Cisco CCNA Access Control Lists (ACLs) 5 — Questions and Answers
Question 1: A VLAN ACL (VACL) differs from a routed ACL because it can filter traffic that is:
- Only routed between VLANs
- Only destined for the router CPU
- Both routed and bridged within the same VLAN (Correct answer)
- Only inbound on Layer 3 interfaces
Correct answer: Both routed and bridged within the same VLAN
VACLs apply to all traffic within a VLAN, including Layer 2 bridged traffic that never passes through a routed interface.
Question 2: Which keyword in a standard ACL matches all hosts (equivalent to 0.0.0.0 255.255.255.255)?
- all
- default
- any (Correct answer)
- every
Correct answer: any
The keyword 'any' is shorthand for source address 0.0.0.0 with wildcard 255.255.255.255, matching every IP address.
Question 3: What is the result of applying an ACL with only a 'deny' statement and no permit entries?
- All traffic is permitted by default
- All traffic is denied due to the implicit deny any at the end (Correct answer)
- Only the denied traffic is blocked; everything else passes
- The router ignores the ACL
Correct answer: All traffic is denied due to the implicit deny any at the end
The single deny entry plus the implicit deny any at the end means all traffic is blocked.
Question 4: Which protocol number would you use in an extended ACL to match ICMP traffic?
- 6
- 17
- 1 (Correct answer)
- 89
Correct answer: 1
ICMP is protocol number 1; TCP is 6, UDP is 17, and OSPF is 89.
Question 5: An administrator wants to log packets that match an ACL deny entry. Which keyword is added to the ACL entry?
- record
- monitor
- log (Correct answer)
- trace
Correct answer: log
Adding the 'log' keyword at the end of an ACL entry causes matching packets to generate a syslog message.
Question 6: Which statement about numbered ACLs versus named ACLs is TRUE?
- Numbered ACLs allow deletion of individual entries; named ACLs do not
- Named ACLs allow deletion of individual entries; numbered ACLs require deleting the entire ACL (Correct answer)
- Both types allow individual entry deletion equally
- Named ACLs cannot be used on router interfaces
Correct answer: Named ACLs allow deletion of individual entries; numbered ACLs require deleting the entire ACL
Named ACLs support per-entry deletion using sequence numbers, while numbered ACLs require removing and re-entering the entire list.
Question 7: Which ACL entry correctly blocks all traffic from the 10.0.0.0/8 network to a web server at 172.16.1.10?
- access-list 100 deny tcp 10.0.0.0 255.0.0.0 host 172.16.1.10 eq 80
- access-list 100 deny tcp 10.0.0.0 0.255.255.255 host 172.16.1.10 eq 80 (Correct answer)
- access-list 100 deny ip 10.0.0.0 0.0.0.255 host 172.16.1.10
- access-list 1 deny 10.0.0.0 0.255.255.255
Correct answer: access-list 100 deny tcp 10.0.0.0 0.255.255.255 host 172.16.1.10 eq 80
The /8 network requires wildcard 0.255.255.255; HTTP uses TCP port 80; 'host' keyword matches the single destination IP.
Cisco CCNA Access Control Lists (ACLs) 5
A VLAN ACL (VACL) differs from a routed ACL because it can filter traffic that is: