Cisco CCNA 200-301 IPv4 Access Control Lists Practice Test

Topic 36 focuses on IPv4 Access Control Lists for the Cisco Certified Network Associate (CCNA) certification and the 200-301 exam, using Cisco networking and Cisco IOS concepts where relevant. For broader exam preparation, review the Cisco CCNA 200-301 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which IPv4 ACL type primarily matches traffic based on source IPv4 address?

1. Standard ACL placement
2. Standard ACL
3. Outbound ACL
4. Extended ACL placement

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

Incorrect Answers

Answer A is incorrect because the “Standard ACL placement” option describes a different concept: a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

Answer C is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

Answer D is incorrect because the “Extended ACL placement” option describes a different concept: a common design guideline is to place extended ACLs relatively close to the source because they can precisely identify source, destination, protocol, and ports.

 

Question 2

Which IPv4 ACL type can match source and destination addresses plus protocol and port information?

1. Standard ACL placement
2. Wildcard mask
3. Named IPv4 ACL
4. Extended ACL

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Incorrect Answers

Answer A is incorrect because the “Standard ACL placement” option describes a different concept: a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

Answer B is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer C is incorrect because the “Named IPv4 ACL” option describes a different concept: a named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.

 

Question 3

What is an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses?

1. Wildcard 0.0.0.0
2. ACE
3. Wildcard mask
4. First-match ACL logic

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Incorrect Answers

Answer A is incorrect because the “Wildcard 0.0.0.0” option describes a different concept: a wildcard mask of 0.0.0.0 requires every address bit to match exactly.

Answer B is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Answer D is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

 

Question 4

Which invisible deny statement at the end of an ACL drops packets not matched by an earlier permit statement?

1. ip access-group
2. Implicit deny
3. Standard ACL placement
4. permit ACE

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes the invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Incorrect Answers

Answer A is incorrect because the “ip access-group” option describes a different concept: the Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

Answer C is incorrect because the “Standard ACL placement” option describes a different concept: a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

Answer D is incorrect because the “permit ACE” option describes a different concept: an access control entry that allows traffic matching its conditions.

 

Question 5

Which access control entry allows traffic matching its conditions?

1. permit ACE
2. Implicit deny
3. Outbound ACL
4. Inbound ACL

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes an access control entry that allows traffic matching its conditions.

Incorrect Answers

Answer B is incorrect because the “Implicit deny” option describes a different concept: the invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Answer C is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

Answer D is incorrect because the “Inbound ACL” option describes a different concept: an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

 

Question 6

Which access control entry blocks traffic matching its conditions?

1. Outbound ACL
2. permit ACE
3. deny ACE
4. Inbound ACL

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes an access control entry that blocks traffic matching its conditions.

Incorrect Answers

Answer A is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

Answer B is incorrect because the “permit ACE” option describes a different concept: an access control entry that allows traffic matching its conditions.

Answer D is incorrect because the “Inbound ACL” option describes a different concept: an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

 

Question 7

Which ACL is applied to traffic as it enters an interface before the router makes the outbound forwarding decision?

1. ip access-group
2. Outbound ACL
3. Inbound ACL
4. First-match ACL logic

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

Incorrect Answers

Answer A is incorrect because the “ip access-group” option describes a different concept: the Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

Answer B is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

Answer D is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

 

Question 8

Which ACL is applied to traffic after the routing decision as packets are about to leave an interface?

1. Implicit deny
2. Top-down ACL processing
3. any keyword
4. Outbound ACL

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes an ACL applied to traffic after the routing decision as packets are about to leave an interface.

Incorrect Answers

Answer A is incorrect because the “Implicit deny” option describes a different concept: the invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Answer B is incorrect because the “Top-down ACL processing” option describes a different concept: a router evaluates ACL entries in order from the top of the list toward the bottom.

Answer C is incorrect because the “any keyword” option describes a different concept: In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

 

Question 9

Which numeric value orders named ACL entries and makes insertion or editing easier?

1. Sequence number
2. First-match ACL logic
3. Named IPv4 ACL
4. Top-down ACL processing

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes a numeric value that orders named ACL entries and makes insertion or editing easier.

Incorrect Answers

Answer B is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer C is incorrect because the “Named IPv4 ACL” option describes a different concept: a named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.

