ACL practice questions with answers
Fifteen free ACL practice questions with explained answers on wildcard masks, rule order, the implicit deny, placement and verification. An access control list (ACL) is an ordered list of permit and deny statements that a Cisco router applies to packets entering or leaving an interface. ACLs are tested on the CCNA 200-301 and appear conceptually on CompTIA Network+ N10-009. The questions assume IPv4 ACLs on Cisco IOS.
How to use these questions
Attempt each question before opening the answer. For every list, read top to bottom and stop at the first match, and remember that an implicit deny closes every ACL. Note the constraint words: “inbound”, “closest to”, “only” and “originated by the router” decide several answers. The rules behind them are in ACLs explained.
Warm-up: wildcards, types and first match
Question 1. Which range of addresses does the statement permit 192.168.10.64 0.0.0.31 match?
- A. 192.168.10.64 to 192.168.10.127
- B. 192.168.10.0 to 192.168.10.31
- C. 192.168.10.64 to 192.168.10.95
- D. 192.168.10.64 to 192.168.10.94
Show answer
Answer: C
A wildcard bit of 0 must match and a bit of 1 is ignored. 0.0.0.31 leaves the last 5 bits free, so the statement matches 32 addresses starting at .64, which is 192.168.10.64 to 192.168.10.95. The range .64 to .127 would need a wildcard of 0.0.0.63. The range .0 to .31 starts at the wrong address. The range .64 to .94 is not a block of a power of two.
Question 2. The requirement is to block HTTP (TCP port 80) from the 10.5.0.0/16 network to one web server and to permit all other traffic. What type of ACL is needed?
- A. An extended ACL
- B. A standard ACL
- C. An access-class on the VTY lines
- D. A reflexive ACL
Show answer
Answer: A
The requirement names a destination, a protocol and a port, and only an extended ACL can match these. A standard ACL matches only the source address, so it cannot tell web traffic from other traffic. A VTY access-class is for management sessions to the router itself. A reflexive ACL is not needed, because nothing in the requirement depends on session state.
Question 3. A packet matches both line 30 and line 70 of an ACL. Line 30 denies it and line 70 permits it. What happens to the packet?
- A. It is permitted, because the later entry replaces the earlier one
- B. It is denied, because the first match decides
- C. It is permitted, because the more specific entry wins
- D. It is denied only if the implicit deny also applies
Show answer
Answer: B
A router processes ACL entries from top to bottom and acts on the first match, so line 30 applies and the packet is dropped. Line 70 is never evaluated for this packet. The more specific line does not win, as the position decides. The router does not combine the two results.
Question 4. A standard ACL must stop the 192.168.50.0/24 network from reaching the server subnet 10.20.0.0/16 while leaving that network free to reach everything else. Where should the ACL be placed?
- A. Inbound on the interface connected to 192.168.50.0/24
- B. On the VTY lines of the source router
- C. Anywhere in the network, because placement does not matter
- D. Close to the destination, on the interface towards 10.20.0.0/16
Show answer
Answer: D
A standard ACL matches only the source address. Placed near the source it would block 192.168.50.0/24 from everything, not just the server subnet, so it goes as close as possible to the destination. The outbound interface towards 10.20.0.0/16 is such a place. Placing it inbound near the source blocks too much. The VTY lines control only management access to the router. Placement does matter, because a standard ACL cannot be selective about the destination.
Question 5. Which statement is equivalent to permit ip 10.1.1.5 0.0.0.0 any?
- A. permit ip host 10.1.1.5 any
- B. permit ip any any
- C. permit ip 10.1.1.5 0.0.0.255 any
- D. permit ip any host 10.1.1.5
Show answer
Answer: A
A wildcard of 0.0.0.0 requires every bit to match, so it matches the single address 10.1.1.5, and the host keyword is the shorthand for it: permit ip host 10.1.1.5 any. Using any in place of the address would match all sources. A wildcard of 0.0.0.255 would match the whole /24. The statement with the destination host does not match the original, because the original matches any destination.
