5.6 Configure and verify access control lists.
Objective 5.6 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.
Objective title verbatim from the official objectives. Cisco exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Host 10.20.5.9 cannot open an HTTPS session to server 172.16.4.10. List 120 is applied inbound on the SVI facing the host.
Device# show access-lists
Extended IP access list 120
10 deny ip 10.20.0.0 0.0.255.255 any
20 permit tcp host 10.20.5.9 host 172.16.4.10 eq 443
30 permit ip any anyWhy does the session fail?
The concept
An access list is walked top down and evaluation stops at the first match. A later, narrower line is dead code whenever a broader line above it already covers the same packets.
Why this answer
The packet from 10.20.5.9 falls inside 10.20.0.0 0.0.255.255, so line 10 denies it and evaluation ends there. Line 20 sits below that deny and can never be reached, even though it names the exact host, peer and port.
- ALine 30 permits everything unmatched, so the implicit deny at the end is never reached. That would explain a list whose last line is a specific permit.
- BThe wildcard 0.0.255.255 leaves the first two octets fixed, and 10.20.5.9 matches 10.20.0.0. A wildcard of 0.0.0.255 would have narrowed the range to one subnet.
- Correct. Line 10 covers the host and ends the lookup.
- DIOS rewrites the order of standard lists to put host matches on top. List 120 is extended, and extended entries stay in the order they were entered.
Now you: objective 5.6 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 2
List 145 is applied inbound on the routed port facing the WAN.
Device# show access-lists
Extended IP access list 145
10 permit tcp any 192.168.16.0 0.0.7.255 eq 22
20 deny tcp any any eq 23
30 permit udp any host 192.168.20.53 eq 53
40 deny ip any any logWhich traffic does the list permit?
Sample question 2 of 2
A routed port was supposed to filter inbound traffic, but every source still reaches the server behind it.
Device# show running-config interface gigabitethernet1/0/24
interface GigabitEthernet1/0/24
no switchport
ip address 10.5.4.1 255.255.255.0
ip access-group 55 in
Device# show ip access-lists 55
Device#Why is nothing filtered?
That’s 2 of the full CCNA bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
- Cisco: IPv4 ACLs, Security Configuration Guide, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) ↗
- Cisco: IPv4 ACLs, Security Configuration Guide, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) ↗
- Cisco: IPv4 ACLs, Security Configuration Guide, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) ↗