mediumMultiple Choice
350-401 Practice Question: Given the following configuration: interface…
Given the following configuration:
interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip access-group 101 in
!
access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80 access-list 101 deny ip any any
What is the effect of this configuration?
⚠ Common exam trap
Cisco often tests the distinction between inbound and outbound ACL application, and the trap here is confusing the direction of the access-group or misreading the source/destination in the ACL entries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incoming traffic from 192.168.1.0/24 to any destination on port 80 is permitted; all other incoming traffic is denied.
The configuration applies access-list 101 inbound on GigabitEthernet0/0. The first ACE permits TCP traffic from source network 192.168.1.0/24 to any destination on port 80 (HTTP). The second ACE denies all other IP traffic. Since the access list is applied in the inbound direction, it filters traffic entering the router through that interface. Therefore, only incoming traffic matching the permit statement is allowed; everything else is denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Incoming traffic from 192.168.1.0/24 to any destination on port 80 is permitted; all other incoming traffic is denied.
Why this is correct
This is correct because the access-list entry 'permit tcp 192.168.1.0 0.0.0.255 any eq 80' matches packets that enter the chosen interface (inbound direction) with a source IP in 192.168.1.0/24, any destination IP, and a destination TCP port of 80 (HTTP). Once this permit statement is evaluated and no other permit entries exist, the implicit deny all at the end of the ACL causes all other inbound traffic to be dropped. Therefore only HTTP from the specified subnet is allowed; everything else is denied.
- ✗
Outgoing traffic from the router to 192.168.1.0/24 on port 80 is permitted; all other outgoing traffic is denied.
Why it's wrong here
This is incorrect because the ACL is applied with the 'in' keyword, meaning it is evaluated only for packets that are entering the interface from the attached network, not for packets leaving the router. Additionally, the ACL's source field is 192.168.1.0/24 and its destination is 'any', so the permitted flow would be from that subnet to any host, not to that subnet. Thus the statement mischaracterizes both the direction of enforcement and the source/destination relationship.
- ✗
Incoming traffic from any source to 192.168.1.0/24 on port 80 is permitted; all other incoming traffic is denied.
Why it's wrong here
This is wrong because it inverts the source and destination addresses in the access-list entry. In the ACE 'permit tcp 192.168.1.0 0.0.0.255 any eq 80', the first address and wildcard define the source, while 'any' is the destination. So inbound traffic with a source address in 192.168.1.0/24 is matched, regardless of where it is going; traffic from other sources to the 192.168.1.0/24 network would require a different ACE with 'any' as the source and that network as the destination.
- ✗
The access-list will permit all TCP traffic from 192.168.1.0/24, regardless of destination port.
Why it's wrong here
This is incorrect because the access-list entry is not a general TCP permit; it includes the 'eq 80' qualifier, which restricts the match to packets whose destination TCP port equals 80 (HTTP). Without that qualifier, the ACE would match all TCP packets from that source network, but with it, non-HTTP TCP traffic (e.g., SSH on port 22, HTTPS on 443) does not match and is subject to the implicit deny. So only TCP port 80 traffic from 192.168.1.0/24 is permitted, not all TCP traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.