Home > CCNA Access List Sim

CCNA Access List Sim

January 5th, 2019 Go to comments

Question

accesslist_sim

Answer and Explanation

Note: If you are not sure about Access-list, please read my Access-list tutorial. You can also download this sim to practice (open with Packet Tracer) here: http://juquitiba.sp.gov.br/?exams=download/9tut.com_CCNA_Access_List_Sim.zip

For this question we only need to use the show running-config command to answer all the questions below

Router>enable
Router#show running-config

accesslist_sim_showrun1

accesslist_sim_showrun2

accesslist_sim_showrun3

Question 1

How can we fix the problem but only allow ping to work while disabling telnet?

A – Correctly assign an IP address to interface fa0/1
B – Change the ip access-group command on fa0/0 from “in” to “out”
C – Remove access-group 106 in from interface fa0/0 and add access-group 115 in.
D – Remove access-group 102 out from interface s0/0/0 and add access-group 114 in
E – Remove access-group 106 in from interface fa0/0 and add access-group 104 in

 

Answer: E

Explanation

Let’s have a look at the access list 104:

accesslist_sim_answer1

The question does not ask about ftp traffic so we don’t care about the two first lines. The 3rd line denies all telnet traffic and the 4th line allows icmp traffic to be sent (ping). Remember that the access list 104 is applied on the inbound direction so the 5th line “access-list 104 deny icmp any any echo-reply” will not affect our icmp traffic because the “echo-reply” message will be sent over the outbound direction.

Question 2

What will happen after issuing the command “ip access-group 114 in” to the fa0/0 interface?

A – Attempts to telnet to the router would fail
B – All traffic from the 10.4.4.0 network would be allow to go through
C – TCP and UDP traffic are not allowed to pass
D – Routing protocol updates for the 10.4.4.0 network would not be accepted from the fa0/0 interface

 

Answer: B

Explanation

From the output of access-list 114: access-list 114 permit ip 10.4.4.0 0.0.0.255 any we can easily understand that this access list allows all traffic (ip) from 10.4.4.0/24 network

Question 3

What will happen after issuing the command “access-group 115 in” on the s0/0/1 interface?

A – Hosts cannot connect to Router through s0/0/1
B – Telnet and ping would work but routing updates would fail.
C – FTP, FTP-DATA, echo, and HTTP traffic would work but telnet would fail
D – Only traffic from the 10.4.4.0 network would pass through the interface

 

Answer: A

Explanation

First let’s see what was configured on interface S0/0/1:

accesslist_sim_answer3

Recall that each interface only accepts one access-list, so when using the command “ip access-group 115 in” on the s0/0/1 interface it will overwrite the initial access-list 102. Therefore any telnet connection will be accepted (so we can eliminate answer C).
B is not correct because if telnet and ping can work then routing updates can, too.
D is not correct because access-list 115 does not mention about 10.4.4.0 network. So the most reasonable answer is A.

But here raise a question…

The wildcard mask of access-list 115, which is 255.255.255.0, means that only host with ip addresses in the form of x.x.x.0 will be accepted. But we all know that x.x.x.0 is likely to be a network address so the answer A: “no host could connect to Router through s0/0/1” seems right…

But what will happen if we don’t use a subnet mask of 255.255.255.0? For example we can use an ip address of 10.45.45.0 255.255.0.0, such a host with that ip address exists and we can connect to the router through that host. Now answer A seems incorrect!

Please comment if you have any idea for this sim!

Comments
Comment pages
1 27 28 29 39
  1. Acl 106
    October 6th, 2018

    Why is the switch not pinging the router but when I check the ACL 106, it’s only denying telnet requests? Icmp requests are permitted tho

  2. Anonymous
    October 24th, 2018

    Hi All, preparing SIM from 9TUT is enough to appear in the exam?

  3. Q3
    October 29th, 2018

    @9tut isn’t thar true?

    Robesz July 7th, 2013
    Q3 solution!

