Access Control Lists (Standard and Extended IPv4 ACLs)

63 questions

All types63 Multiple choice32 Multiple select16 Ordering15

A network administrator needs to configure an extended IPv4 access control list (ACL) to implement a specific traffic policy on a Cisco router interface. Arrange the following ACL statements and actions in the correct top-down evaluation order to ensure that host 10.1.1.15 is allowed SSH access to server 172.16.0.5, all other SSH traffic from subnet 10.1.1.0/24 to server 172.16.0.5 is blocked, all other IP traffic from subnet 10.1.1.0/24 is permitted, and unmatched traffic is dropped by default.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places specific permit statements first (permit tcp host 10.1.1.15 host 172.16.0.5 eq 22), followed by broader subnet restrictions (deny tcp 10.1.1.0 0.0.0.255 host 172.16.0.5 eq 22), then general subnet permits (permit ip 10.1.1.0 0.0.0.255 any), and concludes with the automatic implicit deny rule.

Cisco IOS IPv4 access control lists process entries in strict sequential top-down order, stopping processing as soon as a packet matches an Access Control Entry (ACE). Therefore, specific host exceptions must be placed above broader subnet rules. The permit statement for host 10.1.1.15 must be evaluated first so it is not dropped by the subnet-wide SSH deny rule. Placing general subnet permit traffic third allows other protocols from the subnet, and any packet not matching these three lines falls into the automatic implicit deny rule at the bottom.

Step-by-Step Solution

Identify specific host exception rules

Position the permit rule for host 10.1.1.15 SSH traffic at line 1.

Cisco IOS processes ACLs top-down sequentially; specific host permissions must precede subnet-wide blocks to prevent false matches.

Identify broader subnet restriction rules

Position the deny rule for SSH traffic from subnet 10.1.1.0/24 to server 172.16.0.5 at line 2.

This blocks all other hosts in 10.1.1.0/24 from SSH access to 172.16.0.5 after the allowed host exception is processed.

Identify general permit rules for remaining subnet traffic

Position the permit IP rule for 10.1.1.0/24 to any destination at line 3.

This allows non-SSH traffic from 10.1.1.0/24 to pass after specific SSH security checks have been evaluated.

Account for default ACL termination behavior

Acknowledge the implicit deny ip any any statement at the end of the evaluation list.

Cisco IOS appends an unseen implicit deny statement to the end of every ACL, dropping any packet that does not match preceding lines.

Key Concept

Cisco IPv4 ACL sequential top-down evaluation logic and implicit deny enforcement

Question 2Question →

A network administrator applies a standard IPv4 access control list containing a single line, `access-list 10 permit 192.168.1.0 0.0.0.255`, to a router interface. What happens to incoming packets originating from host 10.0.0.5?

The packets are dropped due to the implicit deny statement at the end of the access list.

The packets are permitted because access lists permit all unlisted traffic by default.

The packets are permitted because there is no explicit deny statement configured in the list.

The packets are forwarded to the default gateway interface for further ACL evaluation.

Show answer & explanation

Answer: The packets are dropped due to the implicit deny statement at the end of the access list.

Answer

The packets are dropped due to the implicit deny statement at the end of the access list.

In Cisco IOS IPv4 Access Control Lists, an unwritten 'implicit deny' statement exists at the end of every list. Any traffic that does not match one of the explicit permit statements will be dropped by default when it reaches the end of the ACL.

Step-by-Step Solution

Evaluate the incoming packet source address against the ACL statements.

The packet source IP 10.0.0.5 is compared against the first entry: `permit 192.168.1.0 0.0.0.255`.

ACL entries are processed sequentially from top to bottom.

Determine if the packet matches the explicit entry.

Host 10.0.0.5 does not belong to the 192.168.1.0/24 network, so it does not match.

The wildcard mask 0.0.0.255 restricts matching strictly to the 192.168.1.0/24 subnet.

Apply the default action at the end of the list.

The packet hits the invisible `deny ip any any` (or `deny any`) statement at the bottom of the ACL and is dropped.

Every Cisco IPv4 ACL automatically ends with an implicit deny all clause.

Key Concept

Implicit Deny Clause in Cisco IPv4 ACLs

Question 3Question →

A network engineer is configuring a named extended IPv4 Access Control List (ACL) on a Cisco IOS router to implement a multi-tier security policy. The ACL must process rules top-down to meet the following requirements:
1. Permit SSH access ( $TCP$ port 22) from the specific management host $192.168.100.50$ to the core server interface $10.1.1.1$ .
2. Deny all other IP traffic originating from the Management subnet ( $192.168.100.0/24$ ) destined for the Server Farm subnet ( $10.1.0.0/16$ ).
3. Permit ICMP echo traffic from the Operations subnet ( $172.16.20.0/24$ ) to any destination.
4. Permit all remaining IPv4 traffic across all subnets.

In what order should the access-list statements be configured from top (first statement executed) to bottom (last statement executed) to ensure proper sequential traffic processing without unintended dropping of packets?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of ACL statements from top to bottom is: 1) permit tcp host 192.168.100.50 host 10.1.1.1 eq 22, 2) deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255, 3) permit icmp 172.16.20.0 0.0.0.255 any echo, 4) permit ip any any.

Cisco Access Control Lists evaluate matching statements in a strict top-down sequential order. Once a packet matches an Access Control Entry (ACE), processing stops for that packet. Therefore, more specific rules (such as permitting TCP port 22 from host

192.168.100.50

to host

10.1.1.1

) must appear before broader rules (such as denying

192.168.100.0/24

10.1.0.0/16

). Finally, 'permit ip any any' must be placed at the end to prevent unmentioned traffic from being dropped by the implicit deny rule.

