FirstTry

Objective 5.6

200-301

Configure and verify access control lists.

Objective 5.6 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.

Objective title verbatim from the official objectives. Cisco exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

5-6Security Fundamentals

Host 10.20.5.9 cannot open an HTTPS session to server 172.16.4.10. List 120 is applied inbound on the SVI facing the host.

Device# show access-listsExtended IP access list 120    10 deny ip 10.20.0.0 0.0.255.255 any    20 permit tcp host 10.20.5.9 host 172.16.4.10 eq 443    30 permit ip any any

Why does the session fail?

The implicit deny at the end of list 120 drops the trafficLine 30 permits everything unmatched, so the implicit deny at the end is never reached. That would explain a list whose last line is a specific permit.
The wildcard 0.0.255.255 in entry 10 excludes host 10.20.5.9The wildcard 0.0.255.255 leaves the first two octets fixed, and 10.20.5.9 matches 10.20.0.0. A wildcard of 0.0.0.255 would have narrowed the range to one subnet.
Entry 10 matches the host first, so entry 20 never runsCorrect · your answerCorrect. Line 10 covers the host and ends the lookup.
The device reorders host matches in list 120 to the topIOS rewrites the order of standard lists to put host matches on top. List 120 is extended, and extended entries stay in the order they were entered.

Correct.

Checked against cisco.com, August 2026

Concept

An access list is walked top down and evaluation stops at the first match. A later, narrower line is dead code whenever a broader line above it already covers the same packets.

Why C

The packet from 10.20.5.9 falls inside 10.20.0.0 0.0.255.255, so line 10 denies it and evaluation ends there. Line 20 sits below that deny and can never be reached, even though it names the exact host, peer and port.

Source

One by one, the device tests packets against the conditions in an access list. The first match determines whether the device accepts or rejects the packet. Because the device stops testing after the first match, the order of the conditions is critical.

Cisco: IPv4 ACLs, Security Configuration Guide, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches), checked August 2026
#acl#extended-acl#troubleshooting

Now you: objective 5.6 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

5-6Security Fundamentals

List 145 is applied inbound on the routed port facing the WAN.

Device# show access-listsExtended IP access list 145    10 permit tcp any 192.168.16.0 0.0.7.255 eq 22    20 deny tcp any any eq 23    30 permit udp any host 192.168.20.53 eq 53    40 deny ip any any log

Which traffic does the list permit?

Sample question 2 of 3

5-6Security Fundamentals

A routed port was supposed to filter inbound traffic, but every source still reaches the server behind it.

Device# show running-config interface gigabitethernet1/0/24interface GigabitEthernet1/0/24 no switchport ip address 10.5.4.1 255.255.255.0 ip access-group 55 inDevice# show ip access-lists 55Device#

Why is nothing filtered?

Sample question 3 of 3

5-6Security Fundamentals

An ISP writes an ACL on customer-facing interfaces. Which sources should it deny to stop spoofing?

That’s 3 of the full CCNA bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Fundamentals