Cisco CCNA Access Control Lists (ACLs) 2 — Questions and Answers
Question 1: Which wildcard mask would match only the host 192.168.10.5?
- 0.0.0.255
- 0.0.0.0 (Correct answer)
- 255.255.255.0
- 0.0.255.255
Correct answer: 0.0.0.0
A wildcard mask of 0.0.0.0 means all bits must match, which specifies a single host.
Question 2: Which ACL number range is used for extended IP ACLs?
- 1-99
- 100-199 (Correct answer)
- 200-299
- 1300-1999
Correct answer: 100-199
Extended IP ACLs use the number range 100-199 (and 2000-2699 for expanded range).
Question 3: Where should an extended ACL be placed for optimal performance?
- As close to the destination as possible
- As close to the source as possible (Correct answer)
- On the core switch only
- On the default gateway router
Correct answer: As close to the source as possible
Extended ACLs should be placed close to the source to stop unwanted traffic early and reduce unnecessary network load.
Question 4: What does the 'established' keyword do in an extended ACL?
- Permits all TCP traffic
- Permits TCP packets with ACK or RST bits set (Correct answer)
- Denies all new TCP connections
- Matches only UDP traffic
Correct answer: Permits TCP packets with ACK or RST bits set
The 'established' keyword matches TCP segments that have the ACK or RST bit set, indicating an existing session.
Question 5: An administrator applies the command 'ip access-group 101 in' on an interface. What does this mean?
- ACL 101 filters traffic leaving the interface
- ACL 101 filters traffic entering the interface (Correct answer)
- ACL 101 is applied to all interfaces
- ACL 101 is a named ACL
Correct answer: ACL 101 filters traffic entering the interface
The 'in' keyword applies the ACL to inbound traffic arriving on that interface.
Question 6: Which command correctly creates a named extended ACL called BLOCK-WEB?
- access-list BLOCK-WEB extended permit
- ip access-list extended BLOCK-WEB (Correct answer)
- named access-list extended BLOCK-WEB
- ip access-list BLOCK-WEB extended
Correct answer: ip access-list extended BLOCK-WEB
The correct syntax to create a named extended ACL is 'ip access-list extended <name>'.
Question 7: What happens when a packet matches a permit statement in an ACL?
- The packet is dropped and logged
- The packet is forwarded and no further ACL entries are checked (Correct answer)
- The remaining ACL entries are still checked
- The packet is sent to the CPU for inspection
Correct answer: The packet is forwarded and no further ACL entries are checked
Once a packet matches any ACL statement (permit or deny), processing stops and the action is taken immediately.
Cisco CCNA Access Control Lists (ACLs) 2
Which wildcard mask would match only the host 192.168.10.5?