Step-by-Step Solution

Identify specific host permit exception

Recognize that 'permit tcp host 192.168.100.50 host 10.1.1.1 eq 22' is a specific exception to a broader subnet blocking rule.

Cisco ACLs process rules sequentially from top to bottom and stop at the first match. Specific host rules must always precede general subnet rules that overlap with them.

Place broader subnet deny rule

Position 'deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255' immediately after the specific permit rule.

This blocks all other hosts in

192.168.100.0/24

from accessing any hosts in

10.1.0.0/16

Add specific subnet feature permits

Add 'permit icmp 172.16.20.0 0.0.0.255 any echo' to allow Operations ICMP traffic.

Matches the requirement for ICMP echo traffic from

172.16.20.0/24

Add explicit catch-all permit rule

Append 'permit ip any any' at the very bottom.

Without this rule, Cisco IOS ACLs end with an implicit 'deny ip any any' clause, which would drop all other traffic across the network.

Key Concept

Cisco IPv4 Extended ACL sequential top-down evaluation and implicit deny override.

Question 4Question →

A network engineer is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco IOS router. Place the following ACL entries in the correct top-down execution sequence (from top/first line to bottom/last line) to ensure that SSH traffic from management host 192.168.1.10 to server 10.1.1.50 is allowed, HTTP traffic from subnet 192.168.1.0/24 to server 10.1.1.50 is allowed, and all remaining IPv4 traffic to server 10.1.1.50 is denied.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order from top to bottom is: first, the specific host SSH permit statement ('access-list 105 permit tcp host 192.168.1.10 host 10.1.1.50 eq 22'); second, the subnet HTTP permit statement ('access-list 105 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.50 eq 80'); and third, the explicit deny statement ('access-list 105 deny ip any host 10.1.1.50').

Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a matching rule is found. To function correctly, specific rules (single host 192.168.1.10 on port 22) must come first, followed by broader rules (subnet 192.168.1.0/24 on port 80), and finally any explicit deny statement intended to block remaining traffic to host 10.1.1.50.

Step-by-Step Solution

Identify the most specific traffic requirement.

SSH traffic (TCP port 22) from single host 192.168.1.10 to server 10.1.1.50 is identified.

Cisco ACLs process sequentially from top to bottom, stopping at the first match. More specific entries must be positioned above general ones.

Identify the broader permitted traffic requirement.

HTTP traffic (TCP port 80) from the entire 192.168.1.0/24 subnet to server 10.1.1.50 is placed next.

This permits web traffic for the broader subnet while allowing host 192.168.1.10 to have already matched its SSH permit entry on line 1.

Place the specific deny statement for remaining traffic destined to the server.

The entry 'access-list 105 deny ip any host 10.1.1.50' is placed after all permit entries.

Placing a deny rule above any permit rules would cause matching traffic to be dropped prematurely.

Key Concept

Cisco IPv4 ACL Top-Down Sequential Evaluation

Question 5Question →

A network engineer must construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy requirements for traffic originating from subnet $10.20.1.0/24$ destined for the server subnet $172.16.10.0/24$ :

1. Host $10.20.1.5$ must be permitted to access SSH (TCP port 22) on the server subnet.
2. Host $10.20.1.5$ must be denied all other TCP traffic to the server subnet.
3. All other hosts on subnet $10.20.1.0/24$ must be permitted HTTP (TCP port 80) access to the server subnet.
4. All remaining IPv4 traffic from subnet $10.20.1.0/24$ to the server subnet must be dropped.

Arrange the ACL statements in the correct top-down sequence (from top/sequence 10 to bottom/sequence 40) to properly enforce this security policy.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of ACL statements from top to bottom is: permit tcp host 10.20.1.5 172.16.10.0 0.0.0.255 eq 22, followed by deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255, followed by permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80, and finally deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255.

Cisco IPv4 Access Control Lists evaluate statements sequentially from top to bottom until a first match occurs. To enforce host-specific exceptions within a larger subnet, more specific rules (host 10.20.1.5 permits and denies) must precede general rules (subnet 10.20.1.0/24 permits and denies). Placing the SSH permit for host 10.20.1.5 first guarantees SSH functionality. Placing the TCP deny for host 10.20.1.5 second prevents host 10.20.1.5 from matching the subnet HTTP permit rule placed third. Finally, the subnet-wide IP deny statement catches all other traffic from the subnet.

Step-by-Step Solution

Identify the most specific exception rule for host 10.20.1.5.

The permit statement for SSH (TCP port 22) for host 10.20.1.5 must be evaluated first.

Cisco ACLs process statements top-down until a match occurs. Placing host 10.20.1.5's SSH permit rule at the top ensures SSH traffic is not dropped by subsequent deny rules.

Block all remaining TCP traffic for host 10.20.1.5.

Place 'deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255' second.

Host 10.20.1.5 belongs to the

10.20.1.0/24

subnet. If the general HTTP permit rule for the subnet were placed above this statement, host 10.20.1.5 would accidentally be permitted HTTP access.

Permit HTTP traffic for the rest of the

10.20.1.0/24

subnet.

Place 'permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80' third.

Since host 10.20.1.5 has already matched earlier statements for its allowed/denied TCP traffic, remaining hosts in

10.20.1.0/24

reach this step and are permitted HTTP access.

Catch all remaining IPv4 traffic from the source subnet.

Place 'deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255' last.

This explicitly drops any non-HTTP traffic from

10.20.1.0/24

172.16.10.0/24

before reaching the implicit deny any clause.

