered.
C
The interface has no ACL applied.
Why wrong: There is an outbound ACL applied.
D
ACL 101 is applied in both directions.
Why wrong: Only outbound ACL is set; inbound is not set.

Question 3mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 120

10 permit tcp 10.0.0.0 0.255.255.255 any eq www (1000 matches)
    
20 permit udp any any eq dns (500 matches)
    
30 deny ip any any (200 matches)

Based on this output, what is the problem?

Trap 1: The ACL is correctly permitting web and DNS traffic.

While it permits those, the deny all statement may block other needed traffic.

Trap 2: The ACL has no effect because it is not applied.

The match counts indicate the ACL is applied and active.

Trap 3: The ACL allows all traffic because of the permit statements.

The deny ip any any overrides and denies all other traffic.

A
The ACL is correctly permitting web and DNS traffic.
Why wrong: While it permits those, the deny all statement may block other needed traffic.
B
The ACL is blocking all traffic except web and DNS, which may be too restrictive.
The deny ip any any with matches shows that other traffic is being denied, which could be a problem.
C
The ACL has no effect because it is not applied.
Why wrong: The match counts indicate the ACL is applied and active.
D
The ACL allows all traffic because of the permit statements.
Why wrong: The deny ip any any overrides and denies all other traffic.

Question 4easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 130

10 deny ip 192.168.1.0 0.0.0.255 any (0 matches)
    
20 permit ip any any (1000 matches)

Based on this output, which statement is correct?

Trap 1: Traffic from 192.168.1.0/24 is being denied.

Line 10 has 0 matches, so no traffic from that subnet has been denied yet.

Trap 2: The ACL is blocking all traffic.

Line 20 permits all traffic, and line 10 has no matches.

Trap 3: The ACL is misconfigured because line 10 is not needed.

The ACL may be intentional; 0 matches does not indicate misconfiguration.

A
Traffic from 192.168.1.0/24 is being denied.
Why wrong: Line 10 has 0 matches, so no traffic from that subnet has been denied yet.
B
Traffic from 192.168.1.0/24 is being permitted.
Since line 10 has no matches, traffic from that subnet is matched by line 20 (permit any any) and permitted.
C
The ACL is blocking all traffic.
Why wrong: Line 20 permits all traffic, and line 10 has no matches.
D
The ACL is misconfigured because line 10 is not needed.
Why wrong: The ACL may be intentional; 0 matches does not indicate misconfiguration.

Question 5mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 140

10 deny tcp any host 10.1.1.1 eq 23 (15 matches)
    
20 permit tcp any host 10.1.1.1 eq 22 (20 matches)
    
30 permit ip any any (5 matches)

Based on this output, what is the problem?

Trap 1: SSH to 10.1.1.1 is being denied.

Line 20 permits SSH with 20 matches.

Trap 2: All traffic is permitted because of line 30.

Line 30 permits any any, but only after the deny statements; Telnet is still denied.

Trap 3: The ACL is not applied to any interface.

The match counts indicate the ACL is active.

A
SSH to 10.1.1.1 is being denied.
Why wrong: Line 20 permits SSH with 20 matches.
B
Telnet to 10.1.1.1 is being denied, which may be intentional.
Line 10 denies Telnet with 15 matches, so Telnet traffic is blocked.
C
All traffic is permitted because of line 30.
Why wrong: Line 30 permits any any, but only after the deny statements; Telnet is still denied.
D
The ACL is not applied to any interface.
Why wrong: The match counts indicate the ACL is active.

Question 6easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 150

10 permit ip 10.0.0.0 0.255.255.255 any (500 matches)
    
20 deny ip any any (100 matches)

Based on this output, which statement is correct?

Trap 1: Traffic from 10.0.0.0/8 is denied.

Line 10 permits it with 500 matches.

Trap 2: All traffic is permitted.

Line 20 denies traffic not matching line 10.

Trap 3: The ACL has no effect.

Match counts show it is active.

A
Traffic from 10.0.0.0/8 is denied.
Why wrong: Line 10 permits it with 500 matches.
B
Traffic not from 10.0.0.0/8 is denied.
Line 20 denies all other traffic with 100 matches.
C
All traffic is permitted.
Why wrong: Line 20 denies traffic not matching line 10.
D
The ACL has no effect.
Why wrong: Match counts show it is active.

