1. VLSM allows you to summarize 192.168.2.0/24 and 192.168.3.0/24 as 192.168.2.0/25.
A. True
B. False
Answer: B
CIDR allows you to summarize class networks together; VLSM allows you to summarize subnets only back to the class network boundary.
2. VLSM allows a network segment to have more than one subnet mask.
A. True
B. False
Answer: B
Each segment has a single network number and mask. VLSM allows a class address, not a network segment, to have more than one subnet mask.
3. Which protocol supports VLSM?
A. RIP V2
B. IGRP
C. RIP and IGRP
D. None of these
Answer: A
RIPv2 supports VLSM (RIPv1 doesn’t).
B is classful and doesn’t support VLSM. C includes a classful protocol. There is a correct answer, so D is incorrect.
4. You are given a Class C network, 192.168.1.0/24. You need one network with 120 hosts and two networks with 60 hosts. How many subnet masks do you need?
A. 1
B. 2
C. 3
D. 4
Answer: B
You need two subnet masks: 255.255.255.128 (/25) and 255.255.255.192 (/26). This creates three networks, for instance, 192.168.1.0/25, 192.168.128/26, and 192.168.1.192/26.
5. You are given a class C network, 192.168.1.0/24. You need one network with 120 hosts and three networks with 60 hosts. What subnet mask values would you use?
A. 255.255.255.128 and 255.255.255.192
B. 255.255.255.128
C. 255.255.255.192
D. None of these
Answer: D
This is impossible with a single Class C network. One hundred twenty hosts require a 255.255.255.128 mask, which is half a Class C network. Sixty hosts require a 255.255.255.192 mask; however, you need three of these, which is 3/4 of a Class C network. Therefore it is impossible.
A is incorrect because it accommodates only the 120-host and two 60-host segments. B is incorrect because it accommodates only two subnets. C is incorrect because it accommodates the three 60-host segments, but not the 120-host segment.
6. You are given a class C network, 192.168.1.0/24. You need three networks with 60 hosts and two networks with 30 hosts. What are the subnet mask values you could use?
A. 255.255.255.128 and 255.255.255.192
B. 255.255.255.224 and 255.255.255.240
C. 255.255.255.192 and 255.255.255.224
D. None of these
Answer: A
A and C. A creates one 126-host segment and two 62-host segments. C creates three 62-host segments and two 30-host segments.
B’s second mask supports only 14 hosts. D is incorrect because there is a correct answer.
7. You are given this address space: 172.16.5.0/25. You need one network with 64 hosts and two with 30 hosts. What are the most specific subnet mask values to use?
A. /25 and /26
B. /26 and /27
C. /27 and /28
D. None of these
Answer: D
Sixty-four hosts require a 25-bit mask, and you are only given this to begin with—62 hosts would work with a 26-bit mask.
A, B, and C don’t support enough addresses.
8. You are given a class C network and you have four LAN segments with the following numbers of devices: 120, 60, and two with 30. What subnet mask values would you use to accommodate these segments?
A. /24, /25, and /26
B. /25, /26, and /27
C. /26, /27, and /28
D. None of these
Answer: B
A bit mask of 25 creates two networks: 0 and 128. If you take one of these subnets and apply a 26-bit mask, you have two more networks, such as 128 and 192. Taking one of these two subnets, applying a 27-bit mask creates two more subnets, such as 192 and 224.
A, C, and D don’t support enough addresses to accommodate all four LAN segments.
9. VLSM allows you to summarize __________ back to the class boundary.
A. Subnets
B. Networks
Answer: A
VLSM allows you to summarize subnets back to the class A, B, or C network boundary.
B is a non-subnetted address space and therefore is a Class A, B or C network number and can’t be summarized with VLSM, but can be with CIDR.
10. Which of the following is not an advantage of route summarization?
A. It requires less memory and processing.
B. It supports smaller routing update sizes.
C. It contains network problems.
D. It supports discontiguous subnets.
Answer: D
Discontiguous subnets are supported by classless protocols, but they are not an advantage of summarization. Actually, summarization is more difficult if you have discontiguous subnets.
A, B, and C are advantages of route summarization.
11. _________ allows you to create this summarization: 10.0.0.0/7.
