Comments on: CCNA – Access List Questions

By: Anonymous

Anonymous — Wed, 27 Aug 2014 02:10:00 +0000

Ola amingos minha mae colocou senha no roteado e nao consigo saber senha sei que ipei 192.168.1.128 alguem pode me ajundar adescobri

By: Wall Cookie

Wall Cookie — Mon, 05 May 2014 15:50:59 +0000

Q5:
Option A and D are synonymous.

You can use “host” with the host destination IP or you can use the wildcard mask of 0.0.0.0
Both work the same.
The “host” statement does not designate a standard access-list statment as there is no destination IP/network in a standard access-list, only the source IP/network.

By: Mark

Mark — Thu, 27 Mar 2014 09:56:54 +0000

Hi Guys , Can someone help me passing the exam.
I would appreciate if one of you guys who have the latest dump to send it to my email
“seafarmer11@gmail.com”

Thanks Alot

By: Ayad

Ayad — Thu, 27 Mar 2014 01:14:43 +0000

There is no command such as access-list 101 in !!

By: cabby777

cabby777 — Thu, 23 Jan 2014 00:48:59 +0000

In reference to Question 6:
What is the difference between an access-list and an access-group?
When do you use a group instead of a list?
A – access-list 101 in
C – ip access-group 101 in
Thanks

By: mohsen alattas

mohsen alattas — Thu, 09 Jan 2014 06:06:36 +0000

how was the exam easy or difficult

By: Anonymous

Anonymous — Wed, 08 Jan 2014 06:22:30 +0000

cool i have done ccna cool

By: Anonymous

Anonymous — Mon, 28 Oct 2013 05:44:39 +0000

download latest dumps from
9
t
u
t
.
c
o
m
x
a
.
c
o
m

By: abel

abel — Fri, 11 Oct 2013 15:44:48 +0000

Thanks 9tut, i passed the cisco 200-120 exams today, i had over 90 percent…………….more new questions. came accross access list, netmask and some drag and drop questions

By: ka

ka — Tue, 01 Oct 2013 22:36:48 +0000

Thanks 9tut……I passed the Cisco CCNA 640-802 exam yesterday 30-sep-2013…………!!! I got ACL 2, EIGRP and VTP. All the best to those who are preparing for the exam….

By: Alex

Alex — Fri, 27 Sep 2013 18:36:59 +0000

Hi guys,

I was wondering if someone can send me the lastes dump for the ICND2 640-816,.. this is my last attempt to pass this cert. Taking it on sept 30th. any info is greatly appreciated,, my email is Alex9094@msn.com

By: pro link building

pro link building — Tue, 24 Sep 2013 14:10:45 +0000

mpoMiz Major thankies for the article.Much thanks again. Really Cool.

By: Anonymous

Anonymous — Mon, 23 Sep 2013 01:20:28 +0000

@ Tomas on Aug 29.. Referring to Ques 1. – I got the same reasoning as 2/3 of CCNP Guy. /29 = 248 = Block of 8. So 0.0.0.7

By: citrix 1 msit

citrix 1 msit — Sat, 21 Sep 2013 11:15:15 +0000

is it just me i don’t get number 8…the image doesn’t match what needs to be selected..

By: chan

chan — Sat, 21 Sep 2013 06:32:52 +0000

guys can somebody help me with the direct link to packet tracer 6 download, i keep getting redirected

By: ansari

ansari — Wed, 18 Sep 2013 09:05:43 +0000

hi friends..
i am having exam of ccna 640-802 in sept 20 so plz any body send me a latest dump i will very thanks full to them
my email: akhtaransari555@yahoo.com

By: steph

steph — Tue, 17 Sep 2013 10:49:31 +0000

Hi friends..
Any body with current dumps can help me pls
Also i beg anybody who can help me in details about these CCNA series, help pls
My email: makonyu0759119441@gmail.com

By: latest dump

latest dump — Sat, 14 Sep 2013 10:33:58 +0000

I have the exam 640-802 in sept 20 , please send me the latest dump louldddris@yahoo.fr

Thank you

By: thanks 9tut passed the CCNA exam today! 960! sim VTP, EIGRP and ACL2

thanks 9tut passed the CCNA exam today! 960! sim VTP, EIGRP and ACL2 — Sat, 14 Sep 2013 06:46:03 +0000

Chris J

By: Samina khan

Samina khan — Thu, 12 Sep 2013 14:31:05 +0000

Cisco CCNA 640-802 exam last date is 30-sep-2013, if I will pass it before 30-sep-2013, will it valid,and if it is till what time it will valid.

