Cisco CCNA Access Control Lists (ACLs) 3 — Questions and Answers
Question 1: What is the effect of the implicit deny at the end of every ACL?
- It logs all unmatched traffic
- It drops all traffic that does not match any ACL entry (Correct answer)
- It permits all unmatched traffic
- It sends unmatched traffic to a default route
Correct answer: It drops all traffic that does not match any ACL entry
Every ACL ends with an implicit 'deny any' that silently drops any traffic not matched by a previous entry.
Question 2: Which ACL type can filter traffic based on both source AND destination IP address?
- Standard ACL
- Extended ACL (Correct answer)
- Dynamic ACL
- Reflexive ACL
Correct answer: Extended ACL
Extended ACLs can match on source IP, destination IP, protocol, and port numbers.
Question 3: Which command verifies which ACLs are applied to a specific interface and their direction?
- show access-lists
- show ip interface (Correct answer)
- show running-config
- show ip access-lists
Correct answer: show ip interface
'show ip interface' displays the inbound and outbound ACLs applied to each interface.
Question 4: A network administrator needs to block only Telnet traffic from host 10.1.1.1 to any destination. Which ACL entry achieves this?
- access-list 100 deny tcp any host 10.1.1.1 eq 23
- access-list 100 deny tcp host 10.1.1.1 any eq 23 (Correct answer)
- access-list 100 deny udp host 10.1.1.1 any eq 23
- access-list 1 deny host 10.1.1.1
Correct answer: access-list 100 deny tcp host 10.1.1.1 any eq 23
Telnet uses TCP port 23; the source is the host and destination is 'any'.
Question 5: Which wildcard mask matches the entire subnet 172.16.0.0/16?
- 255.255.0.0
- 0.0.0.255
- 0.0.255.255 (Correct answer)
- 255.0.0.0
Correct answer: 0.0.255.255
A /16 prefix means 16 bits are fixed, so the wildcard mask is 0.0.255.255, allowing the last 16 bits to vary.
Question 6: How many ACLs can be applied per interface per direction?
- Unlimited
- Two (one inbound, one outbound)
- One (Correct answer)
- Four
Correct answer: One
Cisco IOS allows only one ACL per interface per direction (one inbound and one outbound).
Question 7: What is a reflexive ACL primarily used for?
- Blocking all ICMP traffic
- Allowing return traffic for sessions initiated from inside the network (Correct answer)
- Filtering traffic based on time of day
- Locking out users after failed login attempts
Correct answer: Allowing return traffic for sessions initiated from inside the network
Reflexive ACLs dynamically permit return traffic for outbound sessions, providing stateful-like filtering.
Cisco CCNA Access Control Lists (ACLs) 3
What is the effect of the implicit deny at the end of every ACL?