Question 7hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 160

10 permit tcp any any established (200 matches)
    
20 permit udp any any (100 matches)
    
30 deny ip any any (50 matches)

Based on this output, what is the problem?

Trap 1: The ACL allows all UDP traffic.

Line 20 permits UDP, but line 30 denies all other IP traffic, so UDP is permitted.

Trap 2: The ACL permits all TCP traffic.

Only established TCP is permitted; new TCP connections would be denied by line 30.

Trap 3: The ACL is correctly configured for a firewall.

Blocking all non-established TCP and non-UDP traffic may be too restrictive.

A
The ACL allows all UDP traffic.
Why wrong: Line 20 permits UDP, but line 30 denies all other IP traffic, so UDP is permitted.
B
The ACL blocks all traffic except established TCP and UDP.
Line 30 denies all other IP traffic, which may block new TCP connections and other protocols.
C
The ACL permits all TCP traffic.
Why wrong: Only established TCP is permitted; new TCP connections would be denied by line 30.
D
The ACL is correctly configured for a firewall.
Why wrong: Blocking all non-established TCP and non-UDP traffic may be too restrictive.

Question 8mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 170

10 permit icmp any any echo (100 matches)
    
20 permit icmp any any echo-reply (80 matches)
    
30 deny ip any any (10 matches)

Based on this output, which statement is correct?

Trap 1: All ICMP traffic is permitted.

Only echo and echo-reply are permitted; other ICMP types are denied.

Trap 2: The ACL permits all IP traffic.

Line 30 denies all other IP traffic.

Trap 3: The ACL is not applied.

Match counts indicate it is applied.

A
All ICMP traffic is permitted.
Why wrong: Only echo and echo-reply are permitted; other ICMP types are denied.
B
Only ICMP echo and echo-reply are permitted; all other IP traffic is denied.
Line 30 denies all other IP traffic, including other ICMP types.
C
The ACL permits all IP traffic.
Why wrong: Line 30 denies all other IP traffic.
D
The ACL is not applied.
Why wrong: Match counts indicate it is applied.

Question 9mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 180

10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (50 matches)
    
20 permit tcp 192.168.2.0 0.0.0.255 any eq 443 (30 matches)
    
30 deny ip any any (5 matches)

Based on this output, what is the problem?

Trap 1: Traffic from 192.168.2.0/24 to port 443 is denied.

Line 20 permits that traffic with 30 matches.

Trap 2: All traffic from 192.168.1.0/24 is permitted.

Only HTTP is permitted; other traffic from that subnet is denied by line 30.

Trap 3: The ACL is correctly configured to allow only specific web traffic.

While it allows specific web traffic, it denies all other traffic, which may be a problem if other services are needed.

A
Traffic from 192.168.1.0/24 to port 80 is permitted.
Line 10 permits that traffic with 50 matches.
B
Traffic from 192.168.2.0/24 to port 443 is denied.
Why wrong: Line 20 permits that traffic with 30 matches.
C
All traffic from 192.168.1.0/24 is permitted.
Why wrong: Only HTTP is permitted; other traffic from that subnet is denied by line 30.
D
The ACL is correctly configured to allow only specific web traffic.
Why wrong: While it allows specific web traffic, it denies all other traffic, which may be a problem if other services are needed.