A. Subnetting
B. CDR
C. Supernetting
D. VLSM
Answer: C
Supernetting, or CIDR, supports summarization of contiguous blocks of class A, B, or C networks.
A is the opposite of summarization. B should be CIDR, not CDR. D allows you to summarize subnets, not networks.
12. Which of the following are classless protocols?
A. IGRP
B. EIGRP
C. IGRP and EIGRP
D. Neither IGRP or EIGRP
Answer: B
EIGRP, as well as IS-IS, BGP, OSPF, and RIPv2, is a classless protocol.
A is not a classless protocol. C includes a classful protocol (IGRP). D is incorrect because there is a correct answer.
13. A routing protocol that supports route summarization must perform all except which of the following?
A. Carry the subnet mask with the network entry.
B. Make routing decisions based on the entire destination IP address.
C. Summarize entries so that the same lowest-order bits match.
D. None of these.
Answer: C
Summarized entries must have the same highest-order matching bits, not lowest.
A and B are things a routing protocol supporting route summarization must perform. D is incorrect because there is a correct answer.
14. You have the following two routes: 192.168.1.64/27 and 192.168.1.96/27. Enter the most specific summarized route for these two subnets: ___________.
A. IF YOU DUNNO THEN CLICK TO VIEW THE ANSWER
Answer: A
192.168.1.64/26 THIS INCULDES ADDRESSESS FROM 192.168.1.64 THROUGH 192.168.1.127
192.168.1.64/26: this includes addresses from 192.168.1.64 through 192.168.1.127.
15. You have the following four routes: 192.168.1.32/30, 192.168.1.36/30, 192.168.1.40/30, and 192.168.1.44/30. Enter the most specific summarized route for these four subnets: __________.
A. IF YOU DUNNO THEN CLICK TO VIEW THE ANSWER
Answer: A
192.168.1.32/28 THIS INCULDES ADDRESSES FROM 192.168.1.32 THROUGH 192.168.1.47
192.168.1.32/28: this includes addresses from 192.168.1.32 through 192.168.1.47.
Thursday, October 9, 2008
Access list
ACCESS-LIST
1. On your newly installed router, you apply the access list illustrated below to interface Ethernet 0 on a
Cisco router. The interface is connected to the 192.168.1.8/29 LAN.
access-list 123 deny tcp 192.168.166.18 0.0.0.7 eq 20 any
access-list 123 deny tcp 192.168.166.18 0.0.0.7 eq 21 any
How will the above access lists affect traffic?
A. All traffic will be allowed to exit E0 except FTP traffic.
B. FTP traffic from 192.168.166.19 to any host will be denied.
C. FTP traffic from 192.168.166.22 to any host will be denied.
D. All traffic exiting E0 will be denied.
E. All FTP traffic to network 192.168.166.18/29 from any host will be denied.
Answer: D
2. On a newly installed router, the following access list is added to the HSSI interface for incoming traffic:
Access-list 101 permit tcp any 10.18.10.0 0.0.0.255 eq tcp
What is the effect of the "any" keyword in the above access list?
A. check any of the bits in the source address
B. permit any wildcard mask for the address
C. accept any source address
D. check any bit in the destination address
E. permit 255.255.255.255 0.0.0.0
F. accept any destination
Answer: C
3. The relevant portion of the Barrymore router configuration is displayed below:
Barrymore#show running-config
enable password cisco
!
username Central password 0 cisco
!
interface BRI0/0
ip address 192.168.0.1 255.255.255.0
encapsulation ppp
dialer idle-timeout 180
dialer map ip 192.168.0.2 name Remote 5552000
dialer-group 1
isdn switch-type basic-ni
no fair-queue
ppp authentication chap
!
ip route 192.168.20.0 255.255.255.0 192.168.0.2
!
router rip
network 192.168.0.0
!
access-list 129 deny tcp 192.168.0.0 0.0.0 255 host 192.168.20.5 eq www
access-list 128 permit ip any any
dialer-list 1 protocol ip list 128
In your effort to conserve precious bandwidth, you set up some ACL's to deny internet access to the
remote server located at 192.168.20.5. A few minutes after reconfiguring (as shown in the exhibit above)
you notice that some web traffic is still going through.