Scenarios: order, syntax and application
Question 6. An ACL contains, in this order: 10 deny tcp 10.2.0.0 0.0.255.255 any, then 20 permit tcp host 10.2.1.4 any eq 443, then 30 permit ip any any. Host 10.2.1.4 cannot open HTTPS sites. How is this fixed?
- A. Delete line 30
- B. Place the permit for 10.2.1.4 before line 10
- C. Change port 443 to port 80 in line 20
- D. Replace it with a standard ACL
Show answer
Answer: B
Line 10 denies every TCP packet from 10.2.0.0/16, and 10.2.1.4 is inside that network, so line 20 is never reached. Placing the host exception before the broader deny fixes it, for example by inserting it with a sequence number lower than 10. Removing line 30 would make it worse. Changing 443 to 80 does not help, as the deny matches before port numbers are considered. The ACL is a valid list, so recreating it as standard would lose the port match.
Question 7. Which extended ACL entry permits HTTPS from the 192.168.1.0/24 LAN to the server 10.9.9.9?
- A. permit udp 192.168.1.0 0.0.0.255 host 10.9.9.9 eq 443
- B. permit tcp 192.168.1.0 0.0.0.255 host 10.9.9.9 eq 80
- C. permit tcp 192.168.1.0 0.0.0.255 host 10.9.9.9 eq 443
- D. permit tcp host 10.9.9.9 192.168.1.0 0.0.0.255 eq 443
Show answer
Answer: C
HTTPS uses TCP port 443, the source is the LAN with wildcard 0.0.0.255 and the destination is the host: permit tcp 192.168.1.0 0.0.0.255 host 10.9.9.9 eq 443. Using udp does not match TCP segments. Port 80 is HTTP, not HTTPS. The fourth option has source and destination reversed, so it would match traffic from the server to the LAN.
Question 8. A named ACL called LAN-FILTER must filter packets that enter the router from the LAN on GigabitEthernet0/0. Which command applies it?
- A. ip access-group LAN-FILTER out
- B. access-class LAN-FILTER in
- C. ip access-list LAN-FILTER in
- D. ip access-group LAN-FILTER in
Show answer
Answer: D
An ACL is applied to an interface with ip access-group followed by a direction. Packets entering the router from the LAN are inbound on that interface, so the command is ip access-group LAN-FILTER in under GigabitEthernet0/0. Using out would filter packets leaving the interface towards the LAN. The access-class command applies to VTY lines. The ip access-list command creates the list but does not attach it to an interface.
Question 9. Remote management of a router must be limited to the host 10.0.0.50 through the VTY lines, using access list 10, which permits only that host. Which configuration applies it?
- A. line vty 0 15, then access-class 10 in
- B. line vty 0 15, then ip access-group 10 in
- C. line console 0, then access-class 10 in
- D. An extended ACL on every interface
Show answer
Answer: A
Access to the VTY lines is limited with access-class under line vty, using a standard ACL that matches the permitted source: line vty 0 15 with access-class 10 in. The ip access-group command applies to interfaces, not lines. An extended ACL on every interface would also filter transit traffic, which is not required. Applying an ACL on the console line leaves the VTY lines unprotected.
Question 10. Named extended ACL BRANCH has entries 10 and 20. A new permit must be evaluated between them. What is the correct way to add it?
- A. Delete the ACL and recreate it with the new line first
- B. Enter the new permit without a sequence number
- C. Enter the new permit with sequence number 15
- D. Apply a second ACL on the same interface in the same direction
Show answer
Answer: C
Entries in a named ACL carry sequence numbers, and a new entry with a number between the existing ones, such as 15 permit …, is inserted at that position in ACL configuration mode. Deleting and recreating the whole list works but is not necessary and briefly changes the filtering. Adding a line without a number appends it at the end, after line 20. Applying a second ACL to the interface in the same direction is not possible, because only one ACL per protocol, per direction, per interface is allowed.
