CertAce

CCNA practice test / CCNA ACL Practice Questions

CCNA ACL Practice Questions

10 original questions, each with an explanation for every option.

Start the questions Or start the free trial

ACLs look easy on paper. A few lines, permit or deny, done. Then the exam hands you a wildcard like 0.0.7.255, an ACL applied outbound on the wrong interface, and four answers that all sound reasonable. I failed my first CCNA attempt with 58%, and the lesson that stuck was simple: knowing the theory is not enough if you read too fast. With ACLs, the only safe way is to walk the packet through the list, line by line, every time.

I work as a network engineer now, and the ACL mistakes I see in real configs are the same ones the exam tests: a deny-only list that blocks everything through the implicit deny, a specific permit placed under a broader deny, a standard ACL put next to the source and cutting off traffic nobody meant to touch. In production those mistakes cause outages; on the exam they cost points.

The 10 questions below are written from scratch for CCNA 200-301. They cover wildcard math, standard vs extended syntax and numbering, first-match processing, placement, inbound vs outbound, access-class on VTY lines, reading show access-lists output and inserting entries with sequence numbers. Each choice has its own explanation, including why the wrong ones are wrong, because that is where the learning happens.

Adrian, network engineer and founder of CertAce.

How to work these questions

  1. Identify the ACL type first: standard (1-99, 1300-1999, or `standard` named) matches only source; extended (100-199, 2000-2699, or `extended` named) matches protocol, source, destination and ports.
  2. Convert every wildcard to a range before reading the answers: block size = wildcard octet + 1, and the base must be a multiple of that size.
  3. Walk the entries top-down with the exact packet from the question and stop at the first match. If nothing matches, the answer is the implicit deny.
  4. Check where and in which direction the ACL is applied, from the router's point of view. In = arriving on that interface, out = leaving it. Ask what source address the packets have at that point.
  5. For extended entries, check that each port operator sits after the right address: after the source it matches the source port, after the destination it matches the destination port.
  6. For placement questions, remember: standard close to the destination, extended close to the source.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

  1. Question 1 of 10Calculation

    You need one ACL entry that matches source addresses 10.20.30.64 through 10.20.30.79 and nothing else. Which address and wildcard mask pair should you use?

    1. 10.20.30.64 0.0.0.16
    2. 10.20.30.64 0.0.0.15
    3. 10.20.30.64 255.255.255.240
    4. 10.20.30.64 0.0.0.31
    Show the answer

    Answer: B

    Wildcard = 255.255.255.255 minus the subnet mask. A /28 block of 16 addresses uses 0.0.0.15, and the block must start on a multiple of 16 (64 is 4 x 16). Always check both size and alignment.

    • A. 0.0.0.16 frees only bit value 16 in the last octet, so it matches just two addresses: 10.20.30.64 and 10.20.30.80.
    • B. The range is 16 addresses (64-79) aligned on a /28 boundary, and 0.0.0.15 leaves the low 4 bits of the last octet free, so it matches exactly .64 to .79.
    • C. That is the subnet mask, not the wildcard. As a wildcard it ignores the first three octets and the high nibble of the last one, matching any address whose last octet ends in binary 0000.
    • D. 0.0.0.31 frees 5 bits and matches 32 addresses, 10.20.30.64 through 10.20.30.95, which is twice the required range.

  2. Question 2 of 10Calculation

    An ACL contains the entry `permit 172.16.8.0 0.0.7.255`. Which range of source addresses does this entry match?

    1. 172.16.8.0 through 172.16.8.255
    2. 172.16.8.0 through 172.16.11.255
    3. 172.16.8.0 through 172.16.15.255
    4. 172.16.0.0 through 172.16.7.255
    Show the answer

    Answer: C

    Read the wildcard octet by octet: 7 in the third octet means 8 consecutive values starting at the base (8 to 15). 0.0.7.255 is the wildcard for a /21. The base 8 is a multiple of 8, so the block is aligned.

    • A. That would be 172.16.8.0 0.0.0.255, a single /24. The 7 in the third octet widens the match to eight /24s.
    • B. That range of 4 third-octet values would need wildcard 0.0.3.255 (a /22).
    • C. 0.0.7.255 frees the low 3 bits of the third octet (8 values) and the whole fourth octet, so it matches 172.16.8.0 to 172.16.15.255, a /21 block starting at 8.
    • D. The address field is 172.16.8.0, and the third octet's bit value 8 is a must-match bit, so the 172.16.0.x - 172.16.7.x range is excluded.