By: jasostrong

jasostrong — Wed, 11 Sep 2013 13:28:49 +0000

Thanks 9tut. I made it. I passed my CCNA 200-120 today. The sim is Access-list 1 , Access-list 2 & EIGRP. A lot of new questions like Netflow, Syslog, SNMP, VRRP, and GLBP.

By: Richard

Richard — Wed, 11 Sep 2013 03:52:24 +0000

Q1 is correct!
it’s just a summary of two subnets..

By: Ali

Ali — Wed, 11 Sep 2013 00:26:37 +0000

@ Boe, it must be /22

By: Boe

Boe — Mon, 09 Sep 2013 22:15:02 +0000

Q4, should it be /21 not 22

By: Shuja

Shuja — Fri, 06 Sep 2013 13:45:58 +0000

I have the exam on 10th, can anyone send me the latest dumps please, shujaansari@outlook.com

Suggu, please can you help with the dumps?

By: suggu

suggu — Fri, 06 Sep 2013 07:00:58 +0000

Hey i cleared CCNA with 986!!!!! Thanks to 9tut….its really awesome! study labs given on site…i was having EIGRP, ACCESS-LIST,VTP. All the best to those who are preparing for exam….

By: nadim

nadim — Tue, 03 Sep 2013 13:32:34 +0000

question 1 is wrong !!!

By: Nimal

Nimal — Fri, 30 Aug 2013 23:21:58 +0000

@kb8,
Q4 is about using route summarizationand applying one ACL statement to capture the four subnets rather than applying four individual ACL statements for each of the four subnets.

read up on route summarization

By: Nimal

Nimal — Fri, 30 Aug 2013 23:18:50 +0000

Tomas is correct. ACLs don’t care about how you have subnetted your LAN. It’s job is kind of like a bouncer with a list in hand. As the ACL in Q1 is applied to the *outbound* interface s0/0 of RTB it’ll apply to any traffic coming from any of the LANs connected to RTB that are going out s0/0 !

The ACL for Question 1:
access-list 101 deny tcp 192.168.15.32 0.0.0.15 any eq telnet
access-list 101 permit ip any any

basically it says the *bouncer/guard* at s0/0 is going to block anything that tries to go out of s0/0 if they match the ip address range of
192.168.12.32 – 192.168.47, if the traffic is of TCP type and destined to a telnet port of any ip

all other traffic will be allowed by this guard

By: kb8

kb8 — Thu, 29 Aug 2013 08:10:37 +0000

Q4??

By: Adeel

Adeel — Mon, 26 Aug 2013 15:16:26 +0000

Hello Guys I hope you will be fine there. I have CCNA (640-802) and CCNA security (640-554) Vouchers on special discount of 58% for World wide, with six months expiry date till you purchase. Each voucher cost 70USD.
Details Required For CCNA Voucher For Discount Processing:
1-Full Name. 1st Name & Last Name (as you want to appear on certificate & documents)
2-Country.
3-City.
4-State.
5-Pin Code (or Area Code)
6-Residential Address (or where you can collect your Certificate or further correspondence
can be received)
7-Date of birth
Add me on Skype through this information which is written below:
Skype Name: rockon660
you can also email me at this email address which is written below:
madeelqaiser@gmail.com
If you have any Questions feel free to contact me.
Thanks,
Best regards,
Adeel

By: Tomas

Tomas — Sat, 24 Aug 2013 16:24:36 +0000

Study more. You are mixing apples and pears. The wildcard 0.0.0.15 in the access list and the subnet mask of the to lans (192.168.15.32/29 and 192.168.15.40/29) have nothing in common. The best way for you to verify the answers are correct is to simulate it. And you’ll see…

By: 2/3s of a CCNP guy

2/3s of a CCNP guy — Sat, 24 Aug 2013 05:09:43 +0000

With due respect question #1 is wrong, specifically the indicated mask of 255.255.255.248 or /29. This is due to the fact that the two indicated “correct” answers of 192.168.15.36 and 192.168.15.46 end up being on two different subnets when using the /29 mask (i.e., an increment/block size of 8) indicated on the graphic, with the former answer falling into the 192.168.15.32/29 network and the latter answer into the 192.168.15.40/29 network, which is obviously not going to work. The access list’s wildcard mask of 0.0.0.15 says that.

If you WANT those two answers TO work then you must change the indicated mask to a /28 or an increment/block size of 16, which would THEN allow the two indicated answers to fall into the 192.168.15.32/28 network, which then would be congruent with the indicated wildcard mask of 0.0.0.15. Again, block size, in this case 16, being paramount.

This shows that you have to read things CAREFULLY. If you don’t, then you’ll hang yourself. No offense to the web site editor. We all make mistakes–and Heaven only knows that I’ve made my share of networking boo boos. By the way, I sit for my CCNA on Sept. 3. GULP. “Pray” for me.

By: CiscoER

CiscoER — Thu, 22 Aug 2013 20:00:16 +0000

Q4 The configuration tells the router to start at n/w 172.29.16.0 Sounds like it is requiring block sizes of 4 So… 172.29.16.0 172.29.17.0 172.29.18.0 172.29.19.0 We match the first 2 octet with 0 0 and the last with 255 (we don’t care about last so all set to 1′s) so we have 0.0.#.255 Since block size of 4 just minus 1 from 4. Answer is C – with mask 0.0.3.255 . Well I think so lol
**It’s a Rubicon**

By: CiscoER

CiscoER — Thu, 22 Aug 2013 19:50:58 +0000

Q2 Answer is B not A You want inbound since it is an extended ACL 100-199 in this case 101. Rem for Extended ACL you want to use the port closest to the source. For Standard you want to use the port closest to the destination. Since 101 is Extended, use fa0/0 which is closest to the source (PC1) I think I got that right now i need this emblazoned in my brains
**It’s a Rubicon**
Q2 Why are the answers BC and not AC. I always get confused between inbound and outbound.
Can someone please explain the difference or why it should be inbound and not outbound?

By: sl

sl — Thu, 22 Aug 2013 01:34:50 +0000

Can some one explain Q 4 please

By: sbr

sbr — Wed, 21 Aug 2013 05:42:44 +0000

AC ,VTP,EIGRP r the questions asked in version 2 of ccna exams also?

By: Anonymous

Anonymous — Mon, 19 Aug 2013 13:01:14 +0000

PLS somebody help me with the latest dump CCNA. i want to write it next week. keltronicss@yahoo.com

thanks

By: AC

AC — Mon, 19 Aug 2013 10:25:35 +0000

Q2 Why are the answers BC and not AC. I always get confused between inbound and outbound.

Can someone please explain the difference or why it should be inbound and not outbound?

By: Aditya

Aditya — Sun, 18 Aug 2013 01:29:44 +0000

Dear 9tut,

I think the answer to Question 8 is wrong..It should be C and D..
Reason: 5.1.1.8 0.0.0.3 means –> blah blah blah 00001000 / ‘I care’ ‘I care’ ‘I care’ 00000011
The last 2 bits ’11′ says Don’t care which means it does not care what the last 2 bits are..So only .9 and .10 would be blocked.. .8 is 0000 1000..
Correct me if I am wrong.

By: Mel_88

Mel_88 — Sat, 17 Aug 2013 19:48:07 +0000

Pass CCNA thanks 9tut

By: Bhargav

Bhargav — Sat, 17 Aug 2013 15:07:54 +0000

hi
this is bhargav i am ccna certify
with cost of 10000
i will send
ccna power point study notes
ccna lab manuals
ccna command guide book

By: Johnny

Johnny — Mon, 12 Aug 2013 01:54:20 +0000

Hi Redwan, the command line access-list 2 deny 10.1.1.0 0.0.0.255 (it would deny all traffic due implicit deny any)

By: Johnny

Johnny — Mon, 12 Aug 2013 01:52:18 +0000

Hi hh86, the answer A is wrong because the traffic to server is entering (in) to router accross interface fa0/0