Edge cases and traps: implicit deny, verification and scope
Question 11. An administrator applies an inbound ACL on the LAN interface that contains only the entry 10 deny tcp any any eq 23. Afterwards users report that no traffic passes at all. What explains this?
- A. Port 23 is HTTP, so the entry blocks web traffic only
- B. The implicit deny drops everything else, so permit ip any any is needed
- C. An inbound ACL blocks all traffic until it is applied outbound
- D. The deny entry cannot use the eq keyword
Show answer
Answer: B
Every ACL ends with an implicit deny of all traffic. With only one deny entry, all other traffic matches nothing and is dropped by the implicit deny. Adding permit ip any any as the last line allows everything except telnet. The entry itself is valid, and telnet uses TCP port 23. ACLs are not stateful, but that is not the cause here. The direction is correct for traffic entering the router from the LAN.
Question 12. Which wildcard mask matches exactly the subnet 10.4.8.0/21?
- A. 0.0.0.255
- B. 255.255.248.0
- C. 0.0.15.255
- D. 0.0.7.255
Show answer
Answer: D
A /21 mask is 255.255.248.0, and subtracting each octet from 255 gives the wildcard 0.0.7.255. The statement 10.4.8.0 0.0.7.255 matches 10.4.8.0 to 10.4.15.255. 0.0.0.255 matches only 10.4.8.0 to 10.4.8.255. 0.0.15.255 would match 10.4.0.0 to 10.4.15.255, a /20, which is too wide. 255.255.248.0 is the subnet mask, not the wildcard.
Question 13. Which command shows which ACL is applied, and in which direction, on the interface GigabitEthernet0/1?
- A. show running-config interface GigabitEthernet0/1
- B. show ip route
- C. show access-lists
- D. show ip protocols
Show answer
Answer: A
The command show running-config interface GigabitEthernet0/1 displays the ip access-group lines, each with the ACL name and the direction in or out. The command show access-lists lists the ACLs and their entries and match counters, but not where they are applied. The command show ip route shows the routing table. The command show ip protocols describes routing protocol settings.
Question 14. An outbound extended ACL on a router interface denies icmp any any. An administrator logged into the router pings a host through that interface. What is the result?
- A. The ping fails, because the ACL drops the echo request
- B. The ping can succeed, because the ACL does not filter router-originated traffic
- C. The ping fails, because of the implicit deny
- D. The router refuses to send the ping until the ACL is removed
Show answer
Answer: B
Outbound ACLs on an interface do not filter traffic that the router itself originates, so the echo request leaves the router and the ping can succeed. The same ACL would drop ICMP that the router forwards on behalf of other hosts. The ping does not fail because of the ACL, the implicit deny does not apply to packets the router generates itself, and the router does not refuse to send it.
Question 15. An inbound ACL has these entries: 10 deny ip 192.168.10.64 0.0.0.31 any, 20 permit ip 192.168.10.0 0.0.0.127 any, 30 deny ip any any. What happens to a packet from 192.168.10.100?
- A. Denied by line 10
- B. Denied by the implicit deny
- C. Permitted by line 20
- D. Denied by line 30
Show answer
Answer: C
Line 10 matches .64 to .95 only, and .100 is outside that range, so it does not match. Line 20 has a wildcard of 0.0.0.127, which matches .0 to .127, and .100 falls in it, so the packet is permitted by line 20 and processing stops. It is not denied by line 10, which does not match. It never reaches line 30 or the implicit deny.
Where to go next
Review the rules and the worked list in ACLs explained. Wildcard masks rely on block sizes, so continue with the subnetting practice problems, and try the NAT practice questions, where an ACL selects the addresses to translate. Then take the free 20-question CCNA practice test and read the multiple-choice exam tips.