Key Concept

Top-Down Sequential Processing and Specific-to-General Ordering in IPv4 Extended ACLs

Question 6Question →

A network administrator configures an IPv4 extended numbered Access Control List (ACL 110) on a Cisco IOS router interface to prevent web traffic on TCP port 80 from reaching an internal web server at 192.168.10.50/32. The administrator enters the following single configuration command:

`R1(config)# access-list 110 deny tcp 10.1.1.0 0.0.0.255 host 192.168.10.50 eq 80`

ACL 110 is then applied inbound on the GigabitEthernet0/0 interface serving subnet 10.1.1.0/24. Immediately after applying the ACL, users on the 10.1.1.0/24 network report that all network communication is blocked, including ICMP pings, SSH access, and traffic destined for other subnets. Which configuration oversight is causing all traffic from subnet 10.1.1.0/24 to be dropped?

The ACL lacks an explicit permit statement, causing all unlisted IPv4 traffic to be dropped by the default implicit deny any clause at the end of the list.

The router processes forwarding decisions using longest prefix match prior to ACL evaluation, which overrides the single deny statement for non-matching destinations.

The extended access-list configuration omitted the overload keyword necessary to maintain stateful translations for multi-host subnets.

A floating static route configured on GigabitEthernet0/0 takes precedence over ACL rules due to its lower administrative distance.

Show answer & explanation

Answer: The ACL lacks an explicit permit statement, causing all unlisted IPv4 traffic to be dropped by the default implicit deny any clause at the end of the list.

Answer

The ACL lacks an explicit permit statement, causing all unlisted IPv4 traffic to be dropped by the default implicit deny any clause at the end of the list.

Every standard and extended Cisco IPv4 ACL concludes with an unwritten, invisible implicit deny clause ('deny ip any any'). When an ACL contains only a deny statement, any traffic that does not meet the specific deny criteria drops through to the implicit deny clause and is blocked. To fix this, a network administrator must configure a subsequent permit statement (such as 'access-list 110 permit ip any any') to allow all other traffic to pass through.

Step-by-Step Solution

Analyze the sequential evaluation of IPv4 Access Control Lists in Cisco IOS.

Cisco ACLs process statements sequentially from top to bottom until a match occurs.

If a packet matches a specific permit or deny statement, no further statements in the list are evaluated.

Examine the default behavior when a packet reaches the end of an ACL without matching any explicit statement.

An invisible 'deny ip any any' statement exists at the end of every IPv4 ACL.

Traffic that does not match an explicit permit rule is automatically dropped.

Evaluate the configured ACL 110 against non-HTTP traffic (e.g., ICMP, SSH, or web traffic to other hosts).

Non-HTTP traffic does not match the single 'deny tcp ... eq 80' rule and falls through to the implicit deny statement.

To allow remaining legitimate traffic, an explicit 'access-list 110 permit ip any any' rule must be appended after the deny statement.

Key Concept

Implicit Deny Any Clause in IPv4 ACLs

Question 7Question →

A network administrator is creating an IPv4 extended named Access Control List (ACL) called `MGMT_FILTER` to enforce security policies on a router interface. The policy mandates the following conditions:
- Permit HTTP ( $80$ ) and SSH ( $22$ ) traffic originating from subnet $192.168.1.0/24$ destined to a specific management server at $10.0.5.10$ .
- Deny all other IP traffic from subnet $192.168.1.0/24$ destined to subnet $10.0.5.0/24$ .
- Allow all remaining IPv4 traffic traversing the interface to reach other destinations.

Which TWO statements or configuration requirements are necessary to correctly fulfill this policy? (Select TWO.)

Select all that apply

Place `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 80` and `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 22` prior to the subnet deny entry.

Add an explicit `permit ip any any` entry at the end of the access list sequence.

Omit any statement at the end of the ACL because the default implicit clause automatically permits all unmatched IPv4 traffic.

Use the wildcard mask `0.0.0.0` for subnet

192.168.1.0/24

and wildcard mask `0.0.0.255` for host

10.0.5.10

Show answer & explanation

Answer: Place `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 80` and `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 22` prior to the subnet deny entry.; Add an explicit `permit ip any any` entry at the end of the access list sequence.

Answer

The policy requires placing specific TCP permit statements for HTTP and SSH to host 10.0.5.10 before the broader subnet deny rule, and appending an explicit 'permit ip any any' at the end of the ACL to override the default implicit deny.

The solution requires two essential steps: placing specific permit statements for HTTP and SSH to host 10.0.5.10 ahead of the broader subnet deny rule (so specific allowed traffic is processed first), and adding an explicit 'permit ip any any' statement at the bottom of the ACL to override the invisible implicit 'deny ip any any' clause that would otherwise block all other traffic.

Step-by-Step Solution

Evaluate Top-Down Sequential Processing

Specific host rules must be placed above general subnet rules.

Cisco IOS processes ACL entries sequentially. If the subnet deny rule for 10.0.5.0/24 were placed first, traffic to 10.0.5.10 on ports 80 and 22 would match the deny rule and be dropped before hitting the permit rules.

Account for Implicit Deny Behavior

An explicit 'permit ip any any' line must be added to the end of the ACL.

All Cisco ACLs end with an invisible implicit 'deny ip any any' statement. To permit traffic destined for other subnets outside 10.0.5.0/24, an explicit permit all rule is required at the end.

Key Concept

Access Control List (ACL) Evaluation Order and Implicit Deny Behavior

Question 8Question →

A network administrator configures a single line standard IPv4 Access Control List (ACL) on a Cisco IOS router as follows:

`access-list 10 permit 192.168.1.50 0.0.0.0`

This ACL is applied inbound on interface GigabitEthernet0/0. What happens to incoming IP traffic with a source IPv4 address of 192.168.1.20 when it reaches interface GigabitEthernet0/0?