Answer D is incorrect because the “Top-down ACL processing” option describes a different concept: a router evaluates ACL entries in order from the top of the list toward the bottom.

 

Question 10

What is an individual access control entry within an ACL, containing match criteria and a permit or deny action?

1. ACE
2. deny ACE
3. Extended ACL
4. TCP and UDP port matching

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Incorrect Answers

Answer B is incorrect because the “deny ACE” option describes a different concept: an access control entry that blocks traffic matching its conditions.

Answer C is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Answer D is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

 

Question 11

What is a router evaluates ACL entries in order from the top of the list toward the bottom?

1. Inbound ACL
2. Sequence number
3. Top-down ACL processing
4. First-match ACL logic

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes a router evaluates ACL entries in order from the top of the list toward the bottom.

Incorrect Answers

Answer A is incorrect because the “Inbound ACL” option describes a different concept: an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

Answer B is incorrect because the “Sequence number” option describes a different concept: a numeric value that orders named ACL entries and makes insertion or editing easier.

Answer D is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

 

Question 12

An ACL contains several entries that could match a packet. Which processing rule determines which action is applied?

1. Implicit deny
2. Outbound ACL
3. First-match ACL logic
4. any keyword

Correct Answer: C

 

Correct Answer

Answer C is correct because ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Incorrect Answers

Answer A is incorrect because the “Implicit deny” option describes a different concept: the invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Answer B is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

Answer D is incorrect because the “any keyword” option describes a different concept: In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

 

Question 13

Which IPv4 ACL keyword expresses an exact single-address match without writing the equivalent 0.0.0.0 wildcard mask?

1. host keyword
2. Wildcard mask
3. Standard ACL
4. First-match ACL logic

Correct Answer: A

 

Correct Answer

Answer A is correct because In an IPv4 ACL, the host keyword matches one exact IPv4 address and is equivalent to using a 0.0.0.0 wildcard mask for that address.

Incorrect Answers

Answer B is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer C is incorrect because the “Standard ACL” option describes a different concept: an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

Answer D is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

 

Question 14

An IPv4 ACL entry must match all IPv4 addresses. Which keyword expresses the equivalent of address 0.0.0.0 with wildcard 255.255.255.255?

1. any keyword
2. Standard ACL
3. First-match ACL logic
4. Extended ACL

Correct Answer: A

 

Correct Answer

Answer A is correct because In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

Incorrect Answers

Answer B is incorrect because the “Standard ACL” option describes a different concept: an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

Answer C is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer D is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

 

Question 15

An IPv4 ACL must compare every bit of a specified address. Which wildcard mask requires this exact match?

1. Wildcard 0.0.0.0
2. TCP and UDP port matching
3. Wildcard mask
4. Extended ACL

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes a wildcard mask of 0.0.0.0 requires every address bit to match exactly.

Incorrect Answers

Answer B is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Answer C is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer D is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

 

Question 16

What is a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address?

1. ACE
2. Wildcard 0.0.0.0
3. Standard ACL placement
4. Wildcard mask

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

Incorrect Answers

Answer A is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Answer B is incorrect because the “Wildcard 0.0.0.0” option describes a different concept: a wildcard mask of 0.0.0.0 requires every address bit to match exactly.

Answer D is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

 

Question 17

What is a common design guideline is to place extended ACLs relatively close to the source because they can precisely identify source, destination, protocol, and ports?

1. Sequence number
2. Extended ACL
3. TCP and UDP port matching
4. Extended ACL placement

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes a common design guideline is to place extended ACLs relatively close to the source because they can precisely identify source, destination, protocol, and ports.

Incorrect Answers

Answer A is incorrect because the “Sequence number” option describes a different concept: a numeric value that orders named ACL entries and makes insertion or editing easier.

Answer B is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Answer C is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

 

Question 18

Which IOS interface command applies an IPv4 ACL in the inbound or outbound direction?

1. Standard ACL
2. ACE
3. ip access-group
4. Outbound ACL

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes the Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

Incorrect Answers

Answer A is incorrect because the “Standard ACL” option describes a different concept: an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

Answer B is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Answer D is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

 

Question 19

An administrator identifies an ACL with a descriptive name and uses sequence numbers to edit its entries. Which ACL form is being used?

