Access list Questions – Part 2

Here you will find answers to Access list Questions – Part 2

Note: If you are not sure about Access list, please read my Access list tutorial.

Question 1

Refer to the exhibit. What will happen to HTTP traffic coming from the Internet that is destined for 172.16.12.10 if the traffic is processed by this ACL?

router#show access-lists  Extended IP access list 110 10 deny tcp 172.16.0.0 0.0.255.255 any eq telnet 20 deny tcp 172.16.0.0 0.0.255.255 any eq smtp 30 deny tcp 172.16.0.0 0.0.255.255 any eq http 40 permit tcp 172.16.0.0 0.0.255.255 any

A. Traffic will be dropped per line 30 of the ACL.
B. Traffic will be accepted per line 40 of the ACL.
C. Traffic will be dropped, because of the implicit deny all at the end of the ACL.
D. Traffic will be accepted, because the source address is not covered by the ACL.

Answer: C

Explanation

The syntax of an extended access list is:

access-list access-list-number {permit | deny} protocol source {source-mask} destination {destination-mask} [eq destination-port]

Notice that in our access list, the network 172.16.0.0 0.0.255.255 is specified as the source but the question asks about “HTTP traffic coming from the Internet that is destined for 172.16.12.10″, which means 172.16.0.0 0.0.255.255 is the destination network. So in this case there is no match in our access list and the traffic will be dropped because of the implicit deny all at the end of the ACL. It is surely a tricky question!

Question 2

Refer to the exhibit. Which statement describes the effect that the Router1 configuration has on devices in the 172.16.16.0 subnet when they try to connect to SVR-A using Telnet or SSH?

A. Devices will not be able to use Telnet or SSH.
B. Devices will be able to use SSH, but not Telnet.
C. Devices will be able to use Telnet, but not SSH.
D. Devices will be able to use Telnet and SSH.

Answer: B

Explanation

Let’s analyze the access list 100:

+ 10 permit tcp 172.16.16.0 0.0.0.15 host 172.16.48.63 eq 22: allows TCP traffic from network 172.16.16.0/28 to access host 172.16.48.63 with a destination port of 22 (SSH)
+ 20 permit tcp 172.16.16.0 0.0.0.15 eq telnet host 172.16.48.63: allows TCP traffic from network 172.16.16.0/28 with a source port of 23 (telnet) to access host 172.16.48.63

Notice that if a device wants to telnet (or SSH) to SVR-A server it must use the destination port of 23 (or 22), not a source port of 23 (or 22).

Access list 100 is applied on the inbound direction of Fa0/0 so it will only filter traffic from 172.16.16.0 subnet to the SVR-A server.

Access list 101 is very similar to access list 100 but it is applied on the inbound direction of Fa0/1 so it will filter traffic from SVR-A server to 172.16.16.0 subnet. In ACL 101:

+ 10 permit tcp host 172.16.48.63 eq 22 172.16.16.0 0.0.0.15: allows TCP traffic from host 172.16.48.63 with a source port of 22 (SSH) to access network 172.16.16.0/28.
+ 20 permit tcp host 172.16.48.63 172.16.16.0 0.0.0.15 eq telnet: allows TCP traffic from host 172.16.48.63 to access network 172.16.16.0/28 with a destination port of telnet.

Notice that the returned traffic from SVR-A to network 172.16.16.0/28 (resulting from telnet or SSH session) will have a source port of 23 (Telnet) or 22 (SSH)

In conclusion, the first statements of each ACL will allow devices to “SSH” to SVR-A. But they can’t telnet because of the implicit deny all at the end of the ACL.

In this question, the second statements of each ACL can be considered “wrong” if we intend to filter telnet or SSH traffic and they have no effect on the Telnet or SSH traffic.

Question 3

Refer to the exhibit. Which three variables (router, protocol port, and router ACL direction) apply to an extended ACL that will prevent student 01 from securely browsing the internet?

A. OUT
B. Router 3
C. HTTPS
D. IN
E. Router 1

Answer: B C D

Explanation

There are 3 routers we can place this access list: Router 1, Router Main and Router 3 but in theory, an extended access list should be placed close to the source -> Router 3 is the best choice -> B is correct.

