hardMultiple ChoiceObjective-mapped
Decoding ACL Match Counts from show access-lists
A network engineer runs the following command on Router R1:
R1# show ip access-lists
Extended IP access list 150
10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
20 deny tcp any any eq 23 (8 matches)
30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
40 deny tcp any any eq 22 (1 match)
50 permit ip any any (15 matches)Based on this output, what can be concluded?
Quick Answer
The answer is that Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied. This conclusion is drawn by interpreting the show access-lists output, where the ACL processes entries sequentially: the first match for a packet determines its action, and subsequent entries are ignored. Since 192.168.1.0/24 is not within the permitted 10.0.0.0/8 range for Telnet, it falls to the deny any any eq 23 entry, which has 8 matches confirming such denials. Similarly, SSH from 10.0.0.0/8 does not match the permit for 172.16.0.0/16, so it hits the deny any any eq 22 entry, with 1 match indicating a single denied SSH packet. On the ENCOR 350-401 exam, decoding ACL match counts tests your ability to trace packet flow through an ordered list, a common trap being the assumption that a permit entry for one source implicitly permits all others. Remember: ACLs are a first-match-wins filter, not a whitelist—if your source isn’t explicitly permitted, it’s implicitly denied by the next matching deny statement.
⚠ Common exam trap
Cisco often tests the misconception that a permit statement for one protocol (e.g., Telnet) also permits another protocol (e.g., SSH) from the same source, when in fact each ACE applies only to the specified protocol and port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.
The ACL 150 processes entries sequentially. Telnet (TCP port 23) from 192.168.1.0/24 is not explicitly permitted by the first permit statement (which only allows source 10.0.0.0/8) and is denied by the subsequent deny statement (line 20). SSH (TCP port 22) from 10.0.0.0/8 is permitted by line 10 only for Telnet, not SSH; line 30 permits SSH only from 172.16.0.0/16, so SSH from 10.0.0.0/8 hits line 40 (deny) and is denied. The implicit deny at the end would also block unmatched traffic, but here explicit denies apply.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.
Why this is correct
Telnet from 192.168.1.0/24 matches entry 20 (deny), and SSH from 10.0.0.0/8 does not match entry 30 (which permits only from 172.16.0.0/16), so it matches entry 40 (deny).
- ✗
Telnet from 10.0.0.0/8 is denied.
Why it's wrong here
Entry 10 permits Telnet from 10.0.0.0/8.
- ✗
SSH from 172.16.0.0/16 is denied.
Why it's wrong here
Entry 30 permits SSH from 172.16.0.0/16.
- ✗
All traffic is permitted.
Why it's wrong here
Telnet and SSH from unauthorized sources are denied.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Router R1: R1# show access-lists Extended IP access list 101 10 permit tcp host 10.1.1.1 host 192.168.1.100 eq 80 (4 matches) 20 deny tcp any host 192.168.1.100 eq 80 (12 matches) 30 permit ip any any (8 matches) Based on this output, what can be concluded?
medium- ✓ A.HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.
- B.All HTTP traffic to 192.168.1.100 is denied.
- C.All traffic from 10.1.1.1 to 192.168.1.100 is permitted.
- D.The ACL is applied inbound on an interface.
Why A: The ACL explicitly permits TCP traffic from host 10.1.1.1 to host 192.168.1.1.100 on port 80 (HTTP) via line 10, and then denies all other TCP traffic to that same host on port 80 via line 20. The match counters confirm that both lines have been hit, and the final permit ip any any (line 30) allows all other traffic. Thus, only HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, while all other HTTP traffic to that host is denied.
Variation 2. A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 120 10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches) 20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches) 30 deny tcp any any eq 22 (2 matches) 40 permit ip any any (10 matches) Based on this output, what can be concluded?
medium- ✓ A.SSH access from 192.168.1.0/24 would be denied.
- B.SSH access from 10.0.0.0/8 is denied.
- C.All SSH traffic is permitted.
- D.The ACL has an implicit deny at the end.
Why A: The ACL 120 explicitly denies TCP traffic to port 22 (SSH) from any source not matching the earlier permit statements. The source 192.168.1.0/24 is not covered by the permit entries (10.0.0.0/8 or 172.16.0.0/16), so it hits line 30 (deny tcp any any eq 22) and is denied. The 5 matches on line 10 and 3 on line 20 confirm that only traffic from those specific subnets is permitted for SSH.
Variation 3. A network engineer runs the following command on Router R1: R1# show access-lists 130 Extended IP access list 130 10 permit icmp host 10.1.1.1 any echo (8 matches) 20 permit icmp host 10.1.1.1 any echo-reply (5 matches) 30 deny icmp any any (3 matches) 40 permit ip any any (12 matches) Based on this output, what can be concluded?
medium- ✓ A.ICMP packets from sources other than 10.1.1.1 are denied.
- B.All ICMP traffic is permitted.
- C.The ACL permits all traffic from 10.1.1.1.
- D.The ACL is applied inbound on an interface.
Why A: The ACL explicitly denies all ICMP traffic (line 30) except for echo and echo-reply from host 10.1.1.1 (lines 10 and 20). The 'deny icmp any any' statement matches ICMP packets from any source other than 10.1.1.1, and the 'permit ip any any' at line 40 only permits non-ICMP traffic. Therefore, ICMP packets from sources other than 10.1.1.1 are denied.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.