Cisco CCNA Access Control Lists (ACLs) Questions and Answers — Questions and Answers
Question 1: A network administrator needs to create an ACL that denies FTP traffic from a specific source subnet (192.168.10.0/24) to a specific destination server (10.0.0.5). Which type of ACL is required for this task?
- MAC Address ACL
- Standard Numbered ACL
- Extended Numbered ACL (Correct answer)
- Reflexive ACL
Correct answer: Extended Numbered ACL
Extended ACLs are required because they can filter traffic based on source IP address, destination IP address, protocol type (like TCP for FTP), and specific port numbers. Standard ACLs can only filter based on the source IP address.
Question 2: A network administrator needs to use a standard ACL to prevent traffic from the 192.168.1.0/24 subnet from reaching the server subnet 10.10.10.0/24. All other traffic from 192.168.1.0/24 should be permitted to reach other destinations. According to Cisco best practices, where should this ACL be placed?
- Inbound on the source router's interface connected to 192.168.1.0/24.
- Outbound on the source router's interface leading towards the destination.
- Inbound on the destination router's interface leading towards the source.
- Outbound on the destination router's interface connected to 10.10.10.0/24. (Correct answer)
Correct answer: Outbound on the destination router's interface connected to 10.10.10.0/24.
The best practice for standard ACLs is to place them as close to the destination as possible. This is because standard ACLs only filter by source address and cannot specify a destination. Placing it close to the source (e.g., inbound on the source router) would block all traffic from 192.168.1.0/24, preventing it from reaching any destination, not just the intended server subnet.
Question 3: An administrator writes the following Access Control Entry (ACE): `access-list 10 permit 192.168.16.0 0.0.15.255`. Which range of IP addresses will be permitted by this statement?
- 192.168.16.0 to 192.168.16.255
- 192.168.16.0 to 192.168.31.255 (Correct answer)
- 192.168.0.0 to 192.168.31.255
- 192.168.16.0 to 192.168.32.255
Correct answer: 192.168.16.0 to 192.168.31.255
The wildcard mask `0.0.15.255` is used to determine which bits of the address must match. A '0' in the wildcard mask means the corresponding bit must match, while a '1' means the bit does not matter. The mask `0.0.15.255` in binary is `00000000.00000000.00001111.11111111`. This means the first 20 bits must match the address `192.168.16.0`. The last 12 bits (4 in the third octet, 8 in the fourth) can be anything, which creates a range of addresses from 192.168.16.0 to 192.168.31.255.
Question 4: A network administrator applies the following ACL to the inbound direction of an interface: `access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 80` `access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 443` A user on the 10.1.1.50 host reports that they can access websites but cannot resolve domain names using the company's DNS server at 10.10.10.10. What is the most likely cause of this issue?
- The DNS traffic is being blocked by the implicit deny at the end of the ACL. (Correct answer)
- The ACL is applied in the wrong direction on the interface.
- A named ACL must be used for DNS traffic.
- The source address in the ACL statements is incorrect.
Correct answer: The DNS traffic is being blocked by the implicit deny at the end of the ACL.
All ACLs have an invisible `deny any any` statement at the very end, known as the implicit deny. The configured ACL explicitly permits HTTP (port 80) and HTTPS (port 443) traffic from the 10.1.1.0/24 network. However, it does not have a statement to permit DNS traffic (UDP port 53). Therefore, the DNS query from 10.1.1.50 is matched against the implicit deny statement and dropped.
Question 5: A network administrator wants to restrict Telnet and SSH access to a router's virtual terminal (VTY) lines, allowing access only from the management workstation with the IP address 10.0.0.99. Which set of commands correctly accomplishes this?
- router(config)# access-list 101 permit ip host 10.0.0.99 any router(config)# line vty 0 15 router(config-line)# ip access-group 101 in
- router(config)# access-list 1 permit any router(config)# line vty 0 15 router(config-line)# access-class 10.0.0.99 in
- router(config)# access-list 1 permit host 10.0.0.99 router(config)# line vty 0 15 router(config-line)# access-class 1 in (Correct answer)
- router(config)# access-list 1 permit host 10.0.0.99 router(config)# interface vty 0 15 router(config-if)# ip access-group 1 in
Correct answer: router(config)# access-list 1 permit host 10.0.0.99 router(config)# line vty 0 15 router(config-line)# access-class 1 in
To apply an access control list to VTY lines to filter management access (like Telnet or SSH), the `access-class` command must be used under `line vty` configuration mode. The `ip access-group` command is used for applying ACLs to physical or logical Layer 3 interfaces, not VTY lines.
Question 6: An administrator needs to insert a new rule into an existing, numbered standard ACL (access-list 10). The new rule must permit a specific host (192.168.5.5) and should be evaluated before any other existing rules in the ACL. Which of the following methods should be used to achieve this?
- Use a sequence number to insert the new permit statement at the beginning of the ACL. (Correct answer)
- Use a text editor to copy the ACL, insert the new line at the top, delete the old ACL, and paste the new version.
- Re-enter the entire ACL from the CLI, typing the new permit statement first.
- Add the new permit statement to the end of the ACL and use the `ip access-list resequence` command.
Correct answer: Use a sequence number to insert the new permit statement at the beginning of the ACL.
Modern Cisco IOS allows for editing both numbered and named ACLs using sequence numbers. To insert a rule at the beginning, an administrator can enter the specific ACL configuration mode (`ip access-list standard 10`) and then specify a low sequence number (e.g., `5 permit host 192.168.5.5`) to place it before the default sequence numbers, which start at 10 and increment by 10.
Cisco CCNA Access Control Lists (ACLs) Questions and Answers
A network administrator needs to create an ACL that denies FTP traffic from a specific source subnet (192.168.10.0/24) to a specific destination server (10.0.0.5).
Which type of ACL is required for this task?