The traffic we need to filter here is “securely browsing the internet” so it is HTTPS -> C is correct.

Finally we should apply this access list to the inbound direction so that Router 3 will filter this traffic before making routing decision. It helps save processing resources on Router 3 -> D is correct.

Question 4

Which two statements apply to dynamic access lists? (choose two)

A. they offer simpler management in large internetworks.
B. you can control logging messages.
C. they allow packets to be filtered based on upper-layer session information.
D. you can set a time-based security policy.
E. they provide a level of security against spoofing.
F. they are used to authenticate individual users.

Answer: A F

Explanation

Dynamic ACLs have the following security benefits over standard and static extended ACLs:
+ Use of a challenge mechanism to authenticate individual users
+ Simplified management in large internetworks
+ In many cases, reduction of the amount of router processing that is required for ACLs
+ Reduction of the opportunity for network break-ins by network hackers
+ Creation of dynamic user access through a firewall, without compromising other configured security restrictions

(Reference: CCNA Exploration 4 – Dynamic ACLs)

Question 5

Which command shows if an access list is assigned to an interface?

A. show ip interface [interface] access-lists
B. show ip access-lists interface [interface]
C. show ip interface [interface]
D. show ip access-lists [interface]

Answer: C

Explanation

The output of “show ip interface [interface]” command is shown below:

In the output we can see the access list 1 is applied to this interface on inbound direction.

Question 6

Which item represents the standard IP ACL?

A. access-list 50 deny 192.168.1.1 0.0.0.255
B. access-list 110 permit ip any any
C. access-list 2500 deny tcp any host 192.168.1.1 eq 22
D. access-list 101 deny tcp any host 192.168.1.1

Answer: A

Explanation

The standard access lists are ranged from 1 to 99 and from 1300 to 1999 so only access list 50 is a standard access list.

Question 7

Which statement about access lists that are applied to an interface is true?

A. you can apply only one access list on any interface
B. you can configure one access list, per direction, per layer 3 protocol
C. you can place as many access lists as you want on any interface
D. you can configure one access list, per direction, per layer 2 protocol

Answer: B

Explanation

We can have only 1 access list per protocol, per direction and per interface. It means:

+ We can not have 2 inbound access lists on an interface
+ We can have 1 inbound and 1 outbound access list on an interface

Question 8

A network engineer wants to allow a temporary entry for a remote user with a specific username and password so that the user can access the entire network over the internet. Which ACL can be used?

A. reflexive
B. extended
C. standard
D. dynamic

Answer: D

Explanation

We can use a dynamic access list to authenticate a remote user with a specific username and password. The authentication process is done by the router or a central access server such as a TACACS+ or RADIUS server. The configuration of dynamic ACL can be read here:http://www.cisco.com/en/US/tech/tk583/tk822/technologies_tech_note09186a0080094524.shtml

Question 9

Which parameter standard access list takes into consideration for traffic filtering decisions?

A. Source MAC address
B. Destination IP address
C. Destination MAC address
D. Source IP address

Answer: D

Question 10

In which solution is a router ACL used?

A. protecting a server from unauthorized access
B. controlling path selection, based on the route metric
C. reducing router CPU utilization
D. filtering packets that are passing through a router

Answer: D

Access list questions

Here you will find answers to CCNA Access list questions

Note: If you are not sure about how to use Access list, please read my Access list tutorial

Question 1

Your boss is learning a CCNA training course, refer to the exhibit. The access list has been configured on the S0/0 interface of router RTB in the outbound direction. Which two packets, if routed to the interface, will be denied? (Choose two)

access-list 101 deny tcp 192.168.15.32 0.0.0.15 any eq telnet
access-list 101 permit ip any any

A. source ip address: 192.168.15.5; destination port: 21
B. source ip address: 192.168.15.37 destination port: 21
C. source ip address: 192.168.15.41 destination port: 21
D. source ip address: 192.168.15.36 destination port: 23
E. source ip address: 192.168.15.46; destination port: 23
F. source ip address: 192.168.15.49 destination port: 23

Answer: D E

Explanation

First we notice that telnet uses port 23 so only D, E & F can satisfy this requirement.