Question 10mediummultiple choice

Consider the following partial configuration on router R1: ```

interface GigabitEthernet0/1
 ip access-group MY_ACL in

ip access-list extended MY_ACL
 permit tcp 10.1.1.0 0.0.0.255 any eq 80
 permit icmp any any echo
 deny   ip any any

``` What is the effect of this ACL when applied inbound on GigabitEthernet0/1?

Trap 1: It permits HTTP requests from 10.1.1.0/24 and all ICMP traffic; all…

Incorrect. Only ICMP Echo requests are permitted, not all ICMP types.

Trap 2: It permits HTTP requests from any source to 10.1.1.0/24 and ICMP…

Incorrect. The source is 10.1.1.0/24, not the destination.

Trap 3: It permits HTTP requests from 10.1.1.0/24 and ICMP Echo replies;…

Incorrect. The ACL permits ICMP Echo requests, not replies.

A
It permits HTTP requests from 10.1.1.0/24 and ICMP Echo requests from any source; all other IP traffic is denied.
Correct. The ACL permits the specified traffic and denies all other IP traffic.
B
It permits HTTP requests from 10.1.1.0/24 and all ICMP traffic; all other IP traffic is denied.
Why wrong: Incorrect. Only ICMP Echo requests are permitted, not all ICMP types.
C
It permits HTTP requests from any source to 10.1.1.0/24 and ICMP Echo requests; all other traffic is denied.
Why wrong: Incorrect. The source is 10.1.1.0/24, not the destination.
D
It permits HTTP requests from 10.1.1.0/24 and ICMP Echo replies; all other IP traffic is denied.
Why wrong: Incorrect. The ACL permits ICMP Echo requests, not replies.

Question 11mediummultiple choice

Examine the following configuration snippet: ```

interface GigabitEthernet0/0
 ip access-group BLOCK_TELNET out

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any

``` What is the effect of applying this ACL outbound on GigabitEthernet0/0?

Trap 1: It blocks Telnet traffic entering the interface from the network.

Incorrect. The ACL is applied outbound, so it filters traffic leaving the interface, not entering.

Trap 2: It permits Telnet traffic and blocks all other IP traffic.

Incorrect. The ACL denies Telnet and permits all other IP traffic.

Trap 3: It has no effect because the ACL is missing a sequence number.

Incorrect. Named ACLs do not require sequence numbers; the configuration is valid.

A
It blocks Telnet traffic entering the interface from the network.
Why wrong: Incorrect. The ACL is applied outbound, so it filters traffic leaving the interface, not entering.
B
It blocks Telnet traffic leaving the interface, but permits all other IP traffic.
Correct. The outbound ACL denies Telnet and permits all other IP traffic.
C
It permits Telnet traffic and blocks all other IP traffic.
Why wrong: Incorrect. The ACL denies Telnet and permits all other IP traffic.
D
It has no effect because the ACL is missing a sequence number.
Why wrong: Incorrect. Named ACLs do not require sequence numbers; the configuration is valid.

Question 12mediummultiple choice

Given the following configuration: ```

interface GigabitEthernet0/2
 ip access-group FILTER_SSH in

ip access-list extended FILTER_SSH
 permit tcp any host 192.168.1.10 eq 22
 permit udp any host 192.168.1.10 eq 22

``` What is the issue with this ACL?

Trap 1: The ACL is missing a deny statement at the end to block other…

Incorrect. There is an implicit deny at the end of all ACLs; it is not required to be explicit.

Trap 2: The ACL should use the 'established' keyword to allow return…

Incorrect. The 'established' keyword is used for TCP sessions, but the ACL permits inbound SSH to a specific host, which is correct for inbound connections.

Trap 3: The ACL should be applied outbound instead of inbound.

Incorrect. The direction depends on the desired filtering; inbound is appropriate for filtering traffic coming into the interface.

A
The ACL permits UDP port 22, which is not used by SSH; this could allow unwanted UDP traffic.
Correct. SSH uses TCP, so the UDP permit is unnecessary and potentially risky.
B
The ACL is missing a deny statement at the end to block other traffic.
Why wrong: Incorrect. There is an implicit deny at the end of all ACLs; it is not required to be explicit.
C
The ACL should use the 'established' keyword to allow return traffic.
Why wrong: Incorrect. The 'established' keyword is used for TCP sessions, but the ACL permits inbound SSH to a specific host, which is correct for inbound connections.
D
The ACL should be applied outbound instead of inbound.
Why wrong: Incorrect. The direction depends on the desired filtering; inbound is appropriate for filtering traffic coming into the interface.

Question 13mediummultiple choice

Consider this configuration on router R2: ```

interface GigabitEthernet0/0
 ip access-group RESTRICT_ACCESS in

ip access-list extended RESTRICT_ACCESS
 permit ip 10.0.0.0 0.255.255.255 any
 deny   ip any any

``` What traffic will be permitted inbound on GigabitEthernet0/0?

Trap 1: Only traffic from source 10.0.0.0/24.

Incorrect. The wildcard mask 0.255.255.255 matches all addresses starting with 10, not just 10.0.0.0/24.

Trap 2: All traffic from any source.

Incorrect. The explicit deny statement blocks all traffic not matching the permit.

Trap 3: Only traffic from source 10.0.0.0/16.

Incorrect. The wildcard mask 0.255.255.255 matches /8, not /16.

A
Only traffic from source 10.0.0.0/24.
Why wrong: Incorrect. The wildcard mask 0.255.255.255 matches all addresses starting with 10, not just 10.0.0.0/24.
B
All traffic from the 10.0.0.0/8 network.
Correct. The wildcard mask 0.255.255.255 matches the 10.0.0.0/8 range.
C
All traffic from any source.
Why wrong: Incorrect. The explicit deny statement blocks all traffic not matching the permit.
D
Only traffic from source 10.0.0.0/16.
Why wrong: Incorrect. The wildcard mask 0.255.255.255 matches /8, not /16.

Question 14mediummultiple choice

Examine the following configuration: ```

interface GigabitEthernet0/3
 ip access-group WEB_ONLY out

ip access-list extended WEB_ONLY
 permit tcp any any eq 80
 permit tcp any any eq 443

``` What is the effect of this ACL when applied outbound on GigabitEthernet0/3?

Trap 1: It permits all web traffic entering the interface.

Incorrect. The ACL is applied outbound, so it filters traffic leaving the interface.

Trap 2: It permits all TCP traffic to any destination.

Incorrect. Only TCP traffic to ports 80 and 443 is permitted.

Trap 3: It has no effect because the ACL is missing a deny statement.

Incorrect. There is an implicit deny at the end of every ACL.

A
It permits all web traffic entering the interface.
Why wrong: Incorrect. The ACL is applied outbound, so it filters traffic leaving the interface.
B
It permits only HTTP and HTTPS traffic to leave the interface; all other traffic is denied.
Correct. The ACL permits web traffic and implicitly denies everything else.
C
It permits all TCP traffic to any destination.
Why wrong: Incorrect. Only TCP traffic to ports 80 and 443 is permitted.
D
It has no effect because the ACL is missing a deny statement.
Why wrong: Incorrect. There is an implicit deny at the end of every ACL.

Question 15mediummultiple choice

Given this configuration: ```

interface GigabitEthernet0/4
 ip access-group BLOCK_FTP in

ip access-list extended BLOCK_FTP
 deny tcp any any eq 21
 deny tcp any any eq

permit ip any any

``` What is the effect of this ACL when applied inbound on GigabitEthernet0/4?

Trap 1: It blocks all FTP traffic leaving the interface.

Incorrect. The ACL is applied inbound, so it filters traffic entering the interface.

Trap 2: It permits FTP traffic and blocks all other IP traffic.

Incorrect. The ACL denies FTP traffic and permits all other IP traffic.

Trap 3: It has no effect because the ACL is missing a sequence number.

Incorrect. Named ACLs do not require sequence numbers.

A
It blocks all FTP traffic entering the interface, but permits all other IP traffic.
Correct. The ACL denies FTP ports and permits everything else.
B
It blocks all FTP traffic leaving the interface.
Why wrong: Incorrect. The ACL is applied inbound, so it filters traffic entering the interface.
C
It permits FTP traffic and blocks all other IP traffic.
Why wrong: Incorrect. The ACL denies FTP traffic and permits all other IP traffic.
D
It has no effect because the ACL is missing a sequence number.
Why wrong: Incorrect. Named ACLs do not require sequence numbers.

Question 16easymultiple choice

What is the default behavior of an IPv4 access control list (ACL) when no explicit permit or deny statement matches a packet?

Trap 1: The packet is permitted.

Incorrect. The default is to deny traffic that does not match any entry.

Trap 2: The packet is logged and then permitted.

Incorrect. Logging is only done if the 'log' keyword is used, and the default action is deny.

Trap 3: The ACL is ignored and the packet is forwarded.

Incorrect. The ACL is always applied; unmatched packets are denied.

A
The packet is permitted.
Why wrong: Incorrect. The default is to deny traffic that does not match any entry.
B
The packet is denied.
Correct. All ACLs have an implicit deny any at the end.
C
The packet is logged and then permitted.
Why wrong: Incorrect. Logging is only done if the 'log' keyword is used, and the default action is deny.
D
The ACL is ignored and the packet is forwarded.
Why wrong: Incorrect. The ACL is always applied; unmatched packets are denied.

Question 17easymultiple choice

In a standard IPv4 ACL, what is the range of valid numbers for the access-list number?

Trap 1: 100-199 and 2000-2699

Incorrect. These are the extended ACL number ranges.

Trap 2: 1-99 only

Incorrect. The expanded range 1300-1999 is also valid for standard ACLs.

Trap 3: 1-199

Incorrect. Numbers 100-199 are for extended ACLs.

A
1-99 and 1300-1999
Correct. These are the standard ACL number ranges.
B
100-199 and 2000-2699
Why wrong: Incorrect. These are the extended ACL number ranges.
C
1-99 only
Why wrong: Incorrect. The expanded range 1300-1999 is also valid for standard ACLs.
D
1-199
Why wrong: Incorrect. Numbers 100-199 are for extended ACLs.

Question 18mediummultiple choice

When using an extended ACL to filter traffic, which fields can be matched? (Choose the most complete answer.)

Trap 1: Only source IP address.

Incorrect. That is the capability of a standard ACL.

Trap 2: Source IP address and destination port number only.

Incorrect. Extended ACLs can match more fields, including protocol and source port.

Trap 3: MAC address and IP address.

Incorrect. MAC addresses are not matched by IP ACLs; they are used in MAC ACLs.

A
Only source IP address.
Why wrong: Incorrect. That is the capability of a standard ACL.
B
Source and destination IP addresses, protocol, and port numbers.
Correct. Extended ACLs can match these fields for fine-grained filtering.
C
Source IP address and destination port number only.
Why wrong: Incorrect. Extended ACLs can match more fields, including protocol and source port.
D
MAC address and IP address.
Why wrong: Incorrect. MAC addresses are not matched by IP ACLs; they are used in MAC ACLs.

Question 19mediummulti select

Which TWO commands verify the application and content of an IPv4 access control list on a Cisco IOS router? (Choose TWO.)

Trap 1: show running-config | include access-list

This shows configuration lines but does not confirm real-time application or hit counts.

Trap 2: show ip route

This displays the routing table, not ACL information.

Trap 3: debug ip packet

This is a debugging tool that can impact performance; it is not a standard verification command.

A
show ip interface
This command shows which ACLs are applied inbound/outbound on each interface.
B
show access-lists
This command displays the ACL entries and their hit counts, confirming content and activity.
C
show running-config | include access-list
Why wrong: This shows configuration lines but does not confirm real-time application or hit counts.
D
show ip route
Why wrong: This displays the routing table, not ACL information.
E
debug ip packet
Why wrong: This is a debugging tool that can impact performance; it is not a standard verification command.

Question 20mediummulti select

Which TWO statements about IPv4 extended access control lists are true? (Choose TWO.)

Trap 1: They use a wildcard mask only for the destination address.

Wildcard masks are used for both source and destination addresses in extended ACLs.

Trap 2: They can be named using numbers only.

Numbered ACLs use numbers; named ACLs use alphanumeric names.

Trap 3: They automatically log all matched packets.

Logging requires the 'log' keyword; it is not automatic.

A
They can filter based on source and destination IP addresses.
Extended ACLs can specify both source and destination addresses in the permit/deny statement.
B
They are typically placed as close to the source as possible.
Best practice for extended ACLs is to apply them near the source to conserve bandwidth.
C
They use a wildcard mask only for the destination address.
Why wrong: Wildcard masks are used for both source and destination addresses in extended ACLs.
D
They can be named using numbers only.
Why wrong: Numbered ACLs use numbers; named ACLs use alphanumeric names.
E
They automatically log all matched packets.
Why wrong: Logging requires the 'log' keyword; it is not automatic.