  3. Question 3 of 10Exhibit

    The ACL in the exhibit is applied inbound on R1's Internet-facing interface. A host at 198.51.100.7 opens an HTTPS session (TCP 443) to 192.168.10.20. What happens to the first packet?

    R1# show access-lists
Extended IP access list WEB-IN
    10 permit tcp any host 192.168.10.20 eq www (152 matches)
    20 permit tcp any host 192.168.10.20 eq 443 (1048 matches)
    30 deny ip 198.51.100.0 0.0.0.255 any (37 matches)
    40 permit icmp any any echo-reply (12 matches)
    1. It is permitted by sequence 40 because ICMP is allowed back in.
    2. It is denied by sequence 30 because the host belongs to 198.51.100.0/24.
    3. It is permitted by sequence 20.
    4. It is denied by the implicit deny at the end of the list.
    Show the answer

    Answer: C

    ACLs are evaluated top-down and stop at the first match. A deny for a subnet placed below a broader permit never catches traffic the permit already matched. If you want 198.51.100.0/24 blocked entirely, that deny must come before the permits.

    • A. Sequence 40 matches only ICMP echo-reply messages. An HTTPS packet is TCP and was already permitted by sequence 20.
    • B. Sequence 30 would match, but ACLs stop at the first match. Sequence 20 is checked first and already permits the packet.
    • C. Processing is top-down and sequence 20 (any source, destination host 192.168.10.20, TCP 443) is the first entry that matches, so the packet is permitted and later entries are never evaluated.
    • D. The implicit deny only applies when no explicit entry matches. Here sequence 20 matches.

  4. Question 4 of 10Exhibit

    You wanted to stop hosts in 192.168.20.0/24 from reaching the server LAN behind R1's GigabitEthernet0/1. After applying the configuration in the exhibit, no host from any subnet can reach the server LAN. What is the correct fix?

    R1(config)# access-list 10 deny 192.168.20.0 0.0.0.255
R1(config)# interface GigabitEthernet0/1
R1(config-if)# description Server LAN 10.1.99.0/24
R1(config-if)# ip access-group 10 out
    1. Change the entry to `access-list 10 deny 192.168.20.0 0.0.0.0`.
    2. Apply the list inbound instead: `ip access-group 10 in`.
    3. Change the entry to `access-list 10 deny 192.168.20.0 255.255.255.0`.
    4. Add `access-list 10 permit any` after the deny entry.
    Show the answer

    Answer: D

    Every ACL ends with an invisible deny any. A list that contains only deny entries blocks all traffic on the interface where it is applied. Always finish a 'block a few' ACL with an explicit permit.

    • A. Wildcard 0.0.0.0 matches only the single address 192.168.20.0, and the implicit deny would still block everyone else.
    • B. Inbound on G0/1 would check traffic coming from the servers, and with only a deny entry it would still drop everything through the implicit deny.
    • C. 255.255.255.0 used as a wildcard would match the wrong addresses. The original 0.0.0.255 is already correct for a /24.
    • D. The ACL has only a deny, so every other packet hits the implicit deny any at the end. Adding a permit any lets all other subnets through while 192.168.20.0/24 stays blocked.

  5. Question 5 of 10Scenario

    R1 connects LAN 10.1.50.0/24 on G0/0 and uplinks to R2 on G0/1. R2 connects to the Internet and to R3. R3 connects the server LAN 10.1.99.0/24 on G0/2. Hosts in 10.1.50.0/24 must be blocked from the server LAN but must still reach the Internet and all other LANs. You must use a standard ACL. Where should you apply it?

    1. R1 G0/0, inbound
    2. R3 G0/2, inbound
    3. R3 G0/2, outbound
    4. R1 G0/1, outbound
    Show the answer

    Answer: C

    Standard ACLs see only the source address, so put them near the destination to avoid collateral blocking. Extended ACLs can match destination and port, so they go near the source to drop unwanted traffic early. Direction is always from the router's point of view.

    • A. A standard ACL matches only the source, so here it would drop everything from 10.1.50.0/24, including Internet traffic.
    • B. Inbound on G0/2 checks packets arriving from the servers, whose source is 10.1.99.x, so the deny never matches traffic from 10.1.50.0/24.
    • C. Standard ACLs go as close to the destination as possible. Outbound on the server-facing interface, the source-only match affects just traffic heading into 10.1.99.0/24.
    • D. All traffic from 10.1.50.0/24 leaves R1 through G0/1, so the subnet would also lose the Internet and every other LAN.