The purpose of this access-list is to deny traffic from network 192.168.15.32 255.255.255.240 (to find out the subnet mask just convert all bit “0″ to “1″ and all bit “1″ to “0″ of the wildcard mask) to telnet to any device. So we need to figure out the range of this network to learn which ip address will be denied.

Increment: 16
Network address: 192.168.15.32
Broadcast address: 192.168.15.47

-> Only 192.168.15.36 (Answer D) & 192.168.15.46 (Answer E) belong to this range so they are the correct answer.

Question 2

Refer to the graphic. It has been decided that PC1 should be denied access to Server. Which of the following commands are required to prevent only PC1 from accessing Server1 while allowing all other traffic to flow normally? (Choose two)

A – Router(config)# interface fa0/0
Router(config-if)# ip access-group 101 out
B – Router(config)# interface fa0/0
Router(config-if)# ip access-group 101 in
C – Router(config)# access-list 101 deny ip host 172.16.161.150 host 172.16.162.163
Router(config)# access-list 101 permit ip any any
D – Router(config)# access-list 101 deny ip 172.16.161.150 0.0.0.255 172.16.162.163 0.0.0.0
Router(config)# access-list 101 permit ip any any

Answer: B C

Question 3

Refer to the exhibit. Why would the network administrator configure RA in this manner?

A. to give students access to the Internet
B. to prevent students from accessing the command prompt of RA
C. to prevent administrators from accessing the console of RA
D. to give administrators access to the Internet
E. to prevent students from accessing the Internet
F. to prevent students from accessing the Admin network

Answer: B

Explanation

Although the access-list is used to “permit” network 10.1.1.0/24 but the best answer here is “to prevent students from accessing the command prompt of RA”. From the picture above, we know that 10.1.1.0/24 is the “Admin” network. This access list is applied to “line vty 0 4″ so it will permit only Telnet traffic from “Admin” to RA while drop all other traffic (because of the implicit “deny all” command at the end of the access list). Therefore we can deduce that it will “prevent students from accessing the command prompt of RA”.

This access list only filters Telnet traffic (because it is applied to vty line) so it will not prevent or allow anyone to access the Internet -> A, D, E are not correct.

C is not correct as this access list allows administrators to access the console of RA.

F is not correct as this access list does not proceed TCP, UDP or IP traffic so the students still access the Admin network.

(Notice that the “command prompt” here implies telnet as telnet is the only way to remotely access RA)

Question 4

An access list was written with the four statements shown in the graphic. Which single access list statement will combine all four of these statements into a single statement that will have exactly the same effect?

A. access-list 10 permit 172.29.16.0 0.0.0.255
B. access-list 10 permit 172.29.16.0 0.0.1.255
C. access-list 10 permit 172.29.16.0 0.0.3.255
D. access-list 10 permit 172.29.16.0 0.0.15.255
E. access-list 10 permit 172.29.0.0 0.0.255.255

Answer: C

Explanation

Four statements above allow 4 networks (from 172.29.16.0/24 to 172.29.19.0/24) to go through so we can summary them as network 172.29.16.0/22.

/22 = 255.255.252.0 so it equals 0.0.3.255 when converting into wildcard mask -> C is correct.

A, B, D are not correct as their wildcard masks are false. For example:
Answer A allows from 172.29.16.0 to 172.29.16.255
Answer B allows from 172.29.16.0 to 172.29.17.255
Answer D allows from 172.29.16.0 to 172.29.31.255

Both the network address and wildcard mask of answer E are false as it allows the whole major network 172.29.0.0/16 to go through.

Question 5

A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?

A – access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
B – access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
C – access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21
access-list 1 permit ip any any
D – access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23
access-list 1 permit ip any any

Answer: A

Explanation:

First the question asks to block only Telnet access so the port we have to use is 23 -> C is not correct.