The traffic is dropped because of the invisible implicit deny any clause at the end of the ACL.

The traffic is permitted because standard ACLs allow all traffic by default unless explicitly denied.

The traffic is forwarded because single-statement ACLs only filter the specified host and ignore all other hosts.

The traffic bypasses interface processing because standard IPv4 ACLs can only be applied outbound.

Show answer & explanation

Answer: The traffic is dropped because of the invisible implicit deny any clause at the end of the ACL.

Answer

The traffic is dropped because of the implicit deny any clause at the end of the access control list.

In Cisco IOS, every Access Control List ends with an unwritten, invisible implicit deny clause (`deny ip any any` or `deny any`). Because the packet from source address 192.168.1.20 does not match the explicit permit rule for host 192.168.1.50, it falls through to the end of the list and is dropped.

Step-by-Step Solution

Examine the configured access control list entries.

The ACL contains only one explicit permit line matching source host address 192.168.1.50.

Traffic from source IP 192.168.1.20 does not match this permit statement.

Evaluate default Cisco IOS ACL sequential processing behavior.

Every IPv4 ACL ends with an unwritten 'deny ip any any' (or 'deny any') statement.

Since the packet does not match any explicit permit line, it matches the implicit deny statement.

Determine the forwarding disposition of the packet.

The packet from source 192.168.1.20 is silently dropped by the router.

Implicit deny drops all traffic that is not explicitly permitted.

Key Concept

ACL Implicit Deny Clause

Question 9Question →

A network technician configures a standard IPv4 access control list on a Cisco router using the command `access-list 5 permit host 172.16.10.15` and applies it inbound on an interface. What happens when host 172.16.10.20 sends traffic into that interface?

The traffic is dropped because of the implicit deny clause at the end of the access control list.

The traffic is permitted because it originates from the same IP subnet as the permitted host.

The traffic is permitted by default until an explicit deny statement is added to the configuration.

The traffic is forwarded because standard access lists only drop traffic when configured with specific deny statements.

Show answer & explanation

Answer: The traffic is dropped because of the implicit deny clause at the end of the access control list.

Answer

The traffic is dropped because of the implicit deny clause at the end of the access control list.

Every Cisco IPv4 access control list automatically ends with an implicit deny statement (such as `deny any`). When host 172.16.10.20 sends packets into the interface, the router evaluates the packet against the explicit rule permitting host 172.16.10.15. Because the source address does not match, processing reaches the end of the list where the implicit deny drops the packet.

Step-by-Step Solution

Inspect the explicit configuration line in the access control list.

The ACL contains only `access-list 5 permit host 172.16.10.15`.

Cisco IOS evaluates ACL entries sequentially against incoming packets.

Compare incoming packet source IP address 172.16.10.20 to the configured rule.

The IP address 172.16.10.20 does not match 172.16.10.15.

The 'host' keyword implies a wildcard mask of 0.0.0.0, matching only one exact address.

Evaluate the default behavior when no explicit rules match.

The packet falls through to the hidden implicit deny entry at the end of the ACL and is dropped.

Every IPv4 ACL in Cisco IOS automatically ends with an implicit `deny ip any` clause.

Key Concept

ACL Implicit Deny Clause

Question 10Question →

A network administrator configures a Cisco IOS router to restrict access to a financial database server ( $192.168.50.100/32$ ) from the HR subnet ( $192.168.10.0/24$ ). All other traffic between subnets must be permitted. The administrator applies the following access list in the inbound direction on interface GigabitEthernet0/0:

text
ip access-list extended FILTER_HR
deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100

After applying this ACL, users report that all traffic targeting any server in the $192.168.50.0/24$ network is being dropped, including traffic from non-HR subnets. Which configuration change will resolve the issue and permit intended traffic?

Append the statement `permit ip any any` to the end of the `FILTER_HR` access list.

Modify the deny statement to use a wildcard mask of `0.0.255.255` instead of `0.0.0.255`.

Re-apply the ACL to interface GigabitEthernet0/0 in the outbound direction using `ip access-group FILTER_HR out`.

Change the protocol from `ip` to `tcp` and append `eq 80` to restrict only Web traffic.

Show answer & explanation

Answer: Append the statement `permit ip any any` to the end of the `FILTER_HR` access list.

Answer

Appending the statement `permit ip any any` to the end of the `FILTER_HR` access list resolves the issue by explicitly permitting all traffic that does not match the deny rule.

Every IPv4 ACL in Cisco IOS ends with an invisible, mandatory `deny ip any any` statement. When an ACL contains only `deny` statements, any packet that does not match those deny statements reaches the bottom of the list and is dropped. Appending `permit ip any any` allows all other IP traffic to pass through as intended.

Step-by-Step Solution

Analyze the existing ACL configuration and traffic processing logic.

The current ACL contains only a single statement: `deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100`.

Cisco IOS Access Control Lists append an unwritten, implicit `deny ip any any` statement at the very end of every access list.

Trace packet evaluation for non-matching traffic.

Traffic from HR targeting other servers, or traffic from non-HR subnets, fails to match the `deny` line and falls through to the implicit deny at the end of the list, resulting in all traffic being dropped.

Top-down sequential processing drops any packet that reaches the end of an ACL without matching an explicit `permit` line.

Determine the necessary configuration addition.

Adding `permit ip any any` at the end ensures that traffic not matching the specific host deny rule is allowed through.

An explicit permit statement overrides the implicit deny clause for all remaining traffic.

