Cisco Access Control Lists Quiz – CISCONET Training Solutions

Welcome to your Cisco Access Control Lists Quiz

Test score and correct answers provided with the end of quiz review.

Select the statement that correctly describes how an ACL is applied?

only one ACL can be applied per interface

multiple ACL can be applied per interface, inbound or outbound, per Layer 3 protocol

only one ACL can be applied per interface, inbound or outbound, per Layer 3 protocol

only one ACL can be applied per interface, inbound per protocol

None

What IOS command applies a named ACL to filter packets on VTY lines?

ip access-name VTY-ACCESS in

ip access-class VTY-ACCESS in

ip access-list VTY-ACCESS in

ip access-group VTY-ACCESS in

None

What extended ACL will deny Telnet traffic from hosts on subnet 192.168.10.0/24 to any network device?

access-list 100 deny tcp 192.168.10.0 0.0.0.255 any eq 21

access-list 100 deny tcp 192.168.10.0 0.0.0.255 any eq telnet

access-list 100 deny ip host 192.168.10.0 any eq 23

access-list 100 deny tcp host 192.168.10.0 any eq telnet

None

What extended ACL will deny access to all applications on a server?

access-list 100 deny 192.168.0.0 0.0.255.255 host 192.168,3.1 eq

access-list 100 deny tcp 192.168.0.0 0.0.255.255 host 192.168.3.1 eq www

access-list 100 deny ip 192.168.0.0 0.0.255.255 host 192.168.3.1

access-list 100 deny tcp 192.168.0.0 0.0.255.255 host 192.168.3.1

None

Why should you apply a standard ACL near the destination?

performance issues

eliminate wildcard masks

prevent excessive filtering

minimize traffic

None

What is the only incorrect extended ACL that will NOT deny access to web-based applications on a server?

access-list 100 deny tcp host 192.168.1.1 host 192.168.3.1 eq web

access-list 100 deny tcp 192.168.0.0 0.0.255.255 any eq www

access-list 100 deny tcp host 192.168.1.1 host 192.168.3.1 eq www

access-list 100 deny tcp 192.168.0.0 0.0.255.255 host 192.168.3.1 eq 80

None

What extended ACL will deny TFTP traffic only from host 192.168.1.1 to host 192.168.3.1?

access-list 100 deny ip host 192.168.1.1 any eq tftp

access-list 100 deny tcp any any eq tftp

access-list 100 deny udp host 192.168.1.0 any eq tftp

access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 69

access-list 100 deny udp host 192.168.1.1 host 192.168.3.1 any eq tftp

None

What named ACL will deny web-based traffic from subnet 10.10.10.0/27 to all servers?

ip access-list extended http-filter
deny udp 10.10.10.0 0.0.0.127 any eq 80

ip access-list extended http-filter
deny tcp 10.10.10.0 0.0.0.255 any eq www

ip access-list extended http-filter
deny udp 10.10.10.0 0.0.0.15 any eq 80

ip access-list extended http-filter
deny tcp 10.10.10.0 0.0.0.31 any eq 80

None

Select the correctly configured standard ACL to deny all traffic from host 172.33.1.1 to all destinations?

access-list 99 deny host 172.33.1.1
access-list 99 permit any

access list 99 deny host 172.33.1.1
access list 99 permit any any

access-list 99 deny host 172.33.1.1 any
access-list 100 permit any

access-list 1 deny 172.33.1.1
access-list 1 permit any any

None

10.

What is the only extended ACL that will only permit access to web-based applications on a server?

access-list 100 permit tcp 192.168.0.0 0.0.255.255 host 192.168.3.1 eq www

access-list 100 permit tcp 192.168.0.0 0.0.255.255 host 192.168.3.1 eq web

access-list 100 permit tcp 192.168.0.0 0.0.255.255 host 192.168.3.1 eq 8080

access-list 100 permit ip 192.168.0.0 0.0.255.255 host 192.168.3.1 eq 80

None

11.

What extended ACL will permit SSH session from host 192.168.1.1 to any network device?

access-list 100 permit ip host 192.168.1.0 any eq ssh

access-list 100 permit tcp any host 192.168.1.0 eq ssh

access-list 100 permit tcp host 192.168.1.1 host any eq ssh

access-list 100 permit tcp host 192.168.1.1 any eq ssh

None

12.

What number is NOT assignable to a standard ACL?

100

1300

None

13.

What last statement is mandatory for IPv4 extended access lists?

permit any

permit ip any any

permit tcp any any

deny ip any

None

14.

What IOS command applies an extended ACL outbound on an interface?

ip access-list 100 out

ip access-group 100 interface out

access-class 100 out

ip access-group 100 out

None

15.

What is an advantage of named ACLs over numbered ACLs?

easier to manage ACL

additional filtering options

support for IPv4/IPv6 addressing

performance

None

1 out of 15

Time's up