Next we need to block traffic from hosts on the subnet 192.168.1.128/28, which is 192.168.1.128 0.0.0.15 if we convert to wildcard mask (just invert all bits of the subnet mask,from 0 to 1 and from 1 to 0 we will get the equivalent wildcard mask of that subnet mask) -> so B is incorrect

In this case, we have to use extended access list because we need to specify which type of traffic (TCP) and which port (23) we want to block -> so D is incorrect because it uses standard access list.

Question 6

As a network administrator, you have been instructed to prevent all traffic originating on the LAN from entering the R2 router. Which the following command would implement the access list on the interface of the R2 router?

A – access-list 101 in
B – access-list 101 out
C – ip access-group 101 in
D – ip access-group 101 out

Answer: C

Question 7

The following access list below was applied outbound on the E0 interface connected to the 192.169.1.8/29 LAN:

access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 20 any
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 21 any

How will the above access lists affect traffic?

A – FTP traffic from 192.169.1.22 will be denied
B – No traffic, except for FTP traffic will be allowed to exit E0
C – FTP traffic from 192.169.1.9 to any host will be denied
D – All traffic exiting E0 will be denied
E – All FTP traffic to network 192.169.1.9/29 will be denied

Answer: D

Explanation:

There is always an implicit “deny all” command at the end of every access list, so if an access list doesn’t have any “permit” command, it will block all the traffic. If we use the command “access-list 135 permit ip any any” at the end of this access list then the answer should be C – FTP traffic from 192.169.1.9 to any host will be denied.

Question 8

The access control list shown in the graphic has been applied to the Ethernet interface of router R1 using the ip access-group 101 in command. Which of the following Telnet sessions will be blocked by this ACL? (Choose two)

A – from host PC1 to host 5.1.1.10
B – from host PC1 to host 5.1.3.10
C – from host PC2 to host 5.1.2.10
D – from host PC2 to host 5.1.3.8

Answer: B D

Explanation

Below is the simple syntax of an extended access list:

access-list access-list-number {deny | permit} {ip|tcp|udp|icmp} source [source-mask] dest [dest-mask] [eq dest-port]

Notice that this access list is applied to the Ethernet interface of R1 in the “in direction” so in this case, it will filter all the packets originated from E1 network (host PC1 and PC2) with these parameters:

Source network: 5.1.1.8 0.0.0.3 which means 5.1.1.8/252 (just invert all the wildcard bits to get the equivalent subnet mask) -> Packets from 5.1.1.8 to 5.1.1.11 will be filtered.

Destination network: 5.1.3.0 0.0.0.255 which means 5.1.3.0/24-> Packets to 5.1.3.0/24 will be filtered

Therefore packets originated from 5.1.1.8 to 5.1.1.11 and have the destination to the host 5.1.3.x (via Telnet) will be denied.

Question 9

The following configuration line was added to router R1

Access-list 101 permit ip 10.25.30.0 0.0.0.255 any

What is the effect of this access list configuration?
A – permit all packets matching the first three octets of the source address to all destinations
B – permit all packet matching the last octet of the destination address and accept all source addresses
C – permit all packet matching the host bits in the source address to all destinations
D – permit all packet from the third subnet of the network address to all destinations

Answer: A

Protocols & Services Questions

Here you will find answers to CCNA – Protocols & Services Questions

Question 1

An administrator attempts a traceroute but receives a “Destination Unreachable” message. Which protocol is responsible for that message?

A. RARP
B. RUDP
C. ICMP
D. SNMP

Answer: C

Explanation

The ICMP destination unreachable message is generated by a router (which is reachable) to inform the source host that the destination unicast address is unreachable.

Question 2

DNS servers provide what service?

A. They run a spell check on host names to ensure accurate routing
B. They convert domain names into IP address
C. Given an IP address.they determine the name of the host that is sought
D. They map individual hosts to their specific IP addresses

Answer: B

Explanation

For example, when you open a web browser (IE, Firefox…) and type a domain (like google.com). This domain will be sent to a DNS server. The DNS server looks up this domain in its database and sends back a corresponding IP address which you can use to access that website.