  6. Question 6 of 10Config

    Hosts in 192.168.30.0/24 must be allowed to query the DNS server 192.168.99.53. The ACL will be applied inbound on the router interface facing 192.168.30.0/24. Which entry correctly matches their DNS queries?

    1. access-list 10 permit udp 192.168.30.0 0.0.0.255 host 192.168.99.53 eq 53
    2. access-list 110 permit udp 192.168.30.0 0.0.0.255 eq 53 host 192.168.99.53
    3. access-list 110 permit udp host 192.168.99.53 192.168.30.0 0.0.0.255 eq 53
    4. access-list 110 permit udp 192.168.30.0 0.0.0.255 host 192.168.99.53 eq 53
    Show the answer

    Answer: D

    Extended ACL order: action, protocol, source + wildcard, optional source port, destination + wildcard, optional destination port. A port operator applies to the address right before it. Use 100-199 or 2000-2699 for numbered extended lists.

    • A. 10 is in the standard range (1-99), and standard ACLs cannot match protocol, destination or ports, so IOS rejects this syntax.
    • B. `eq 53` placed after the source matches the source port. Client queries use a random high source port and destination port 53, so this entry does not match them.
    • C. Source and destination are swapped. This matches packets from the DNS server to the clients with destination port 53, not the clients' queries.
    • D. Extended syntax is protocol, source, [source port], destination, [destination port]. This matches UDP from the client subnet to host 192.168.99.53 with destination port 53.

  7. Question 7 of 10Config

    Only administrators in 10.10.10.0/27 should be able to open SSH sessions to R1's VTY lines. Which two configuration steps accomplish this? (Choose two.)

    1. line vty 0 15, then access-class 5 in
    2. line vty 0 15, then access-class 5 out
    3. line vty 0 15, then ip access-group 5 in
    4. access-list 5 permit 10.10.10.0 0.0.0.31
    5. access-list 5 permit 10.10.10.0 0.0.0.32
    Show the answer

    Answer: A and D

    To restrict management access, build a standard ACL with the allowed sources and apply it with `access-class <acl> in` under `line vty`. It covers traffic to the router itself, not traffic through it. Apply it to all VTY lines in use, or users can land on an unprotected line.

    • A. `access-class ... in` under the VTY lines filters incoming Telnet/SSH sessions to the router itself.
    • B. `access-class out` restricts sessions the router opens from a VTY line to other devices, not sessions coming in to the router.
    • C. `ip access-group` is an interface command. On VTY lines you use `access-class`.
    • D. A /27 holds 32 addresses, so the wildcard is 0.0.0.31. A standard ACL is enough because only the source address matters, and the implicit deny drops everyone else.
    • E. 0.0.0.32 is not a contiguous wildcard for a /27. It frees only bit value 32 and matches just 10.10.10.0 and 10.10.10.32.

  8. Question 8 of 10Exhibit

    Based on the exhibit, host 10.8.40.25 must now be allowed to reach 172.20.1.10 over any IP protocol. The rest of 10.8.40.0/24 must stay blocked from that server, and no other behavior should change. Which entry should you add under `ip access-list extended BRANCH-OUT`?

    R2# show ip access-lists BRANCH-OUT
Extended IP access list BRANCH-OUT
    10 deny tcp 10.8.0.0 0.0.255.255 any eq telnet (4 matches)
    20 deny ip 10.8.40.0 0.0.0.255 host 172.20.1.10 (61 matches)
    30 permit ip 10.8.0.0 0.0.255.255 any (8920 matches)
    1. 25 permit ip host 10.8.40.25 host 172.20.1.10
    2. 15 permit ip host 10.8.40.25 host 172.20.1.10
    3. 35 permit ip host 10.8.40.25 host 172.20.1.10
    4. no 20 (remove the deny for the subnet)
    Show the answer

    Answer: B

    In named ACLs, and numbered ACLs edited in named mode, you can insert an entry by giving it a sequence number between existing ones. Plain `access-list` or entries without a number are appended at the end. A more specific permit must sit above the broader deny it is an exception to.

    • A. Sequence 25 is evaluated after sequence 20, which already denies the host's traffic to 172.20.1.10. The new entry would never be hit.
    • B. Sequence 15 sits between 10 and 20, so the host's traffic is permitted before sequence 20 can deny it. Telnet from the host is still denied by sequence 10, so existing policy is unchanged.
    • C. Sequence 35 is evaluated after both sequence 20 (deny) and 30 (permit). It would have no effect.
    • D. Removing sequence 20 lets the whole 10.8.40.0/24 subnet reach the server, which breaks the requirement.

