Cisco CCNA Access Control Lists (ACLs) 4 — Questions and Answers
Question 1: An ACL entry reads: 'permit ip 192.168.1.0 0.0.0.255 any'. What traffic does this permit?
- All traffic from any host to 192.168.1.0/24
- All IP traffic from the 192.168.1.0/24 subnet to any destination (Correct answer)
- Only TCP traffic from 192.168.1.0/24
- Only ICMP traffic from 192.168.1.0/24
Correct answer: All IP traffic from the 192.168.1.0/24 subnet to any destination
The source is 192.168.1.0/24 (wildcard 0.0.0.255) and the destination is 'any', permitting all IP traffic from that subnet.
Question 2: Which command removes a single entry from a named ACL?
- no access-list <number>
- no ip access-list entry <number>
- no <sequence-number> inside the named ACL config mode (Correct answer)
- delete access-list entry
Correct answer: no <sequence-number> inside the named ACL config mode
In named ACL configuration mode, typing 'no <sequence-number>' removes that specific entry.
Question 3: What is the default sequence number increment when adding ACL entries without specifying a sequence number?
- 5
- 10 (Correct answer)
- 1
- 100
Correct answer: 10
Cisco IOS automatically assigns sequence numbers in increments of 10 (10, 20, 30…) for ACL entries.
Question 4: Which ACL type uses the 'evaluate' command to permit return traffic?
- Standard ACL
- Extended ACL
- Reflexive ACL (Correct answer)
- Dynamic ACL
Correct answer: Reflexive ACL
Reflexive ACLs use 'ip reflexive-list timeout' and the 'evaluate' command to match dynamic return-traffic entries.
Question 5: A time-based ACL uses which command to reference a defined time range?
- schedule <name>
- time-range <name> (Correct answer)
- active-period <name>
- clock-range <name>
Correct answer: time-range <name>
The 'time-range <name>' command defines a time window, which is then referenced in an ACL entry with 'time-range <name>'.
Question 6: Which ACL feature locks a switch port to a specific user's MAC address after successful authentication?
- Port ACL (PACL)
- Dynamic ACL (Lock-and-Key) (Correct answer)
- Reflexive ACL
- VLAN ACL (VACL)
Correct answer: Dynamic ACL (Lock-and-Key)
Dynamic ACLs (Lock-and-Key) require Telnet authentication before temporarily opening access for a specific host.
Question 7: What command displays the hit count for each ACL entry?
- show ip interface brief
- show ip access-lists (Correct answer)
- debug ip packet
- show access-list statistics
Correct answer: show ip access-lists
'show ip access-lists' shows each ACL entry along with how many packets have matched it.
Cisco CCNA Access Control Lists (ACLs) 4
An ACL entry reads: 'permit ip 192.168.1.0 0.0.0.255 any'.
What traffic does this permit?