Note: A DNS server can be a dedicated device for DNS service or integrated into a networking device (like router).

Question 3

Which of the following protocols uses both TCP and UDP ports?

A. SMTP
B. Telnet
C. FTP
D. DNS

Answer: D

Explanation

DNS can use either the User Datagram Protocol (UDP) or Transmission Control Protocol (TCP) with a destination port of 53.

Note:

+Simple Mail Transfer Protocol (SMTP) is specified for mail transport and uses TCP port 25.
+ Telnet uses TCP on port 23.
+ File Transfer Protocol (FTP) uses TCP on port 20, 21.
+ Trivial File Transfer Protocol (TFTP) uses UDP on port 69.
+ HTTP Secure (HTTPS) uses TCP on port 443.

Question 4

Which protocol should be used to establish a secure terminal connection to a remote network device?

A. ARP
B. SSH
C. Telnet
D. WEP
E. SNMPv1
F. SNMPv2

Answer: B

Explanation

Secure Shell (SSH) protocols secure terminal session data across insecure environments such as the internet.

Question 5

A network administrator issues the ping 192.168.2.5 command and successfully tests connectivity to a host that has been newly connected to the network. Which protocols were used during the test? (Choose two)

A. ARP
B. CDP
C. DHCP
D. DNS
E. ICMP

Answer: A E

Explanation

In this question we are not sure the host 192.168.2.5 is in or outside the local network. But in both cases the ARP protocol are used to get the MAC address:

+ If host 192.168.2.5 is inside the local network, our device will broadcast an ARP Request to ask the MAC address of the host 192.168.2.5 (something like “If your IP is 192.168.2.5, please send me your MAC address”).
+ If host 192.168.2.5 is outside the local network, our device will broadcast an ARP Request to ask the MAC address of the local port (the port in the same subnet with our device) of the default gateway. Notice that the IP of the default gateway has been already configured in our device.

-> In both cases, our device must broadcast an ARP Request -> A is correct.

After getting the ARP of the destination device, our device will use ICMP protocol to send the “ping” -> E is correct.

Note: The question states “the host has been newly connected to the network” which means our device hasn’t had the MAC address of this host in its ARP table -> it needs to send ARP Request.

There is one situation which makes answer A incorrect: the newly connected host is outside the network but our device has already learned the MAC address of the default gateway -> in this case no ARP Request will be sent. So I assume the question wants to imply the newly connected host is in the local network.

Question 6

Which network protocol does DNS use?

A. FTP
B. TFTP
C. TCP
D. UDP
E. SCP

Answer: D

Explanation

It is funny that in Question 3 I answered “DNS uses both TCP & UDP” but in this question we can only choose one answer and it should be “DNS uses UDP”. So I wish to explain more:

Normally a client sends a DNS Query using UDP Protocol over Port 53. If it does not get response from a DNS Server, it must re-transmit the DNS Query using TCP after 3-5 seconds. So we can say DNS prefers using UDP to TCP -> the answer should be UDP.

Question 7

When two hosts are trying to communicate across a network, how does the host originating the communication determine the hardware address of the host that it wants to “talk” to?

A. RARP request
B. Show Network Address request
C. Proxy ARP request
D. ARP request
E. Show Hardware Address request

Answer: D

Explanation

The address resolution protocol (ARP) is a protocol used to map IP network addresses to the hardware addresses.

+ If the destination host is inside the local network, the originating host will broadcast an ARP Request to ask the MAC address of that host.
+ If the destination host is outside the local network, the originating host will broadcast an ARP Request to ask the MAC address of the local port (the port in the same subnet with our device) of the default gateway. Notice that the IP of the default gateway has been already configured in our device.

Show Command Questions

Here you will find answers to Show Command Questions

Question 1

Refer to the exhibit. What can be determined from the output?

A. 192.168.1.2 is local to the router.
B. 192.168.3.1 is local to the router.
C. 192.168.1.2 will age out in less than 1 minute.
D. 192.168.3.1 has aged out and is marked for deletion.