1. any keyword
2. host keyword
3. Extended ACL
4. Named IPv4 ACL

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes a named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.

Incorrect Answers

Answer A is incorrect because the “any keyword” option describes a different concept: In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

Answer B is incorrect because the “host keyword” option describes a different concept: In an IPv4 ACL, the host keyword matches one exact IPv4 address and is equivalent to using a 0.0.0.0 wildcard mask for that address.

Answer C is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

 

Question 20

What is an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH?

1. First-match ACL logic
2. Extended ACL
3. TCP and UDP port matching
4. Standard ACL

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Incorrect Answers

Answer A is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer B is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Answer D is incorrect because the “Standard ACL” option describes a different concept: an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

 

Question 21

For Standard ACL, which statement is accurate?

1. An ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.
2. An IPv4 ACL type that primarily matches traffic based on source IPv4 address.
3. In an IPv4 ACL, the host keyword matches one exact IPv4 address and is equivalent to using a 0.0.0.0 wildcard mask for that address.
4. An ACL applied to traffic after the routing decision as packets are about to leave an interface.

Correct Answer: B

 

Correct Answer

Answer B is correct because the choice accurately describes Standard ACL: An IPv4 ACL type that primarily matches traffic based on source IPv4 address.

Incorrect Answers

Answer A is incorrect because the “Inbound ACL” option describes a different concept: an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

Answer C is incorrect because the “host keyword” option describes a different concept: In an IPv4 ACL, the host keyword matches one exact IPv4 address and is equivalent to using a 0.0.0.0 wildcard mask for that address.

Answer D is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

 

Question 22

For Extended ACL, which statement is accurate?

1. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.
2. An IPv4 ACL type that can match source and destination addresses plus protocol and port information.
3. A common design guideline is to place extended ACLs relatively close to the source because they can precisely identify source, destination, protocol, and ports.
4. In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Incorrect Answers

Answer A is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Answer C is incorrect because the “Extended ACL placement” option describes a different concept: a common design guideline is to place extended ACLs relatively close to the source because they can precisely identify source, destination, protocol, and ports.

Answer D is incorrect because the “any keyword” option describes a different concept: In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

 

Question 23

For Wildcard mask, which statement is accurate?

1. A common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.
2. In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.
3. An ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.
4. An individual access control entry within an ACL, containing match criteria and a permit or deny action.

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Incorrect Answers

Answer A is incorrect because the “Standard ACL placement” option describes a different concept: a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

Answer B is incorrect because the “any keyword” option describes a different concept: In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

Answer D is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

 

Question 24

For Implicit deny, which statement is accurate?

1. A router evaluates ACL entries in order from the top of the list toward the bottom.
2. An individual access control entry within an ACL, containing match criteria and a permit or deny action.
3. ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.
4. The invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Correct Answer: D

 

Correct Answer

Answer D is correct because it accurately defines Implicit deny. The matching definition is: The invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Incorrect Answers

Answer A is incorrect because the “Top-down ACL processing” option describes a different concept: a router evaluates ACL entries in order from the top of the list toward the bottom.

Answer B is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Answer C is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

 

Question 25

For permit ACE, which statement is accurate?

1. An individual access control entry within an ACL, containing match criteria and a permit or deny action.
2. An access control entry that allows traffic matching its conditions.
3. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.
4. An access control entry that blocks traffic matching its conditions.

Correct Answer: B

 

Correct Answer

Answer B is correct because the choice accurately describes permit ACE: An access control entry that allows traffic matching its conditions.

Incorrect Answers

Answer A is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Answer C is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Answer D is incorrect because the “deny ACE” option describes a different concept: an access control entry that blocks traffic matching its conditions.

 

Question 26

For deny ACE, which statement is accurate?

1. An access control entry that blocks traffic matching its conditions.
2. An individual access control entry within an ACL, containing match criteria and a permit or deny action.
3. An IPv4 ACL type that primarily matches traffic based on source IPv4 address.
4. The Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes an access control entry that blocks traffic matching its conditions.

Incorrect Answers

Answer B is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Answer C is incorrect because the “Standard ACL” option describes a different concept: an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

Answer D is incorrect because the “ip access-group” option describes a different concept: the Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

 

Question 27

For Inbound ACL, which statement is accurate?