Key Concept

Access Control List Sequential Processing and the Implicit Deny Any Clause

Question 11Question →

A network engineer is configuring IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which of the following statements regarding the operation and behavior of IPv4 ACLs are correct? (Select TWO.)

Select all that apply

Standard IPv4 ACLs filter network traffic based solely on the packet source IPv4 address.

An implicit deny statement at the end of an IPv4 ACL automatically drops any packet that does not match an explicit permit statement.

If a packet does not match any explicit permit line in an ACL, the router automatically permits the packet through the interface.

Extended IPv4 ACLs should be applied as close to the destination device as possible to preserve network bandwidth.

Show answer & explanation

Answer: Standard IPv4 ACLs filter network traffic based solely on the packet source IPv4 address.; An implicit deny statement at the end of an IPv4 ACL automatically drops any packet that does not match an explicit permit statement.

Answer

Standard IPv4 ACLs filter traffic based solely on the source IP address, and an implicit deny statement drops any packet that does not match an explicit permit entry.

Standard IPv4 ACLs examine only packet source IP addresses. Additionally, every IPv4 ACL includes an unwritten implicit deny clause at the end of the rule list that drops any traffic not matched by explicit permit rules.

Step-by-Step Solution

Analyze standard IPv4 ACL criteria

Standard IPv4 ACLs only evaluate the source IP address.

Standard ACLs (numbered 1-99 and 1300-1999) cannot inspect destination addresses or layer 4 ports.

Evaluate default termination behavior of IPv4 ACLs

Unmatched packets encounter an implicit deny and are dropped.

Cisco IOS enforces security by defaulting to deny all traffic that is not explicitly permitted.

Key Concept

Standard vs Extended IPv4 ACL capabilities and the implicit deny feature

Question 12Question →

A network engineer configures an extended IPv4 access control list named `CORP_SEC` on a Cisco IOS router to regulate access from the branch network ( $10.40.0.0/16$ ) to an internal web server ( $192.168.50.10/32$ ). The security requirement specifies that host $10.40.4.15$ in the IT subnet ( $10.40.4.0/22$ ) must be allowed HTTPS access (TCP port 443) to the web server, while all other traffic from $10.40.0.0/16$ to the $192.168.50.0/24$ network must be denied. Additionally, non-matching traffic must reach external destinations freely.

The engineer enters the following configuration commands:

text
ip access-list extended CORP_SEC
10 deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255
20 permit tcp host 10.40.4.15 host 192.168.50.10 eq 443
30 permit ip any any
!
interface GigabitEthernet0/0/1
ip access-group CORP_SEC in

During testing, HTTPS traffic from $10.40.4.15$ to $192.168.50.10$ is unexpectedly dropped. Which modification corrects the access control list logic to satisfy all requirements?

Reorder the ACL so sequence 20 is processed before sequence 10, while leaving sequence 30 in place.

Change sequence 10 to `deny ip 10.40.0.0 0.0.3.255 192.168.50.0 0.0.0.255` to narrow the denied source subnet.

Remove sequence 30 so that the ACL relies on the default implicit deny clause for unmatched traffic.

Apply `ip access-group CORP_SEC out` on interface GigabitEthernet0/0/1 instead of inbound.

Show answer & explanation

Answer: Reorder the ACL so sequence 20 is processed before sequence 10, while leaving sequence 30 in place.

Answer

Reorder the access control list so sequence 20 is evaluated prior to sequence 10, retaining sequence 30 at the bottom.

Cisco IOS Access Control Lists process statements sequentially from top to bottom. The first statement that matches a packet determines the outcome, terminating further evaluation. In the original configuration, sequence 10 broad-denied all traffic from

10.40.0.0/16

192.168.50.0/24

. Because host

10.40.4.15

is part of

10.40.0.0/16

, its HTTPS packets matched sequence 10 first and were dropped before reaching sequence 20. Reordering sequence 20 above sequence 10 allows the specific HTTPS flow to be permitted first. Retaining sequence 30 (`permit ip any any`) ensures non-matching traffic to other networks is not blocked by the implicit deny any clause at the end of the list.

Step-by-Step Solution

Analyze top-down sequential processing logic of Cisco IPv4 ACLs.

Sequence 10 `deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255` matches all IP packets originating from

10.40.0.0/16

heading to

192.168.50.0/24

Host

10.40.4.15

resides within

10.40.0.0/16

. Therefore, HTTPS packets match line 10 first and are immediately dropped before reaching line 20.

Determine placement of specific versus general rules.

The specific exception (`permit tcp host 10.40.4.15 host 192.168.50.10 eq 443`) must precede the broad deny rule (`deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255`).

Top-down execution terminates search upon the first matching entry. Placing specific permit statements above broader deny statements ensures granular access controls work.

Verify requirement for non-matching traffic handling.

Sequence 30 `permit ip any any` must remain at the end of the ACL.

Without `permit ip any any`, all traffic going to external destinations outside

192.168.50.0/24

would hit the implicit `deny ip any any` at the bottom of the ACL and be dropped.

Key Concept

Top-Down Sequential Processing and Placement Strategy in Extended IPv4 ACLs

Estimated Time:2m 0s

Question 13Question →

An administrator configures an IPv4 access control list on a router interface containing only the single entry `access-list 15 permit host 172.16.10.5`. What action will the router take when a packet originating from host 172.16.10.20 arrives on this interface?

The packet is dropped because of the unwritten implicit deny statement at the end of the ACL.

The packet is permitted because standard ACLs only drop traffic that matches an explicit deny statement.

The packet is forwarded to the logging buffer for administrator review before being permitted.

The packet is returned to the source host with an administrative block ICMP message.

Show answer & explanation

Answer: The packet is dropped because of the unwritten implicit deny statement at the end of the ACL.

Answer

The packet is dropped because of the unwritten implicit deny statement at the end of the ACL.

Every Cisco IPv4 ACL ends with an invisible implicit deny statement (`deny any`). Because the packet from host 172.16.10.20 does not match the single permit rule for host 172.16.10.5, it reaches the end of the list and is dropped.

Step-by-Step Solution

Evaluate the packet against the ACL entries in sequential top-down order.

The packet source IP (172.16.10.20) is compared to line 1 (permit host 172.16.10.5), resulting in no match.

Host 172.16.10.20 is not equal to 172.16.10.5.

Proceed to the end of the access control list when no explicit match occurs.

The packet encounters the default invisible implicit deny clause (`deny any`).

Every Cisco IOS IPv4 ACL automatically terminates with an implicit deny all traffic statement.

Determine final packet disposition.

The router drops the packet.

Traffic failing to match any permit statement is dropped by the implicit deny.

Key Concept

Implicit Deny Any in IPv4 Access Control Lists

Estimated Time:45s

Question 14Question →

A network administrator is configuring an IPv4 extended named access control list (ACL) on a Cisco router interface to implement security controls for the host subnet $10.50.1.0/24$ . The ACL must satisfy the following traffic policies:

1. Allow ICMP echo requests from $10.50.1.0/24$ strictly to the default gateway at $10.50.1.1$ .
2. Allow HTTPS access from $10.50.1.0/24$ to the internal application server at $192.168.20.45$ .
3. Explicitly deny all other IPv4 traffic originating from $10.50.1.0/24$ destined to the internal server subnet $192.168.20.0/24$ .
4. Permit all remaining outbound traffic from $10.50.1.0/24$ to any other network destination.

Which two ACL entries must be placed in the access list to achieve this exact behavior without blocking general Internet access? (Select two.)

Select all that apply

permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443

permit ip 10.50.1.0 0.0.0.255 any

deny ip 10.50.1.0 0.0.0.255 any

permit ip 10.50.1.0 0.0.0.255 192.168.20.0 0.0.0.255

Show answer & explanation

Answer: permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443; permit ip 10.50.1.0 0.0.0.255 any

Answer

The correct options are 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' and 'permit ip 10.50.1.0 0.0.0.255 any'.

The correct configuration requires allowing TCP port 443 traffic to the specific host 192.168.20.45 first. Following the explicit block of all other IP traffic to 192.168.20.0/24, an explicit permit ip entry from the source network to 'any' destination is mandatory to prevent the default implicit deny clause from blocking general Internet and external traffic.

Step-by-Step Solution

Analyze extended ACL processing order rules.

Cisco IOS ACLs process entries sequentially from top to bottom until the first match occurs.

Specific permit rules must precede broader deny rules to ensure target traffic is allowed.

Construct the rule for HTTPS access to the application server.

The entry 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' correctly permits SSL/TLS traffic to port 443 of the target server.

Requirements demand permitting HTTPS specifically to 192.168.20.45.

Address general outbound connectivity while maintaining subnet restrictions.

After specifying 'deny ip 10.50.1.0 0.0.0.255 192.168.20.0 0.0.0.255', the rule 'permit ip 10.50.1.0 0.0.0.255 any' must be appended.

Without an explicit permit statement at the end of the ACL, the invisible default 'implicit deny ip any any' clause drops all traffic destined for other locations.

Key Concept

ACL Sequential Evaluation and Implicit Deny Handling

Question 15Question →

A network technician configures the following named IPv4 extended Access Control List (ACL) on a Cisco IOS router to restrict access from the Sales subnet ( $192.168.20.0/24$ ) to an internal web server ( $10.2.2.80$ ):

`ip access-list extended RESTRICT_SALES`
` deny tcp 192.168.20.0 0.0.0.255 host 10.2.2.80 eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 443`

The ACL is applied outbound on interface GigabitEthernet0/1 facing the internal network server segment. Following application, host $192.168.20.45$ can no longer resolve domain names using the internal DNS server at $10.2.2.53$ (UDP port 53) or receive DHCP lease updates. Which statement correctly explains why this non-HTTP traffic is blocked?

The unlisted UDP and ICMP traffic matches the implicit deny all IPv4 traffic rule appended to the end of the ACL processing sequence.

Extended ACLs automatically drop all UDP packets when applied outbound unless an explicit standard ACL permits the protocol inbound on the ingress interface.

The deny tcp statement implicitly converts the entire access list into a protocol-specific filter that suppresses all UDP socket connections.

The router routes UDP traffic to the null interface because the wildcard mask 0.0.0.255 covers host addresses rather than transport layer protocols.

Show answer & explanation

Answer: The unlisted UDP and ICMP traffic matches the implicit deny all IPv4 traffic rule appended to the end of the ACL processing sequence.

Answer

The unlisted UDP and ICMP traffic matches the implicit deny all IPv4 traffic rule appended to the end of the ACL processing sequence.

In Cisco IOS ACL processing, statements are evaluated sequentially from top to bottom. If a packet does not match any explicit permit or deny entry in the access list, it falls through to the invisible implicit deny entry at the end of the ACL ('deny ip any any'). Because the list only explicitly permits TCP traffic on ports 80 and 443, non-TCP traffic such as UDP DNS requests fails all explicit entries and is dropped by the implicit deny.

Step-by-Step Solution

Analyze the sequential processing of the configured extended IPv4 ACL entries.