Based on the above output, what do you suspect as to why the trafficstill traveling over the ISDN link?
A. Broadcasts are creating "interesting" traffic.
B. The access-list is not configured correctly.
C. The command ip access-group 129 out is missing from the bri0/0 interface.
D. The dialer-group has not been applied to outbound traffic.
Answer: B
4. You are securing a network for TestKing and want to apply an ACL (access control list) to an interface
of a router. Which one of the following commands would you use?
A. permit access-list 101 out
B. ip access-group 101 out
C. apply access-list 101 out
D. access-class 101 out
E. ip access-list e0 out
Answer: B
5. Which of the following statements regarding the use of multiple access lists are valid when configuring a
single interface on a Cisco router?
A. Application of up to three access lists per protocol to a single interface.
B. No more than two access lists per interface.
C. One access list may be configured per direction for each Layer 3 protocol configured on an interface.
D. The maximum number allowed varies due to RAM availability in the router.
E. An infinite number of access lists that can be applied to an interface, from most specific to most general.
F. Cisco IOS allows only one access list to an interface.
Answer: C
6. On the serial interface of a router, an inbound access list is configured to deny all traffic from UDP and
TCP ports 21, 23, and 25. All other traffic is permitted. Based on this information, which types of traffic
will be allowed through this interface? (Choose threee)
A. SMTP
B. DNS
C. FTP
D. Telnet
E. HTTP
F. POP3
Answer: B, E, F
7. The following access list below was applied outbound on the E0 interface connected to the 192.169.1.8/29
LAN:
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 20 any
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 21 any
How will the above access lists affect traffic?
A. FTP traffic from 192.169.1.22 will be denied.
B. No traffic, except for FTP traffic will be allowed to exit E0.
C. FTP traffic from 192.169.1.9 to any host will be denied.
D. All traffic exiting E0 will be denied.
E. All FTP traffic to network 192.169.1.9/29 will be denied.
Answer: D
8. Which of the following commands would successfully implement an access list on a routers virtual
terminal line? (Select only one answer choice)
A. RouterTK(config-line)# access-class 10 in
B. RouterTK(config-if)# ip access-class 23 out
C. RouterTK(config-line)# access-list 150 in
D. RouterTK(config-if)# ip access-list 128 out
E. RouterTK(config-line)# access-group 15 out
F. RouterTK(config-if)# ip access-group 110 in
Answer: A
9. What are some general guidelines regarding the placement of access control lists? (Select two answer
choices)
A. You should place standard ACLS as close as possible to the source of traffic to be denied.
B. You should place extended ACLS as close as possible to the source of traffic to be denied.
C. You should place standard ACLS as close as possible to the destination of traffic to be denied.
D. You should place extended ACLS should be places as close as possible to the destination of traffic to be
denied.
Answer: B, C
10. A network administrator wants to add a line to an access list that will block only Telnet access by the
hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to
accomplish this task?
A. access-list 101 deny tcp 192.168.1.128 0.0.015 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
B. access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23
access-list 1 permit ip any any
C. access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21
access-list 1 permit ip any any
D. access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
E. access-list 101 deny ip 192.168.1.128 0.0.0.240 192.158.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
F. access-list 101 deny ip 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
Answer: A
11. You are the network administrator at TestKing. You apply the following access list on the E0 outbound
interface connected to the 192.168.1.8/29 LAN:
access-list 21 deny tcp 192.168.1.8 0.0.0.7 eq 20 any
access-list 21 deny tcp 192.168.1.8 0.0.0.7 eq 21 any
What will the effect of this access list be?
A. All traffic will be allowed to out of E0 except FTP traffic.
B. FTP traffic from 192.168.1.22 to any host will be blocked.
C. FTP traffic from 192.168.1.9 to any host will be blocked.
D. All traffic will be prevented from leaving E0.
E. All FTP traffic to network 192.168.1.9/29 from any host will be blocked.
Answer: D
12. A network administrator has configured access list 172 to prevent Telnet and ICMP traffic from
reaching a server with the address if 192.168.13.26. Which command can the administrator issue to
verify that the access list is working properly? (Choose three)
A. Router# ping 192.168.13.26
B. Router# debug access-list 172
C. Router# show open ports 192.168.13.26
D. Router# show access-list
E. Router# show ip interface
Answer: A, D, E
13. When are packets processed in an inbound access list?
A. Before they are routed to an outbound interface.
B. After they are routed for outbound traffic.
C. After they are routed to an outbound interface while queuing.
D. Before and after they are routed to an outbound interface.
E. Depends on the configuration of the interface
F. None of the above
Answer: A
14. Which of the following are benefits provided with access control lists (ACLs)? (Select all that apply)
A. ACLs monitor the number of bytes and packets.
B. Virus detection.
C. ACLs dentify interesting traffic for DDR.
D. ACLs provide IP route filtering.
E. ACLs provide high network availability.
F. ACLs classify and organize network traffic.
Answer: C, D
15. Which one of the access control list statements below will deny all telnet connections to subnet
10.10.1.0/24?
A. access-list 15 deny telnet any 10.10.1.0 0.0.0.255 eq 23
B. access-list 115 deny udp any 10.10.1.0 eq telnet
C. access-list 15 deny tcp 10.10.1.0 255.255.255.0 eq telnet
D. access-list 115 deny tcp any 10.10.1.0 0.0.0.255 eq 23
E. access-list 15 deny udp any 10.10.1.0 255.255.255.0 eq 23
Answer: D
16. Which of the following answer choices are correct characteristics of named access list? (Select all that
apply)
A. You can delete individual statements in a named access list
B. Named access lists require a numbered range from 1000 to 1099.
C. Named access lists must be specified as standard or extended.
D. You can use the ip access-list command to create named access lists.
E. You cannot delete individual statements in a named access list.
F. You can use the ip name-group command to apply named access lists.
Answer: A, C, D
17. Which of the following access list statements would deny traffic from a specific host?
A. Router(config)# access-list 1 deny 172.31.212.74 any
B. Router(config)# access-list 1 deny 10.6.111.48 host
C. Router(config)# access-list 1 deny 172.16.4.13 0.0.0.0
D. Router(config)# access-list 1 deny 192.168.14.132 255.255.255.0
E. Router(config)# access-list 1 deny 192.168.166.127 255.255.255.255
Answer: C
18. Which IP address and wildcard mask would you use in your ACL to block all the hosts in the subnet
192.168.16.43/28?
A. 192.168.16.32 0.0.0.16
B. 192.168.16.43 0.0.0.212
C. 192.168.16.0 0.0.0.15
D. 192.168.16.32 0.0.0.15
E. 192.168.16.0 0.0.0.31
F. 192.168.16.16 0.0.0.31
Answer: D
19. A standard IP access list is applied to an Ethernet interface of a router. What does this standard access
list filter on?
A. The source and destination addresses
B. The destination port number
C. The destination address
D. The source address
E. All of the above
Answer: D
20. The TestKing network is subnetted using 29 bits for the subnet mask. Which wild card mask should be
used to configure an extended access list to permit or deny access to an entire subnetwork?
A. 255.255.255.224
B. 255.255.255.248
C. 0.0.0.224
D. 0.0.0.8
E. 0.0.0.7
F. 0.0.0.3
Answer: E
21. Which of the following are valid tyoes of access-lists?(choose all that apply)
A. Standard
B. global
C. Extended
D. Named
E. Interface
F. Routing
Answer: A,C,D
22. Choose the valid number ranges for ip extended access lists.(choose all that apply)
A. 1 to 99
B. 199 to 2699
C. 100 to 199
D. 1300 to 1399
E. 2000 to 2699
F. 2000 to 2999
Answer: C,E
23. Which of the following are true satements?(choose all that apply)
A. If a packet does not match any explicit condition in the list,an implicit permit allows
the packet to be forwarded.
B. After a packet matches an entry,it is acted upon by that statement and no other entries
are checked.
C. When an interface receives a packet,all entries in the access list are checked before
any decision is made.
D. A condition can test only against source and destinaiton address.
E. If no entry is matched,the packet is denied by an implicit deny all.
F. All access lists acting as packet filters should have at least one permit statement.
Answer: B,E,F
24. Which command creates a standard access list?(choose all that apply)
A. access-list 101
B. access-list 1 standard
C. access-list 1
D. access-list 1 standard mylist
E. standard access-list 1
Answer: C,D
25. Which of the following commands would you use to allow traffic from the 192.168.255.0
subnet to be allowed in on interface Ethernet 0?(choose all that apply)
A. access-list 1 permit 192.168.255.0
B. ip access-group 1 in
C. access-group 101 permit 192.168.255.0 0.0.0.255
D. interface Ethernet 0
E. access-list standard OK-Traffic permit 192.168.255.0 0.0.0.255
Answer: D,E
26. Which of the following statement are true ?
A. Access lists can be applied only to an interface.
B. An interface can only have one access list,per protocol,per direction.
C. If you delete an access list ,the mapping will be automatically deleted.
D. All access lists have an implict deny any at the bottom.
E. Extended access lists should be placed close to the source.
F. Standard access lists should be placed close to the source.
G. Access list placement does not matter.
Answer: B,C,E
27. Which of the following are not features of ACLs?
A. Restricting telnet access to a router.
B. Prioritizing WAN traffic.
C. Filtering traffic from the router.
D. Triggering dialup phone calls.
Answer: D
1. On your newly installed router, you apply the access list illustrated below to interface Ethernet 0 on a
Cisco router. The interface is connected to the 192.168.1.8/29 LAN.
access-list 123 deny tcp 192.168.166.18 0.0.0.7 eq 20 any
access-list 123 deny tcp 192.168.166.18 0.0.0.7 eq 21 any
How will the above access lists affect traffic?
A. All traffic will be allowed to exit E0 except FTP traffic.
B. FTP traffic from 192.168.166.19 to any host will be denied.
C. FTP traffic from 192.168.166.22 to any host will be denied.
D. All traffic exiting E0 will be denied.
E. All FTP traffic to network 192.168.166.18/29 from any host will be denied.
Answer: D
2. On a newly installed router, the following access list is added to the HSSI interface for incoming traffic:
Access-list 101 permit tcp any 10.18.10.0 0.0.0.255 eq tcp
What is the effect of the "any" keyword in the above access list?
A. check any of the bits in the source address
B. permit any wildcard mask for the address
C. accept any source address
D. check any bit in the destination address
E. permit 255.255.255.255 0.0.0.0
F. accept any destination
Answer: C
3. The relevant portion of the Barrymore router configuration is displayed below:
Barrymore#show running-config
enable password cisco
!
username Central password 0 cisco
!
interface BRI0/0
ip address 192.168.0.1 255.255.255.0
encapsulation ppp
dialer idle-timeout 180
dialer map ip 192.168.0.2 name Remote 5552000
dialer-group 1
isdn switch-type basic-ni
no fair-queue
ppp authentication chap
!
ip route 192.168.20.0 255.255.255.0 192.168.0.2
!
router rip
network 192.168.0.0
!
access-list 129 deny tcp 192.168.0.0 0.0.0 255 host 192.168.20.5 eq www
access-list 128 permit ip any any
dialer-list 1 protocol ip list 128
In your effort to conserve precious bandwidth, you set up some ACL's to deny internet access to the
remote server located at 192.168.20.5. A few minutes after reconfiguring (as shown in the exhibit above)
you notice that some web traffic is still going through.
Based on the above output, what do you suspect as to why the trafficstill traveling over the ISDN link?
A. Broadcasts are creating "interesting" traffic.
B. The access-list is not configured correctly.
C. The command ip access-group 129 out is missing from the bri0/0 interface.
D. The dialer-group has not been applied to outbound traffic.
Answer: B
4. You are securing a network for TestKing and want to apply an ACL (access control list) to an interface
of a router. Which one of the following commands would you use?
A. permit access-list 101 out
B. ip access-group 101 out
C. apply access-list 101 out
D. access-class 101 out
E. ip access-list e0 out
Answer: B
5. Which of the following statements regarding the use of multiple access lists are valid when configuring a
single interface on a Cisco router?
A. Application of up to three access lists per protocol to a single interface.
B. No more than two access lists per interface.
C. One access list may be configured per direction for each Layer 3 protocol configured on an interface.
D. The maximum number allowed varies due to RAM availability in the router.
E. An infinite number of access lists that can be applied to an interface, from most specific to most general.
F. Cisco IOS allows only one access list to an interface.
Answer: C
6. On the serial interface of a router, an inbound access list is configured to deny all traffic from UDP and
TCP ports 21, 23, and 25. All other traffic is permitted. Based on this information, which types of traffic
will be allowed through this interface? (Choose threee)
A. SMTP
B. DNS
C. FTP
D. Telnet
E. HTTP
F. POP3
Answer: B, E, F
7. The following access list below was applied outbound on the E0 interface connected to the 192.169.1.8/29
LAN:
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 20 any
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 21 any
How will the above access lists affect traffic?
A. FTP traffic from 192.169.1.22 will be denied.
B. No traffic, except for FTP traffic will be allowed to exit E0.
C. FTP traffic from 192.169.1.9 to any host will be denied.
D. All traffic exiting E0 will be denied.
E. All FTP traffic to network 192.169.1.9/29 will be denied.
Answer: D
8. Which of the following commands would successfully implement an access list on a routers virtual
terminal line? (Select only one answer choice)
A. RouterTK(config-line)# access-class 10 in
B. RouterTK(config-if)# ip access-class 23 out
C. RouterTK(config-line)# access-list 150 in
D. RouterTK(config-if)# ip access-list 128 out
E. RouterTK(config-line)# access-group 15 out
F. RouterTK(config-if)# ip access-group 110 in
Answer: A
9. What are some general guidelines regarding the placement of access control lists? (Select two answer
choices)
A. You should place standard ACLS as close as possible to the source of traffic to be denied.
B. You should place extended ACLS as close as possible to the source of traffic to be denied.
C. You should place standard ACLS as close as possible to the destination of traffic to be denied.
D. You should place extended ACLS should be places as close as possible to the destination of traffic to be
denied.
Answer: B, C
10. A network administrator wants to add a line to an access list that will block only Telnet access by the
hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to
accomplish this task?
A. access-list 101 deny tcp 192.168.1.128 0.0.015 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
B. access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23
access-list 1 permit ip any any
C. access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21
access-list 1 permit ip any any
D. access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
E. access-list 101 deny ip 192.168.1.128 0.0.0.240 192.158.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
F. access-list 101 deny ip 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
Answer: A
11. You are the network administrator at TestKing. You apply the following access list on the E0 outbound
interface connected to the 192.168.1.8/29 LAN:
access-list 21 deny tcp 192.168.1.8 0.0.0.7 eq 20 any
access-list 21 deny tcp 192.168.1.8 0.0.0.7 eq 21 any
What will the effect of this access list be?
A. All traffic will be allowed to out of E0 except FTP traffic.
B. FTP traffic from 192.168.1.22 to any host will be blocked.
C. FTP traffic from 192.168.1.9 to any host will be blocked.
D. All traffic will be prevented from leaving E0.
E. All FTP traffic to network 192.168.1.9/29 from any host will be blocked.
Answer: D
12. A network administrator has configured access list 172 to prevent Telnet and ICMP traffic from
reaching a server with the address if 192.168.13.26. Which command can the administrator issue to
verify that the access list is working properly? (Choose three)
A. Router# ping 192.168.13.26
B. Router# debug access-list 172
C. Router# show open ports 192.168.13.26
D. Router# show access-list
E. Router# show ip interface
Answer: A, D, E
13. When are packets processed in an inbound access list?
A. Before they are routed to an outbound interface.
B. After they are routed for outbound traffic.
C. After they are routed to an outbound interface while queuing.
D. Before and after they are routed to an outbound interface.
E. Depends on the configuration of the interface
F. None of the above
Answer: A
14. Which of the following are benefits provided with access control lists (ACLs)? (Select all that apply)
A. ACLs monitor the number of bytes and packets.
B. Virus detection.
C. ACLs dentify interesting traffic for DDR.
D. ACLs provide IP route filtering.
E. ACLs provide high network availability.
F. ACLs classify and organize network traffic.
Answer: C, D
15. Which one of the access control list statements below will deny all telnet connections to subnet
10.10.1.0/24?
A. access-list 15 deny telnet any 10.10.1.0 0.0.0.255 eq 23
B. access-list 115 deny udp any 10.10.1.0 eq telnet
C. access-list 15 deny tcp 10.10.1.0 255.255.255.0 eq telnet
D. access-list 115 deny tcp any 10.10.1.0 0.0.0.255 eq 23
E. access-list 15 deny udp any 10.10.1.0 255.255.255.0 eq 23
Answer: D
16. Which of the following answer choices are correct characteristics of named access list? (Select all that
apply)
A. You can delete individual statements in a named access list
B. Named access lists require a numbered range from 1000 to 1099.
C. Named access lists must be specified as standard or extended.
D. You can use the ip access-list command to create named access lists.
E. You cannot delete individual statements in a named access list.
F. You can use the ip name-group command to apply named access lists.
Answer: A, C, D
17. Which of the following access list statements would deny traffic from a specific host?
A. Router(config)# access-list 1 deny 172.31.212.74 any
B. Router(config)# access-list 1 deny 10.6.111.48 host
C. Router(config)# access-list 1 deny 172.16.4.13 0.0.0.0
D. Router(config)# access-list 1 deny 192.168.14.132 255.255.255.0
E. Router(config)# access-list 1 deny 192.168.166.127 255.255.255.255
Answer: C
18. Which IP address and wildcard mask would you use in your ACL to block all the hosts in the subnet
192.168.16.43/28?
A. 192.168.16.32 0.0.0.16
B. 192.168.16.43 0.0.0.212
C. 192.168.16.0 0.0.0.15
D. 192.168.16.32 0.0.0.15
E. 192.168.16.0 0.0.0.31
F. 192.168.16.16 0.0.0.31
Answer: D
19. A standard IP access list is applied to an Ethernet interface of a router. What does this standard access
list filter on?
A. The source and destination addresses
B. The destination port number
C. The destination address
D. The source address
E. All of the above
Answer: D
20. The TestKing network is subnetted using 29 bits for the subnet mask. Which wild card mask should be
used to configure an extended access list to permit or deny access to an entire subnetwork?
A. 255.255.255.224
B. 255.255.255.248
C. 0.0.0.224
D. 0.0.0.8
E. 0.0.0.7
F. 0.0.0.3
Answer: E
21. Which of the following are valid tyoes of access-lists?(choose all that apply)
A. Standard
B. global
C. Extended
D. Named
E. Interface
F. Routing
Answer: A,C,D
22. Choose the valid number ranges for ip extended access lists.(choose all that apply)
A. 1 to 99
B. 199 to 2699
C. 100 to 199
D. 1300 to 1399
E. 2000 to 2699
F. 2000 to 2999
Answer: C,E
23. Which of the following are true satements?(choose all that apply)
A. If a packet does not match any explicit condition in the list,an implicit permit allows
the packet to be forwarded.
B. After a packet matches an entry,it is acted upon by that statement and no other entries
are checked.
C. When an interface receives a packet,all entries in the access list are checked before
any decision is made.
D. A condition can test only against source and destinaiton address.
E. If no entry is matched,the packet is denied by an implicit deny all.
F. All access lists acting as packet filters should have at least one permit statement.
Answer: B,E,F
24. Which command creates a standard access list?(choose all that apply)
A. access-list 101
B. access-list 1 standard
C. access-list 1
D. access-list 1 standard mylist
E. standard access-list 1
Answer: C,D
25. Which of the following commands would you use to allow traffic from the 192.168.255.0
subnet to be allowed in on interface Ethernet 0?(choose all that apply)
A. access-list 1 permit 192.168.255.0
B. ip access-group 1 in
C. access-group 101 permit 192.168.255.0 0.0.0.255
D. interface Ethernet 0
E. access-list standard OK-Traffic permit 192.168.255.0 0.0.0.255
Answer: D,E
26. Which of the following statement are true ?
A. Access lists can be applied only to an interface.
B. An interface can only have one access list,per protocol,per direction.
C. If you delete an access list ,the mapping will be automatically deleted.
D. All access lists have an implict deny any at the bottom.
E. Extended access lists should be placed close to the source.
F. Standard access lists should be placed close to the source.
G. Access list placement does not matter.
Answer: B,C,E
27. Which of the following are not features of ACLs?
A. Restricting telnet access to a router.
B. Prioritizing WAN traffic.
C. Filtering traffic from the router.
D. Triggering dialup phone calls.
Answer: D
Subscribe to:
Posts (Atom)