Cisco CCNA Access Control Lists (ACLs) Questions and Answers

Question 1

A network administrator needs to create an ACL that denies FTP traffic from a specific source subnet (192.168.10.0/24) to a specific destination server (10.0.0.5). Which type of ACL is required for this task?

Accepted Answer

Extended Numbered ACL

Answer

Extended ACLs are required because they can filter traffic based on source IP address, destination IP address, protocol type (like TCP for FTP), and specific port numbers. Standard ACLs can only filter based on the source IP address.

Question 2

A network administrator needs to use a standard ACL to prevent traffic from the 192.168.1.0/24 subnet from reaching the server subnet 10.10.10.0/24. All other traffic from 192.168.1.0/24 should be permitted to reach other destinations. According to Cisco best practices, where should this ACL be placed?

Accepted Answer

Outbound on the destination router's interface connected to 10.10.10.0/24.

Answer

The best practice for standard ACLs is to place them as close to the destination as possible. This is because standard ACLs only filter by source address and cannot specify a destination. Placing it close to the source (e.g., inbound on the source router) would block all traffic from 192.168.1.0/24, preventing it from reaching any destination, not just the intended server subnet.

Question 3

An administrator writes the following Access Control Entry (ACE): `access-list 10 permit 192.168.16.0 0.0.15.255`. Which range of IP addresses will be permitted by this statement?

Accepted Answer

192.168.16.0 to 192.168.31.255

Answer

The wildcard mask `0.0.15.255` is used to determine which bits of the address must match. A '0' in the wildcard mask means the corresponding bit must match, while a '1' means the bit does not matter. The mask `0.0.15.255` in binary is `00000000.00000000.00001111.11111111`. This means the first 20 bits must match the address `192.168.16.0`. The last 12 bits (4 in the third octet, 8 in the fourth) can be anything, which creates a range of addresses from 192.168.16.0 to 192.168.31.255.

Question 4

A network administrator applies the following ACL to the inbound direction of an interface:
`access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 80`
`access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 443`
A user on the 10.1.1.50 host reports that they can access websites but cannot resolve domain names using the company's DNS server at 10.10.10.10. What is the most likely cause of this issue?

Accepted Answer

The DNS traffic is being blocked by the implicit deny at the end of the ACL.

Answer

All ACLs have an invisible `deny any any` statement at the very end, known as the implicit deny. The configured ACL explicitly permits HTTP (port 80) and HTTPS (port 443) traffic from the 10.1.1.0/24 network. However, it does not have a statement to permit DNS traffic (UDP port 53). Therefore, the DNS query from 10.1.1.50 is matched against the implicit deny statement and dropped.

Question 5

A network administrator wants to restrict Telnet and SSH access to a router's virtual terminal (VTY) lines, allowing access only from the management workstation with the IP address 10.0.0.99. Which set of commands correctly accomplishes this?

Accepted Answer

router(config)# access-list 1 permit host 10.0.0.99
router(config)# line vty 0 15
router(config-line)# access-class 1 in

Answer

To apply an access control list to VTY lines to filter management access (like Telnet or SSH), the `access-class` command must be used under `line vty` configuration mode. The `ip access-group` command is used for applying ACLs to physical or logical Layer 3 interfaces, not VTY lines.

Cisco CCNA Practice Test

Cisco CCNA Practice Test

Cisco CCNA Access Control Lists (ACLs) Questions and Answers