1. A router evaluates ACL entries in order from the top of the list toward the bottom.
2. ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.
3. An ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.
4. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

Incorrect Answers

Answer A is incorrect because the “Top-down ACL processing” option describes a different concept: a router evaluates ACL entries in order from the top of the list toward the bottom.

Answer B is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer D is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

 

Question 28

For Outbound ACL, which statement is accurate?

1. ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.
2. An ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.
3. An IPv4 ACL type that primarily matches traffic based on source IPv4 address.
4. An ACL applied to traffic after the routing decision as packets are about to leave an interface.

Correct Answer: D

 

Correct Answer

Answer D is correct because it accurately defines Outbound ACL. The matching definition is: An ACL applied to traffic after the routing decision as packets are about to leave an interface.

Incorrect Answers

Answer A is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer B is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer C is incorrect because the “Standard ACL” option describes a different concept: an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

 

Question 29

In a named IPv4 ACL, what is the purpose of a sequence number?

1. An ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.
2. The Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.
3. The invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.
4. A numeric value that orders named ACL entries and makes insertion or editing easier.

Correct Answer: D

 

Correct Answer

Answer D is correct because the choice accurately describes Sequence number: A numeric value that orders named ACL entries and makes insertion or editing easier.

Incorrect Answers

Answer A is incorrect because the “Inbound ACL” option describes a different concept: an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

Answer B is incorrect because the “ip access-group” option describes a different concept: the Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

Answer C is incorrect because the “Implicit deny” option describes a different concept: the invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

 

Question 30

For ACE, which statement is accurate?

1. The invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.
2. An individual access control entry within an ACL, containing match criteria and a permit or deny action.
3. An ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.
4. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Incorrect Answers

Answer A is incorrect because the “Implicit deny” option describes a different concept: the invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Answer C is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer D is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

 

Question 31

For Top-down ACL processing, which statement is accurate?

1. ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.
2. The Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.
3. In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.
4. A router evaluates ACL entries in order from the top of the list toward the bottom.

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes a router evaluates ACL entries in order from the top of the list toward the bottom.

Incorrect Answers

Answer A is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer B is incorrect because the “ip access-group” option describes a different concept: the Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

Answer C is incorrect because the “any keyword” option describes a different concept: In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

 

Question 32

For First-match ACL logic, which statement is accurate?

1. The invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.
2. ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.
3. An access control entry that blocks traffic matching its conditions.
4. A router evaluates ACL entries in order from the top of the list toward the bottom.

Correct Answer: B

 

Correct Answer

Answer B is correct because it accurately defines First-match ACL logic. The matching definition is: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Incorrect Answers

Answer A is incorrect because the “Implicit deny” option describes a different concept: the invisible deny statement at the end of an ACL that drops packets not matched by an earlier permit statement.

Answer C is incorrect because the “deny ACE” option describes a different concept: an access control entry that blocks traffic matching its conditions.

Answer D is incorrect because the “Top-down ACL processing” option describes a different concept: a router evaluates ACL entries in order from the top of the list toward the bottom.

 

Question 33

For host keyword, which statement is accurate?

1. In an IPv4 ACL, the host keyword matches one exact IPv4 address and is equivalent to using a 0.0.0.0 wildcard mask for that address.
2. An IPv4 ACL type that primarily matches traffic based on source IPv4 address.
3. An ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.
4. A wildcard mask of 0.0.0.0 requires every address bit to match exactly.

Correct Answer: A

 

Correct Answer

Answer A is correct because the choice accurately describes host keyword: In an IPv4 ACL, the host keyword matches one exact IPv4 address and is equivalent to using a 0.0.0.0 wildcard mask for that address.

Incorrect Answers

Answer B is incorrect because the “Standard ACL” option describes a different concept: an IPv4 ACL type that primarily matches traffic based on source IPv4 address.

Answer C is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer D is incorrect because the “Wildcard 0.0.0.0” option describes a different concept: a wildcard mask of 0.0.0.0 requires every address bit to match exactly.

 

Question 34

For any keyword, which statement is accurate?