Line 1 denies TCP traffic to host 10.2.2.80 on port 80. Line 2 permits TCP traffic to any destination on port 80. Line 3 permits TCP traffic to any destination on port 443.

Cisco IOS ACL entries are evaluated in strict top-down order until a match occurs.

Evaluate how UDP traffic (such as DNS on UDP port 53) is evaluated against the rules.

UDP traffic fails to match Line 1 (TCP), Line 2 (TCP), and Line 3 (TCP).

Protocol matching in extended ACLs requires the packet protocol field to match the rule's specified protocol.

Determine the final action taken when no explicit rule matches.

The packet encounters the unwritten implicit 'deny ip any any' at the end of the ACL list and is dropped.

All Cisco ACLs conclude with an implicit deny all clause that drops any traffic not explicitly permitted by a preceding rule.

Key Concept

Implicit Deny Clause in IPv4 ACLs

Question 16Question →

A network administrator applies the following standard IPv4 access control list (ACL) inbound on a router interface:

`access-list 10 permit 192.168.1.0 0.0.0.255`

A host with the IPv4 address `192.168.2.50` attempts to send traffic through this interface. What action will the router take on this packet?

The router drops the packet because it matches the implicit deny statement at the end of the ACL.

The router permits the packet because no explicit deny statement was configured in the ACL.

The router forwards the packet to the default gateway for further inspection.

The router prompts the sending host for authentication before making a forwarding decision.

Show answer & explanation

Answer: The router drops the packet because it matches the implicit deny statement at the end of the ACL.

Answer

The router drops the packet because it matches the implicit deny statement at the end of the ACL.

Cisco IOS IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any configured rule, it reaches the final unwritten entry: the implicit deny (deny ip any). Because the source IP 192.168.2.50 is not in the 192.168.1.0/24 subnet specified in the single permit line, it is silently dropped by this implicit deny feature.

Step-by-Step Solution

Evaluate the packet source IPv4 address against the ACL entries.

The packet source address 192.168.2.50 does not match the permit rule for network 192.168.1.0/24.

Standard ACL 10 only matches host IP addresses falling within the 192.168.1.0 to 192.168.1.255 range.

Apply default ACL processing logic when no explicit entries match.

The packet reaches the bottom of the ACL and hits the implicit deny clause.

All Cisco IPv4 ACLs end with an unwritten 'deny ip any' rule that drops any traffic not explicitly permitted.

Key Concept

Access Control List (ACL) Implicit Deny Clause

Estimated Time:45s

Question 17Question →

A network engineer must configure an IPv4 extended access control list (ACL 105) on a Cisco IOS router to enforce security policies for traffic originating from the internal subnet ( $10.1.1.0/24$ ) destined for an application server at $10.2.2.10$ :

1. Allow host $10.1.1.50$ administrative SSH access (TCP port 22) to server $10.2.2.10$ .
2. Prevent all other hosts in the $10.1.1.0/24$ subnet from accessing server $10.2.2.10$ via SSH.
3. Allow all hosts in the $10.1.1.0/24$ subnet web access (TCP port 80) to server $10.2.2.10$ .
4. Explicitly block all remaining IP traffic from $10.1.1.0/24$ to server $10.2.2.10$ .

In what order should the network engineer place the ACL statements from top to bottom to ensure the policy is correctly enforced?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The ACL statements must be placed from top to bottom in the sequence: 1) access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22, 2) access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22, 3) access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80, and 4) access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10.

Cisco IOS Access Control Lists enforce policies based on top-down, first-match evaluation logic. Once a packet matches an ACL line's source, destination, protocol, and port criteria, the router executes the action (permit or deny) and ignores all subsequent entries. To properly allow host 10.1.1.50 to access SSH while denying SSH to the rest of the 10.1.1.0/24 subnet, the host permit rule must appear first. Next, the subnet SSH deny rule blocks all other SSH attempts. Following that, the HTTP permit rule allows web traffic for the subnet. Finally, the broad IP deny statement catches any remaining traffic types from the subnet.

Step-by-Step Solution

Analyze top-down evaluation mechanics in Cisco IOS IPv4 ACLs.

Cisco IOS ACL entries are processed sequentially in top-down order until the first matching line is hit, at which point packet evaluation stops.

More specific exception rules must precede general or broader range rules to prevent premature match execution.

Place the specific host SSH permit statement first.

'access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22' is placed at position 1.

Host 10.1.1.50 is an IP within subnet 10.1.1.0/24. If the subnet SSH deny rule came first, 10.1.1.50 would match the subnet rule and be denied.

Place the subnet SSH deny statement second.

'access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22' is placed at position 2.

This guarantees that all other SSH packets originating from 10.1.1.0/24 (excluding 10.1.1.50) are dropped before subsequent permit lines are evaluated.

Place the subnet HTTP permit statement third.

'access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80' is placed at position 3.

This permits HTTP port 80 traffic for all hosts in the subnet after non-authorized SSH traffic has already been blocked.

Place the subnet broad IP deny statement fourth.

'access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10' is placed at position 4.

This catches and drops any remaining IP protocols from subnet 10.1.1.0/24 to server 10.2.2.10.

Key Concept

Cisco IOS ACL Top-Down Sequential First-Match Processing

Question 18Question →

A network administrator is reviewing the fundamental operation of standard IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which two statements correctly describe the operational characteristics of standard IPv4 ACLs?

Select all that apply

Standard IPv4 ACLs filter network traffic based solely on the source IPv4 address.

Traffic that does not match any explicit permit or deny rule in the ACL is dropped by an implicit deny entry.

Unmatched packets are automatically permitted and forwarded out the interface by default.

Standard IPv4 ACLs inspect Layer 4 TCP and UDP port numbers to restrict specific application traffic.