Answer: B

Explanation

The “Age” field in the “show ip arp” command is the age in minutes of the cache entry. A hyphen (-) means the address is local so in this case 192.168.1.1 & 192.168.3.1 are local to this router -> B is correct.

Note: The “Age 0″ means that the address was cached less than 1 minute ago.

Question 2

Refer to the exhibit. What could be possible causes for the “Serial0/0 is down” interface status? (Choose two)

A. A Layer 1 problem exists.
B. The bandwidth is set too low.
C. A protocol mismatch exists.
D. An incorrect cable is being used.
E. There is an incorrect IP address on the Serial 0/0 interface.

Answer: A D

Explanation

The first part of the “Serial0/0 is down, line protocol is down” indicates a layer 1 problem while the second part indicates a layer 2 problem -> A is correct.

Some popular layer 1 problems are listed below:

+ device power off
+ device power unplugged
+ loose network cable connection
+ incorrect cable type
+ faulty network cable

Answer B “The bandwidth is set too low” will not make a layer 1 problem.
Answer C is a layer 2 problem.
Answer E is a layer 3 problem.

Question 3

Which line from the output of the show ip interface command indicates a layer 1 problem?

A. Serial0/1 is up, line protocol is down
B. Serial0/1 is down, line protocol is down
C. Serial0/1 is up, line protocol is up
D. Serial0/1 is administratively down, line protocol is down

Answer: B

Explanation

Same as question 2.

Question 4

Refer to the exhibit. What is the meaning of the output MTU 1500 bytes?

A. The maximum number of bytes that can traverse this interface per second is 1500.
B. The minimum segment size that can traverse this interface is 1500 bytes.
C. The maximum segment size that can traverse this interface is 1500 bytes.
D. The minimum packet size that can traverse this interface is 1500 bytes.
E. The maximum packet size that can traverse this interface is 1500 bytes.
F. The maximum frame size that can traverse this interface is 1500 bytes.

Answer: E

Explanation

The Maximum Transmission Unit (MTU) defines the maximum Layer 3 packet (in bytes) that the layer can pass onwards.

Question 5

The network administrator normally establishes a Telnet session with the switch from host A. The administrator’s attempt to establish a connect via Telnet to the switch from host B fails, but pings from host B to other two hosts are successful. What is the issue for this problem?

A. Host B and the switch need to be in the same subnet.
B. The switch needs an appropriate default gateway assigned.
C. The switch interface connected to the router is down.
D. Host B need to be assigned an IP address in vlan 1.

Answer: B

Explanation

Host A (172.19.1.1) and the management IP address of the Switch (172.19.1.250) are in the same subnet so telnet from host A to the switch can be successful even if a default gateway is not set on host A.

But host B (172.19.32.2) and the management IP address of the Switch (172.19.1.250) are not in the same subnet so host B needs a default gateway to telnet to the switch. The default gateway on host B should be 172.19.32.254.

Question 6

Which command displays CPU utilization?

A. show protocols
B. show process
C. show system
D. show version

Answer: B

Explanation

The “show process” (in fact, the full command is “show processes”) command gives us lots of information about each process but in fact it is not easy to read. Below shows the output of this command (some next pages are omitted)

A more friendly way to check the CPU utilization is the command “show processes cpu history”, in which the total CPU usage on the router over a period of time: one minute, one hour, and 72 hours are clearly shown:

+ The Y-axis of the graph is the CPU utilization.
+ The X-axis of the graph is the increment within the period displayed in the graph

For example, from the last graph (last 72 hours) we learn that the highest CPU utilization within 72 hours is 37% about six hours ago.

Question 7

Refer to the exhibit. You are connected to the router as user Mike. Which command allows you to see output from the OSPF debug command?

A. terminal monitor
B. show debugging
C. show sessions
D. show ip ospf interface

Answer: A

Explanation

By default, Cisco IOS does not send log messages to a terminal session over IP like Telnet, SSH but console connections do have logging feature enabled by default. To display debug command output and system error messages for Telnet or SSH session, use the “terminal monitor” command in privileged mode.