Objective 5.6200-301

5.6 Configure and verify access control lists.

Objective 5.6 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.

Objective title verbatim from the official objectives. Cisco exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Security FundamentalsHard

Host 10.20.5.9 cannot open an HTTPS session to server 172.16.4.10. List 120 is applied inbound on the SVI facing the host.

Device# show access-lists
Extended IP access list 120
    10 deny ip 10.20.0.0 0.0.255.255 any
    20 permit tcp host 10.20.5.9 host 172.16.4.10 eq 443
    30 permit ip any any

Why does the session fail?

Correct.

The concept

An access list is walked top down and evaluation stops at the first match. A later, narrower line is dead code whenever a broader line above it already covers the same packets.

Why this answer

The packet from 10.20.5.9 falls inside 10.20.0.0 0.0.255.255, so line 10 denies it and evaluation ends there. Line 20 sits below that deny and can never be reached, even though it names the exact host, peer and port.

  • ALine 30 permits everything unmatched, so the implicit deny at the end is never reached. That would explain a list whose last line is a specific permit.
  • BThe wildcard 0.0.255.255 leaves the first two octets fixed, and 10.20.5.9 matches 10.20.0.0. A wildcard of 0.0.0.255 would have narrowed the range to one subnet.
  • Correct. Line 10 covers the host and ends the lookup.
  • DIOS rewrites the order of standard lists to put host matches on top. List 120 is extended, and extended entries stay in the order they were entered.
Read the sourceCisco: IPv4 ACLs, Security Configuration Guide, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches)
Source-cited
aclextended-acltroubleshooting

Now you: objective 5.6 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 2

Security FundamentalsHard

List 145 is applied inbound on the routed port facing the WAN.

Device# show access-lists
Extended IP access list 145
    10 permit tcp any 192.168.16.0 0.0.7.255 eq 22
    20 deny tcp any any eq 23
    30 permit udp any host 192.168.20.53 eq 53
    40 deny ip any any log

Which traffic does the list permit?

Sample question 2 of 2

Security FundamentalsModerate

A routed port was supposed to filter inbound traffic, but every source still reaches the server behind it.

Device# show running-config interface gigabitethernet1/0/24
interface GigabitEthernet1/0/24
 no switchport
 ip address 10.5.4.1 255.255.255.0
 ip access-group 55 in
Device# show ip access-lists 55
Device#

Why is nothing filtered?

That’s 2 of the full CCNA bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Fundamentals