  9. Question 9 of 10Scenario

    R1's GigabitEthernet0/0 connects to LAN 192.168.1.0/24. You configure the ACL in the exhibit so LAN users can browse the web and use DNS, and nothing else. Right after applying it, LAN users lose all connectivity through R1. What is the cause?

    access-list 120 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 120 permit tcp 192.168.1.0 0.0.0.255 any eq 443
access-list 120 permit udp 192.168.1.0 0.0.0.255 any eq 53
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip access-group 120 out
    1. The ACL is applied in the wrong direction. It should be `ip access-group 120 in` on G0/0.
    2. The wildcard 0.0.0.255 does not match a /24 subnet, so no LAN host matches the permit entries.
    3. The ACL needs the `established` keyword so return traffic can reach the LAN.
    4. A matching ACL is required inbound on the Internet-facing interface to permit the return traffic.
    Show the answer

    Answer: A

    Inbound and outbound are from the router's point of view: in = arriving on that interface, out = leaving it. An ACL written with the LAN as the source must be applied inbound on the LAN-facing interface. When everything breaks right after applying an ACL, check the direction and the implicit deny first.

    • A. Outbound on G0/0 the ACL checks packets going toward the LAN, whose source is a remote server, not 192.168.1.0/24. Nothing matches, so the implicit deny drops all of it. Applied inbound, it filters the users' requests as intended.
    • B. 0.0.0.255 is exactly the wildcard for a /24 and matches 192.168.1.0 through 192.168.1.255.
    • C. When the ACL is applied inbound on the LAN interface, replies leave G0/0 outbound and are not checked by this ACL, so `established` is not needed.
    • D. No ACL exists on the Internet-facing interface, and an interface without an ACL permits everything. The problem is the direction on G0/0.

  10. Question 10 of 10Scenario

    You need to block only Telnet from 10.5.5.0/24 to 10.9.9.9 and allow all other traffic. A colleague configures `access-list 1350 deny 10.5.5.0 0.0.0.255` followed by `access-list 1350 permit any`. Which statement is true?

    1. ACL 1350 is an extended ACL because its number is above 1000, so it can be extended to match Telnet.
    2. ACL 1350 is standard, so it matches only the source and blocks all traffic from 10.5.5.0/24, not just Telnet.
    3. The router rejects the command because 1350 is outside every valid numbered ACL range.
    4. The ACL blocks only Telnet, because standard ACLs filter management protocols such as Telnet by default.
    Show the answer

    Answer: B

    Know the numbered ranges: standard 1-99 and 1300-1999, extended 100-199 and 2000-2699. If the requirement mentions a protocol, a port or a destination, you need an extended ACL. Named ACLs avoid the number question by declaring standard or extended explicitly.

    • A. Extended numbered ranges are 100-199 and 2000-2699. 1350 falls in the expanded standard range.
    • B. Standard ACLs (1-99, 1300-1999) can match only the source. To block Telnet to one host you need an extended ACL, for example `deny tcp 10.5.5.0 0.0.0.255 host 10.9.9.9 eq 23` followed by `permit ip any any`.
    • C. 1300-1999 is the expanded range for standard numbered ACLs, so 1350 is valid.
    • D. Standard ACLs have no protocol or port awareness. Applied to an interface, the deny matches every packet from that subnet.

Want more like these? The full CertAce bank has timed exams, a review pool for the questions you miss and readiness per exam domain.

Start free trial

3 days and 100 questions, no card needed.

Common mistakes

Questions people ask

What is the difference between standard and extended ACLs on the CCNA?

Standard ACLs (1-99, 1300-1999) match only the source IPv4 address. Extended ACLs (100-199, 2000-2699) can match protocol, source and destination addresses, and TCP/UDP ports. Named ACLs can be either type, declared with `ip access-list standard` or `ip access-list extended`.

Where should I place standard and extended ACLs?

Place standard ACLs as close to the destination as possible, because they can only see the source and would otherwise block more than intended. Place extended ACLs as close to the source as possible, so unwanted traffic is dropped before it crosses the network.

How do I add an entry in the middle of an existing ACL?

Enter the ACL in named configuration mode (`ip access-list extended NAME`, or the number for a numbered list) and type the entry with a sequence number between two existing ones, for example `15 permit ...` between 10 and 20. Entries added without a sequence number are appended to the end. `show access-lists` shows the current sequence numbers.

More CCNA topics

Questions written by CertAce. CertAce is not affiliated with or endorsed by Cisco Systems. CCNA and Cisco are trademarks of Cisco Systems, Inc.