    Look at the question!
    What would be the effect of issuing the command “”””””access-group 115 in””””” on the s0/0/1 interface?

    Without the word “ip”, the command would not work at all, so access-list 102 would be stayed there, what says the following:

    permit ftp
    permit fpt-data
    deny telnet
    deny echo-reply
    permit any any

    The only answer, which fits to these conditions is only “C”!
    C – FTP, FTP-DATA, echo, and www would work but telnet would fail

  4. Gomida
    November 7th, 2018

    Question 1
    How can we fix the problem but only allow ping to work while disabling telnet?
    A – Correctly assign an IP address to interface fa0/1
    B – Change the ip access-group command on fa0/0 from “in” to “out”
    C – Remove access-group 106 in from interface fa0/0 and add access-group 115 in.
    D – Remove access-group 102 out from interface s0/0/0 and add access-group 114 in
    E – Remove access-group 106 in from interface fa0/0 and add access-group 104 in

    Answer: E

    B. is also looks right answer to me…check changing the ip access-group command on fa0/0 from “in” to “out”
    ip access-group 106 in will be changed to out.
    access-list 106 permit tcp any any eq ftp
    access-list 106 permit tcp any any eq ftp-data
    access-list 106 deny tcp any any eq telnet
    access-list 106 permit icmp any any echo-reply
    This will efficiently allow ICMP while denying telnet.
    What do you think editors, your comment is highly appreciated

  5. rhgondo
    November 7th, 2018

    People, What lab do you have in the ccna 200-125 exam?

  6. gabinoguz
    November 7th, 2018

    anything knows that this lab come in the exam?

  7. Deus
    December 13th, 2018

    @gabinoguz this sim was in my exam.

  8. Nato
    January 30th, 2019

    This lab was in my exam today no changes…

  9. Drin
    February 17th, 2019

    B. Will not be correct since when you changed in to out. Telnet from the switch will be accepted since the request will be coming from the switch. This is based on the condition given. “An administrator is trying to ping and telnet from Switch to Router”

    So E is the best answer on question 1 :-)

  10. VCE PLAYER LASTES VERSİON
    February 19th, 2019

    does anyone has last of VCE exam simulation setup with crack ???? could you send me mail please..

    halilalban at outlook dat com

  11. Erez
    March 12th, 2019

    I had the CCNA exam today and passed!!! total 62 questions.
    The recent dumps are valid + new questions of 9tut
    Many questions are from new 9tut new questions categories.
    Only 2 questions were not in dumps and 9tut.
    TS were exactly the same as 9 tut (ospf + ACL sim – Remove access-group 106 in from interface fa0/0 and add access-group 104 in)
    LAB was VLAN’s similar to 9 tut, the only problem is that “show interface trunk” command didn’t work on one console, I had to find the native from syslog.
    THANK you Ebrahem and 9tut, you helped very much :)

  12. Hung_1186
    March 23rd, 2019

    Hi all,
    in question 1, can anyone explain why answer 1b is wrong ?

  13. Ray
    March 29th, 2019

    This Sim was in the exam Tuesday, no changes.

  14. tong
    April 12th, 2019

    Erez can you send me the recent dump pls!! to thaotony11@gmail(DOT)com thanks..

  15. Konstantinos Anyfantis
    April 20th, 2019

    I passed today my CCNA and it comes this lab with a different answers I took 816/1000

  16. Josue Rdz
    April 30th, 2019

    Passed my CCNA on April 26, this lab came out, exactly like this.

    Also new questions and drag and drop questions are great support, many of them came out. It is a very good idea to study based on the explanations of each question.

    Thank you 9tut. Very helpful.

  17. Ariel
    May 11th, 2019

    Please Send me valid dump at kyliann.ariel@gmail(dot)com

  18. Gerald
    May 13th, 2019

    hie can anyone help me with avalid dump gerrydube89atgmail.com, thank u

  19. mahmoud m
    May 14th, 2019

    Please Send me valid dump at mahmoodm@ windowslive.com

Comment pages
1 27 28 29 39
Add a Comment