Show answer & explanation

Answer: Standard IPv4 ACLs filter network traffic based solely on the source IPv4 address.; Traffic that does not match any explicit permit or deny rule in the ACL is dropped by an implicit deny entry.

Answer

The correct statements are that standard IPv4 ACLs filter traffic based strictly on source IPv4 addresses, and that unmatched packets are dropped due to the implicit deny statement at the end of the list.

Standard IPv4 ACLs make forwarding or dropping decisions based exclusively on the packet's source IPv4 address. Additionally, any traffic that does not match an explicit rule in the list is dropped automatically by the default implicit deny clause at the end of the ACL.

Step-by-Step Solution

Identify the filtering criteria capability of standard IPv4 ACLs.

Standard IPv4 ACLs examine only the source address field within the IPv4 packet header.

Standard ACL syntax and logic lack fields to evaluate destination IP addresses, transport protocols, or port numbers.

Analyze default ACL evaluation behavior for unmatched packets.

Every Cisco ACL concludes with an implicit 'deny ip any' rule.

If a packet is evaluated against all explicit ACL statements without a match, it hits the implicit deny statement at the end and is discarded.

Key Concept

Standard IPv4 ACL Filtering Scope and Implicit Deny Mechanism

Question 19Question →

A network administrator applies an extended IPv4 Access Control List (ACL) containing only a single rule to an interface: `access-list 100 permit tcp host 192.168.1.10 host 10.0.0.5 eq 80`. What happens when a host with IP address 192.168.1.11 attempts to send HTTP traffic to 10.0.0.5?

The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

The traffic is permitted because there is no explicit deny statement configured in the ACL.

The traffic is forwarded by default because ACLs only inspect source IP address 192.168.1.10.

The traffic triggers a logging notification on the router before being allowed through the interface.

Show answer & explanation

Answer: The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

Answer

The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

Every Cisco IPv4 Access Control List ends with an invisible implicit deny statement (implicit deny ip any any). Because the single configured line only permits traffic from 192.168.1.10, any packet coming from 192.168.1.11 fails to match rule 1 and is dropped by the implicit deny clause.

Step-by-Step Solution

Evaluate the incoming packet details against the ACL rule.

Host 192.168.1.11 does not match source IP host 192.168.1.10 in line 1.

The configured line specifically permits traffic only from host 192.168.1.10.

Proceed to subsequent lines in the ACL.

The packet hits the unwritten implicit deny statement at the end of the list.

All Cisco IOS IPv4 ACLs end with an implicit 'deny ip any any' rule.

Determine the forwarding decision.

The router drops the packet from host 192.168.1.11.

Traffic that fails to match any explicit permit line is denied.

Key Concept

Implicit Deny in IPv4 Access Control Lists

Question 20Question →

A network administrator configures the following IPv4 extended named Access Control List (ACL) on a Cisco IOS router to control access to an internal application server at IP address 192.168.50.10:

text
ip access-list extended APP_FILTER
10 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 80
20 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 443
30 deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10
40 permit ip host 10.10.20.5 host 192.168.50.10

The ACL is applied outbound on GigabitEthernet0/1. An administrator attempts an SSH connection (TCP port 22) from management host 10.10.20.5 to the application server (192.168.50.10), while a user on host 10.10.20.100 attempts a web connection (TCP port 80) to the same server.

Which statement accurately describes how the router processes these two traffic flows?

The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

The SSH flow from 10.10.20.5 is permitted by sequence 40, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

The SSH flow from 10.10.20.5 is denied by the implicit deny clause, while the HTTP flow from 10.10.20.100 is denied by sequence 30.

Both the SSH flow from 10.10.20.5 and the HTTP flow from 10.10.20.100 are denied by sequence 30.

Show answer & explanation

Answer: The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

Answer

The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

Cisco IOS Access Control Lists process statements sequentially in top-down numerical order. For HTTP traffic (port 80) originating from 10.10.20.100, sequence 10 matches the subnet source 10.10.20.0/24, destination host 192.168.50.10, and TCP port 80, allowing the flow immediately. For SSH traffic (port 22) originating from 10.10.20.5, sequences 10 and 20 fail to match due to destination port mismatches (80 and 443). Sequence 30 specifies protocol 'ip', which encompasses all Layer 4 protocols (including TCP/22), matching host 10.10.20.5 within the 10.10.20.0/24 subnet and dropping the packet. Sequence 40 is never reached for host 10.10.20.5 because sequence 30 matches first.

Step-by-Step Solution

Evaluate the HTTP flow (Source: 10.10.20.100, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 80) against sequence 10.

Sequence 10 permits TCP traffic from 10.10.20.0/24 to host 192.168.50.10 on port 80. Match found; processing stops and traffic is permitted.

Top-down evaluation stops immediately at the first matching entry.

Evaluate the SSH flow (Source: 10.10.20.5, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 22) against sequence 10 and 20.

Port 22 does not match port 80 (sequence 10) or port 443 (sequence 20). Evaluation moves to sequence 30.

Extended ACLs require all specified criteria (protocol, source, destination, port) to match.

Evaluate the SSH flow against sequence 30 (deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10).

Host 10.10.20.5 is within 10.10.20.0/24, destination is 192.168.50.10, and 'ip' matches all IP protocols including TCP. Match found; traffic is denied.

Sequence 30 catches all remaining IP traffic from the subnet before sequence 40 can ever be reached.

Key Concept

Top-Down Sequential Processing in Cisco IPv4 Extended ACLs

Page 1 / 4Next

Access Control Lists (Standard and Extended IPv4 ACLs)

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept