ACL types by number and by name
| Type | Identifier | Matches on |
|---|---|---|
| Standard, numbered | 1 to 99, 1300 to 1999 | Source address only |
| Extended, numbered | 100 to 199, 2000 to 2699 | Protocol, source and destination address, ports and more |
| Standard, named | A name you choose | Source address only |
| Extended, named | A name you choose | Protocol, source and destination address, ports and more |
Ranges and match fields per Cisco’s Configure IP Access Lists document. Cisco weights Security Fundamentals at 15% of v1.1 across ten topics; with two of them here, our even-split estimate is about 3% of v1.1 and about 6% of v2.0.
Reading an ACL, then placing it
Two habits carry most of topic 5.6. The first is reading the list the way the router does, top line first. Order decides the outcome: a specific permit written below a broader deny never gets a chance to match, and a list made only of deny lines blocks far more than its author wrote down.
The second is placing a list by what it is able to match. A standard ACL sees only the source address, so ask what else that source would lose if you filtered it at the first router it reaches. An extended ACL can name source, destination, protocol and port, so it can drop unwanted traffic before that traffic crosses the network at all. Work that reasoning through each frame; it holds up better than a memorized slogan when a topology looks unusual.
Wildcard masks are the other half of every entry: 0 bits must match, 1 bits are ignored, host stands in for 0.0.0.0 and any for 255.255.255.255. Prefix-to-wildcard conversions and the odd non-contiguous cases sit on wildcard mask vs subnet mask.
A named extended ACL edited by sequence number
ip access-list extended BRANCH-IN 10 permit udp 10.20.0.0 0.0.255.255 host 10.9.9.53 eq domain 20 deny icmp any any echo 30 permit ip 10.20.0.0 0.0.255.255 any 15 permit tcp 10.20.0.0 0.0.255.255 host 10.9.9.53 eq domain!interface GigabitEthernet0/1 ip access-group BRANCH-IN inEntry 15 was typed last but takes its place between 10 and 20. Numbered lists accept the same per-line edits when you open them with ip access-list standard or ip access-list extended and their number.
Layer 2 features at the access port
| Feature | What it watches | Version |
|---|---|---|
| Port security | Source MAC addresses learned on an access port, with an action you choose for a violation | v1.1 5.7, v2.0 4.7 |
| DHCP snooping | DHCP traffic, and specifically server messages arriving on ports where no server belongs | v1.1 5.7, v2.0 4.7 |
| Dynamic ARP inspection (DAI) | ARP messages on untrusted ports, checked against validated IP-to-MAC bindings | v1.1 5.7, v2.0 4.7 |
| Storm control | Per-interface traffic levels against thresholds you configure | New in v2.0 4.7 |
| IPv6 RA guard | Router Advertisements arriving on host-facing ports, where no router should be (RFC 6105) | New in v2.0 4.7 |
Version column per Cisco’s v1.1 and v2.0 topic pages, checked October 29, 2026. RA guard per RFC 6105.
Switch-side protection and what v2.0 adds
The three v1.1 features are not independent switches you flip in any order. DAI depends on something DHCP snooping produces, which is why the two are enabled together and why trusting the wrong uplink breaks both; the dependency is traced step by step on DHCP snooping and dynamic ARP inspection.
In v2.0 (version dates) this material splits into 4.6, IPv4 ACLs standard and extended, numbered and named, and 4.7, Layer 2 security, which adds storm control and RA guard to the v1.1 trio.
From here the map moves from features set on one box to policy pushed to many: automation and programmability is where controllers and APIs take over that job.
ACL and port-protection frames
Several frames hinge on one keyword or one interface direction, so read each entry character by character before you choose. The practice test, filtered to ACLs and Layer 2 security, mixes these frames with the rest of the blueprint.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 015 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 015Choose 2
Which two statements correctly describe ACLs (Access Control Lists) on a router? (Choose two.)
Choose 2 options, then Check answer. Open the note under any option to see why.
Note on A
Correct. With ‘ip access-group’, an ACL can be applied in or out on an interface, one per direction per protocol.
Note on B
Correct. Each entry permits or denies packets that match criteria such as source, destination, protocol or port.
Note on C
ACL entries match IP header fields. A standard or extended IP ACL has no VLAN ID field to match at all.
Note on D
Moving traffic between VLANs is routing or Layer 3 switching. An ACL only decides which packets are permitted.
Best answers: A and B · why
An IP access control list is an ordered list of permit and deny entries. A router checks a packet against the entries from the top, acts on the first match, and drops anything that matches nothing (the implicit deny). Standard ACLs match the source address; extended ACLs also match destination, protocol and ports. The list does nothing until it is applied, with ‘ip access-group’ inbound or outbound on an interface.
- Frame 002 of 015
An administrator observes that a switch port configured for voice VLAN traffic remains suspended despite proper configuration. Which security feature could be responsible?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Without LLDP the phone may not learn its voice VLAN, but the switch does not suspend the port for that.
Note on B
Allowed VLAN lists apply to trunks; an access port with a voice VLAN is not shut down by them.
Note on C
Routing settings have no effect on whether a Layer 2 access port is up.
Note on D
Correct: a phone and a PC can exceed a maximum of one MAC, and the default shutdown mode err-disables the port.
Best answer: D · why
A port with a voice VLAN usually sees at least two MAC addresses, the phone and the PC behind it. With port security left at maximum 1 and violation mode shutdown, the port goes err-disabled. Raise switchport port-security maximum, then bounce the port with shutdown and no shutdown, or configure errdisable recovery.
- Frame 003 of 015
When configuring access control lists (ACLs) on a Cisco device, what is the role of a ‘deny’ statement compared to a ‘permit’ statement?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: a deny entry drops traffic that matches it, while a permit entry lets matching traffic through.
Note on B
Logging is an optional keyword on any entry; it is not what ‘deny’ means.
Note on C
QoS uses ACLs to classify, but ‘deny’ itself is a filtering action, not a priority.
Note on D
ACLs filter or match traffic; they do not redirect it to another route.
Best answer: A · why
Each ACL entry either permits or denies matching packets, and the router acts on the first entry that matches, from the top down. A deny drops the packet. Every ACL ends with an implicit deny any, so it needs at least one permit. The log keyword can be added to either action.
- Frame 004 of 015
After configuring a router to ensure only authorized devices can access the network, an administrator wants to verify their configuration. Which command should they run to do this?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
This shows interface status, counters and errors, not the access rules.
Note on B
The startup config shows what loads at boot, not the rules running now or their match counts.
Note on C
This shows each interface’s address and status; it says nothing about which traffic is allowed.
Note on D
Correct: it shows every IPv4 ACL with its entries and match counters, so you can see the rules are being hit.
Best answer: D · why
show ip access-lists lists each IPv4 ACL with its entries in order and the number of matches per entry, which confirms that traffic is hitting the rules. show ip interface shows which ACL is applied inbound or outbound on an interface, and show running-config shows the configured text.
- Frame 005 of 015
What role does DHCP snooping play when used alongside dynamic ARP inspection (DAI) on a Cisco switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Snooping watches only DHCP messages; it does not measure CPU or memory.
Note on B
Correct: snooping records each client’s IP, MAC, VLAN and port, and DAI checks ARP packets against that table.
Note on C
Neither feature encrypts anything; both inspect and filter traffic in clear text.
Note on D
Snooping does not assign addresses; it learns the ones a trusted DHCP server leases.
Best answer: B · why
DHCP snooping marks ports as trusted (toward the real DHCP server) or untrusted, drops server messages arriving on untrusted ports, and builds a binding table of IP, MAC, VLAN and port from the leases it sees. Dynamic ARP Inspection uses that table to drop ARP packets whose IP-to-MAC pair does not match, which stops ARP spoofing.
- Frame 006 of 015
Which security feature limits the number of MAC addresses that can be learned on a switch port?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Storm control limits the rate of broadcast, multicast or unicast traffic, not the number of MAC addresses.
Note on B
Correct: port security caps the MAC addresses learned on a port (one by default) and acts on a violation.
Note on C
DHCP snooping filters DHCP messages; it does not cap MAC learning.
Note on D
DAI validates ARP packets; MAC address limits are not part of it.
Best answer: B · why
Port security limits how many source MAC addresses a port may learn (default maximum 1), whether learned dynamically, configured statically or made sticky. On a violation it reacts with protect, restrict or shutdown (the default). It counters MAC flooding and unauthorized devices.
- Frame 007 of 015
Which command is used to activate port security on a Cisco switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
There is no ‘security’ switchport mode; the port must be in access (or trunk) mode before port security.
Note on B
‘security-port enable’ is not an IOS command.
Note on C
‘port-security enable’ is not IOS syntax; the command starts with ‘switchport’.
Note on D
Correct: on an access port, ‘switchport port-security’ turns the feature on with its defaults.
Best answer: D · why
Port security is enabled per interface: switchport mode access, then switchport port-security. Optional commands set the maximum, mac-address sticky and the violation mode. show port-security interface shows the status and the violation count.
- Frame 008 of 015
Which Layer 2 security feature limits the rate of broadcast, multicast, or unicast traffic to prevent network flooding attacks?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Port security limits MAC addresses per port, not the traffic rate.
Note on B
Correct: storm control measures broadcast, multicast or unicast traffic per port and drops it or shuts the port when a threshold is crossed.
Note on C
Private VLANs isolate ports from each other within a VLAN; they do not police rates.
Note on D
Root guard protects the STP root placement; it does not limit flooded traffic.
Best answer: B · why
storm-control broadcast (or multicast, or unicast) level sets a threshold as a percentage of bandwidth or in packets or bits per second. Traffic above it is dropped for the rest of the interval, and storm-control action can also shut down the port or send an SNMP trap.
- Frame 009 of 015
Which feature ensures that DHCP messages are not processed by unauthorized devices on a switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
PAgP negotiates EtherChannel bundles; it does not filter DHCP.
Note on B
Correct: only trusted ports may carry DHCP server replies, so a rogue server on an access port is blocked.
Note on C
PEAP is an EAP method for 802.1X authentication, not a DHCP filter.
Note on D
This is a generic name for a Layer 3 data unit, not a switch security feature.
Best answer: B · why
DHCP snooping classifies switch ports as trusted or untrusted. Server messages such as Offer and ACK are accepted only on trusted ports, usually the uplink toward the real server, so a rogue DHCP server cannot hand out a false gateway. Rate limits on untrusted ports also slow starvation attacks.
- Frame 010 of 015Choose 3
Port security on a switch interface can work with three types of secure MAC address. Which three are they? (Choose three.)
Choose 3 options, then Check answer. Open the note under any option to see why.
Note on A
Correct. Static secure addresses are typed in with ‘switchport port-security mac-address’ and are saved in the configuration.
Note on B
Correct. With the sticky option, learned addresses are added to the running configuration and kept if it is saved.
Note on C
ACLs filter by IP addresses and ports on routers and SVIs. They are a separate feature, not a type of secure MAC address.
Note on D
IPsec security associations protect IP tunnels between peers. They have nothing to do with switch port security.
Note on E
Correct. Dynamic secure addresses are learned from incoming frames and kept only in the address table, not the configuration.
Best answers: A, B and E · why
Port security limits which and how many MAC addresses may use a switch port. The allowed addresses are called secure MAC addresses and come in three types. Static ones are configured by hand. Dynamic ones are learned from traffic and lost on a restart. Sticky ones are learned from traffic but written into the running configuration, so saving it keeps them. When a violation happens, the port reacts in shutdown, restrict or protect mode.
- Frame 011 of 015Choose 3
Which three sentences describe how a firewall ruleset works? (Choose three.)
Choose 3 options, then Check answer. Open the note under any option to see why.
Note on A
Correct: rules are first-match, so once a packet matches, that rule’s action applies and later rules are ignored.
Note on B
Rules are applied in order, not by strictness; a broad permit near the top can override a strict deny below it.
Note on C
Order is set by the policy, and denies often come first to block specific traffic before a wider permit.
Note on D
Correct: traffic is compared against the rules from the top down, so the order of rules matters.
Note on E
Correct: traffic that matches no rule hits the default deny at the end and is dropped.
Best answers: A, D and E · why
Firewall rulesets and ACLs are read from the top down, and the first matching rule decides: its action is taken and processing stops. Traffic that matches nothing falls to a default deny. So specific rules go above general ones, and order rather than strictness determines the result.
- Frame 012 of 015Choose 2
Which two commands are used to configure port security on a switch that has its interfaces in VLAN 20? (Choose two.)
Choose 2 options, then Check answer. Open the note under any option to see why.
Note on A
This enables Dynamic ARP Inspection for VLAN 20, a different feature from port security.
Note on B
Correct: on each access port in VLAN 20, this enables port security.
Note on C
Correct: this sets the violation action, so excess MACs are dropped and logged while the port stays up.
Note on D
Port security is set on access ports here, and making the ports trunks takes them out of VLAN 20 access mode.
Best answers: B and C · why
Port security is configured per interface: switchport mode access, switchport access vlan 20, switchport port-security, then optional settings such as switchport port-security maximum 2 and switchport port-security violation restrict, which drops and logs excess MACs and increments the counter without err-disabling the port.
- Frame 013 of 015
How do access control lists (ACLs) function as part of a layered security strategy in a Cisco network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Updating antivirus signatures happens on endpoints; ACLs never touch host software.
Note on B
ACLs drop packets whenever a deny matches, so they are not passive monitors.
Note on C
ACLs do not encrypt; encryption comes from IPsec, TLS or SSH.
Note on D
Correct: ACL entries permit or deny packets by address, protocol and port, adding one filtering layer among the others.
Best answer: D · why
In a layered design, ACLs are a network-layer filter: they permit or deny packets by source and destination address, protocol and port, on router interfaces, vty lines or switch VLANs. They complement firewalls, endpoint protection, AAA and encryption rather than replacing any of them.
- Frame 014 of 015
A standard ACL must stop host A (10.10.1.25) from reaching server S (10.30.5.10), while A keeps access to every other network. R1 is A’s default gateway, and R3’s Gi0/2 is the gateway interface for S’s subnet. Where should the ACL be applied?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A standard ACL cannot check the destination. Placed at the source, a deny for 10.10.1.25 would cut A off from every network.
Note on B
This is still near the source. Every packet A sends off its LAN leaves this way, so A would lose all remote access.
Note on C
Inbound on Gi0/2 filters packets coming from S’s subnet, whose source is S, so a deny for host A’s address would never match there.
Note on D
Correct. A standard ACL sees only the source, so placing it next to S denies A just on the path into S’s subnet.
Best answer: D · why
A standard ACL matches only the source address. Placed near the source, a deny for host A blocks A from every destination beyond that point, not just from server S. The usual guidance is therefore to apply standard ACLs as close to the destination as possible, and extended ACLs, which can also match destination, protocol and port, close to the source so unwanted traffic is dropped early. Here the filter goes outbound on R3 Gi0/2, so only packets entering S’s subnet are checked. Sources: Cisco’s IP access list document (standard ACLs match source only) and Cisco Press guidance on ACL placement.
- Frame 015 of 015
Which ACL entry permits HTTPS traffic from hosts in 10.1.1.0/24 to the web server 192.0.2.10 and nothing else?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Numbers 1 to 99 are standard ACLs, which match only a source address and have no protocol or port fields, so IOS rejects this entry.
Note on B
Correct. A number from 100 to 199 makes it extended; source comes first, then destination, and ‘eq 443’ after the destination matches HTTPS.
Note on C
Source and destination are reversed. This matches packets from the server to the hosts with destination port 443, not the requests.
Note on D
Here ‘eq 443’ follows the source, so it matches source port 443. Client requests use a random source port and destination port 443.
Best answer: B · why
An extended ACL uses numbers 100 to 199 (or 2000 to 2699) and matches protocol, source, destination and ports, in that order: protocol, source address and wildcard, optional source port, destination address and wildcard, optional destination port. HTTPS requests go to TCP port 443 on the server, so the port test must follow the destination: ‘host 192.0.2.10 eq 443’. A standard number cannot take protocol or port fields, swapping source and destination matches the reverse direction, and ‘eq 443’ after the source tests the client’s source port. Source: Cisco’s document on configuring IP access lists.
ACL and port-security questions
Which ACL numbers are standard and which are extended?
1 to 99 and 1300 to 1999 are standard; 100 to 199 and 2000 to 2699 are extended. The first range of each type is the one worth knowing cold, since the expanded ranges follow the same split.
Where else do wildcard masks appear?
In the OSPF network command, which uses the same 0-means-match logic to select interfaces. The OSPF and first-hop redundancy area covers that side.
What does RA guard stop?
A host, or an attacker’s laptop, sending IPv6 Router Advertisements that would make other hosts use it as their default router or adopt a rogue prefix. It is a v2.0 addition to the Layer 2 security topic.
Concepts in this study area
- DHCP snooping and DAITrusted ports, the binding table and how DAI uses it.
- Wildcard vs subnet maskInverse bits, host and any, ACLs and OSPF network statements.