1. An IPv4 ACL type that can match source and destination addresses plus protocol and port information.
2. ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.
3. An ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.
4. In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

Correct Answer: D

 

Correct Answer

Answer D is correct because In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

Incorrect Answers

Answer A is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Answer B is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer C is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

 

Question 35

For Wildcard 0.0.0.0, which statement is accurate?

1. A wildcard mask of 0.0.0.0 requires every address bit to match exactly.
2. ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.
3. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.
4. A common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes a wildcard mask of 0.0.0.0 requires every address bit to match exactly.

Incorrect Answers

Answer B is incorrect because the “First-match ACL logic” option describes a different concept: ACL processing stops at the first access control entry that matches a packet, and the associated permit or deny action is applied.

Answer C is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Answer D is incorrect because the “Standard ACL placement” option describes a different concept: a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

 

Question 36

For Standard ACL placement, which statement is accurate?

1. A wildcard mask of 0.0.0.0 requires every address bit to match exactly.
2. A common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.
3. An IPv4 ACL type that can match source and destination addresses plus protocol and port information.
4. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Correct Answer: B

 

Correct Answer

Answer B is correct because it accurately defines Standard ACL placement. The matching definition is: A common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

Incorrect Answers

Answer A is incorrect because the “Wildcard 0.0.0.0” option describes a different concept: a wildcard mask of 0.0.0.0 requires every address bit to match exactly.

Answer C is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Answer D is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

 

Question 37

For Extended ACL placement, which statement is accurate?

1. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.
2. An ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.
3. A common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.
4. A common design guideline is to place extended ACLs relatively close to the source because they can precisely identify source, destination, protocol, and ports.

Correct Answer: D

 

Correct Answer

Answer D is correct because the choice accurately describes Extended ACL placement: A common design guideline is to place extended ACLs relatively close to the source because they can precisely identify source, destination, protocol, and ports.

Incorrect Answers

Answer A is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Answer B is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer C is incorrect because the “Standard ACL placement” option describes a different concept: a common design guideline is to place standard ACLs relatively close to the destination because they match only the source address.

 

Question 38

For ip access-group, which statement is accurate?

1. An individual access control entry within an ACL, containing match criteria and a permit or deny action.
2. The Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.
3. An ACL applied to traffic after the routing decision as packets are about to leave an interface.
4. A named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes the Cisco IOS ip access-group command applies an IPv4 ACL to an interface in the inbound or outbound direction.

Incorrect Answers

Answer A is incorrect because the “ACE” option describes a different concept: an individual access control entry within an ACL, containing match criteria and a permit or deny action.

Answer C is incorrect because the “Outbound ACL” option describes a different concept: an ACL applied to traffic after the routing decision as packets are about to leave an interface.

Answer D is incorrect because the “Named IPv4 ACL” option describes a different concept: a named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.

 

Question 39

For Named IPv4 ACL, which statement is accurate?

1. A named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.
2. An IPv4 ACL type that can match source and destination addresses plus protocol and port information.
3. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.
4. In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes a named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.

Incorrect Answers

Answer B is incorrect because the “Extended ACL” option describes a different concept: an IPv4 ACL type that can match source and destination addresses plus protocol and port information.

Answer C is incorrect because the “TCP and UDP port matching” option describes a different concept: an extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Answer D is incorrect because the “any keyword” option describes a different concept: In an IPv4 ACL, the any keyword matches any IPv4 address and is equivalent to an address of 0.0.0.0 with wildcard 255.255.255.255.

 

Question 40

For TCP and UDP port matching, which statement is accurate?

1. An ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.
2. An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.
3. An ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.
4. A named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.

Correct Answer: B

 

Correct Answer

Answer B is correct because it accurately defines TCP and UDP port matching. The matching definition is: An extended ACL can use TCP or UDP port qualifiers to match application traffic such as HTTP, HTTPS, DNS, or SSH.

Incorrect Answers

Answer A is incorrect because the “Wildcard mask” option describes a different concept: an ACL mask in which 0 bits must match and 1 bits are ignored when comparing addresses.

Answer C is incorrect because the “Inbound ACL” option describes a different concept: an ACL applied to traffic as it enters an interface before the router makes the outbound forwarding decision.

Answer D is incorrect because the “Named IPv4 ACL” option describes a different concept: a named IPv4 ACL is identified by a descriptive name instead of only a number and can use sequence numbers for easier editing.