Cisco CCNA Access Control Lists (ACLs) Questions and Answers

Question 1

A network administrator needs to create an ACL that denies FTP traffic from a specific source subnet (192.168.10.0/24) to a specific destination server (10.0.0.5).
Which type of ACL is required for this task?

Accepted Answer

Extended Numbered ACL

Answer

MAC Address ACL

Answer

Standard Numbered ACL

Answer

Reflexive ACL

Question 2

A network administrator needs to use a standard ACL to prevent traffic from the 192.168.1.0/24 subnet from reaching the server subnet 10.10.10.0/24. All other traffic from 192.168.1.0/24 should be permitted to reach other destinations. According to Cisco best practices, where should this ACL be placed?

Accepted Answer

Outbound on the destination router's interface connected to 10.10.10.0/24.

Answer

Inbound on the source router's interface connected to 192.168.1.0/24.

Answer

Outbound on the source router's interface leading towards the destination.

Answer

Inbound on the destination router's interface leading towards the source.

Question 3

An administrator writes the following Access Control Entry (ACE): `access-list 10 permit 192.168.16.0 0.0.15.255`. Which range of IP addresses will be permitted by this statement?

Accepted Answer

192.168.16.0 to 192.168.31.255

Answer

192.168.16.0 to 192.168.16.255

Answer

192.168.0.0 to 192.168.31.255

Answer

192.168.16.0 to 192.168.32.255

Question 4

A network administrator applies the following ACL to the inbound direction of an interface:
`access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 80`
`access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 443`
A user on the 10.1.1.50 host reports that they can access websites but cannot resolve domain names using the company's DNS server at 10.10.10.10. What is the most likely cause of this issue?

Accepted Answer

The DNS traffic is being blocked by the implicit deny at the end of the ACL.

Answer

The ACL is applied in the wrong direction on the interface.

Answer

A named ACL must be used for DNS traffic.

Answer

The source address in the ACL statements is incorrect.

Question 5

A network administrator wants to restrict Telnet and SSH access to a router's virtual terminal (VTY) lines, allowing access only from the management workstation with the IP address 10.0.0.99. Which set of commands correctly accomplishes this?

Accepted Answer

router(config)# access-list 1 permit host 10.0.0.99
router(config)# line vty 0 15
router(config-line)# access-class 1 in

Answer

router(config)# access-list 101 permit ip host 10.0.0.99 any
router(config)# line vty 0 15
router(config-line)# ip access-group 101 in

Answer

router(config)# access-list 1 permit any
router(config)# line vty 0 15
router(config-line)# access-class 10.0.0.99 in

Answer

router(config)# access-list 1 permit host 10.0.0.99
router(config)# interface vty 0 15
router(config-if)# ip access-group 1 in

Question 6

An administrator needs to insert a new rule into an existing, numbered standard ACL (access-list 10). The new rule must permit a specific host (192.168.5.5) and should be evaluated before any other existing rules in the ACL. Which of the following methods should be used to achieve this?

Accepted Answer

Use a sequence number to insert the new permit statement at the beginning of the ACL.

Answer

Use a text editor to copy the ACL, insert the new line at the top, delete the old ACL, and paste the new version.

Answer

Re-enter the entire ACL from the CLI, typing the new permit statement first.

Answer

Add the new permit statement to the end of the ACL and use the `ip access-list resequence` command.

A network administrator needs to create an ACL that denies FTP traffic from a specific source subnet (192.168.10.0/24) to a specific destination server (10.0.0.5).Which type of ACL is required for this task?

A network administrator needs to create an ACL that denies FTP traffic from a specific source subnet (192.168.10.0/24) to a specific destination server (10.0.0.5).
Which type of ACL is required for this task?