mediumMultiple ChoiceObjective-mapped
ACL Inbound Show Access-List Interpretation
A network engineer runs the following command on Router R1:
R1# show ip interface GigabitEthernet0/0 | include access list
Inbound access list is 101 Outbound access list is not set
R1# show access-lists 101
Extended IP access list 101
10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
20 deny tcp any any eq 80 (50 matches)
30 permit ip any any (200 matches)Based on this output, what can be concluded?
Quick Answer
The answer is that HTTP traffic from sources outside 192.168.1.0/24 is denied. This conclusion follows from interpreting the ACL show access-list interpretation inbound on GigabitEthernet0/0: the ACL first permits TCP from the 192.168.1.0/24 subnet to any destination on port 80, then explicitly denies all other HTTP traffic, and finally permits all other IP traffic. The match counters confirm this logic—100 hits on the permit line for the subnet, 50 hits on the deny line for outside HTTP sources, and 200 hits on the final permit for non-HTTP traffic. On the ENCOR 350-401 exam, this tests your ability to read ACL sequence order and match counters, a common trap being that a later permit any any does not override an earlier explicit deny for a specific protocol. A useful memory tip: ACLs are processed top-down, so a deny for a specific service (like HTTP) will block that service from all sources not explicitly permitted earlier, regardless of a catch-all permit later.
⚠ Common exam trap
Cisco often tests the order of ACL entries and the fact that an ACL applied inbound filters traffic before it enters the router, so candidates may mistakenly think the ACL is applied outbound or that the permit ip any any at the end permits all HTTP traffic, ignoring the earlier deny statement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HTTP traffic from sources outside 192.168.1.0/24 is denied.
The ACL 101 is applied inbound on GigabitEthernet0/0. The first line permits TCP traffic from source 192.168.1.0/24 to any destination on port 80 (HTTP). The second line denies TCP traffic from any source to any destination on port 80, which catches HTTP traffic from sources outside 192.168.1.0/24. Since ACLs process in order, traffic from outside the permitted subnet is denied, making option A correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
HTTP traffic from sources outside 192.168.1.0/24 is denied.
Why this is correct
Entry 20 denies all HTTP traffic not matching entry 10, so any HTTP from other subnets is denied.
- ✗
All HTTP traffic is permitted.
Why it's wrong here
Entry 20 denies HTTP from sources not in 192.168.1.0/24.
- ✗
The ACL is applied outbound on the interface.
Why it's wrong here
The output clearly states 'Inbound access list is 101'.
- ✗
The ACL permits all traffic from 192.168.1.0/24.
Why it's wrong here
It only permits HTTP (port 80) from that subnet, not all traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Router R1: R1# show ip interface GigabitEthernet0/1 | include access list Inbound access list is not set Outbound access list is 140 R1# show access-lists 140 Extended IP access list 140 10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches) 20 deny tcp any any eq 443 (10 matches) 30 permit ip any any (50 matches) Based on this output, what can be concluded?
medium- ✓ A.HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.
- B.All HTTPS traffic is permitted outbound.
- C.The ACL is applied inbound on the interface.
- D.The ACL permits all traffic from 192.168.1.0/24.
Why A: The ACL 140 is applied outbound on GigabitEthernet0/1. It permits TCP port 443 (HTTPS) traffic only from source 192.168.1.0/24, then denies all other HTTPS traffic, and finally permits all other IP traffic. Since the deny statement (line 20) blocks HTTPS from any source not matching the permit (line 10), traffic from outside 192.168.1.0/24 is denied when exiting the interface, making option A correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.