By: hh86

hh86 — Sun, 11 Aug 2013 21:26:58 +0000

q 2 explain

By: hh86

hh86 — Sun, 11 Aug 2013 21:26:29 +0000

Refer to the graphic. It has been decided that PC1 should be denied access to Server. Which of the following commands are required to prevent only PC1 from accessing Server1 while allowing all other traffic to flow normally? (Choose two)

accesslist2

A – Router(config)# interface fa0/0
Router(config-if)# ip access-group 101 out
B – Router(config)# interface fa0/0
Router(config-if)# ip access-group 101 in
C – Router(config)# access-list 101 deny ip host 172.16.161.150 host 172.16.162.163
Router(config)# access-list 101 permit ip any any
D – Router(config)# access-list 101 deny ip 172.16.161.150 0.0.0.255 172.16.162.163 0.0.0.0
Router(config)# access-list 101 permit ip any any

please help : why B C not A C

By: Redwan

Redwan — Wed, 07 Aug 2013 18:57:32 +0000

Q.3
ACL would be
access-list 2 deny 10.1.1.0 0.0.0.255

By: Annoyn

Annoyn — Thu, 01 Aug 2013 15:55:18 +0000

@anonymous

The syntax is correct, if you have multiple services running on a single device you would only want to filter some of them, you can limit the source port as well as the destination port.
so if I do

access-list 101 deny tcp 10.1.1.10 host eq21 10.1.1.20 host
access-list 101 permit any any

it limits the source IP from FTP data from the server

access-list 101 deny tcp 10.1.1.10 host 10.1.1.20 host eq21
access-list 101 permit any any

Limits the Server from sending FTP data back to the source address

By: Annoyn

Annoyn — Thu, 01 Aug 2013 15:44:13 +0000

Q2
While the answer C is correct, it is incomplete. You would need the host or 0.0.0.0 at the end of the statement or it returns an error

By: Eagle9

Eagle9 — Thu, 25 Jul 2013 04:06:07 +0000

Hello,

I want to enlighthen in question no. 5. Why we assumed that network 172.29.16.0 to 19 is /24? And why it was summarized them as network 172.29.16.0 as /22?

From what I know, below are the range:
1-126 = /8
128-191 = /16
192-223 = /24

Please help me understand. Thank you!

By: Shail

Shail — Tue, 23 Jul 2013 10:39:40 +0000

hello 9tut,

Thanks for your most valuable tutorials which was very helpful for me to cleared MY CCNA exam yesterday….

By: Mario

Mario — Mon, 22 Jul 2013 20:39:50 +0000

If anyone want VCE player for MAC contact me mario8890@outlook.com

By: Florian(JanflorieMutta)

Florian(JanflorieMutta) — Sat, 20 Jul 2013 06:52:04 +0000

hello ! 9tut Guys, thenx so much for ur awesome and unquantifiably biulful materials,GLORY TO GOD FOR UR EXISTENCE, I passed yesterday with 881/1000, all questions were from 9tut and spike dumps, with approximately minor modifications.

simulations were : ACCESS-LIST2, VTP, AND EIGRP-
(EIGRP sim had alot of problems in configurations, the second router was not responding during confinguration so i decided to leave it),

By: Anonymous

Anonymous — Wed, 03 Jul 2013 20:57:46 +0000

ALHUMDOLILLAH
Thanks GOD I pass today. I recommend spike dump, 9tut, and for Urdu students urduitacademy.com. All questions came from spike dump and labs from 9tut. Thanks spike, 9tut and Mr. Kashif from urduitacademy…any query —> ks_jafry@yahoo.com

By: New to CCNA

New to CCNA — Wed, 03 Jul 2013 13:29:53 +0000

Hey 9ut
the question 1 say CID is 29 means subnet is 248 but in explaination it was 240 can kindly tel me as my exam is in abt 2 days

By: anil rana

anil rana — Mon, 01 Jul 2013 03:55:55 +0000

first i noticed

q1 the all these ip range are same is it possible the all ip range equal like 192.168.15.255

the exiting router pord e0/1 and s1/0 are given same range ip address

By: Skumar

Skumar — Sun, 30 Jun 2013 10:11:36 +0000

A very good one. Thank you.

By: Bobby Guinn

Bobby Guinn — Sat, 29 Jun 2013 00:53:25 +0000

Thanks for these…… very helpful…..

By: 3C271

3C271 — Thu, 27 Jun 2013 13:45:53 +0000

Dumps are good tools to review for the exam, but be certain that the answers are correct. I came across this question, and don’t agree with the answer. Any one have any thoughts on this?

A network administrator has configured access list 173 to prevent Telnet and ICMP traffic from reaching a server with the address of 192.168.13.26. Which commands can the administrator issue to verify that the access list is working properly? (Choose three)

A. Router# ping 192.168.13.26
B. Router# debug access-list 173
C. Router# show open ports 192.168.13.26
D. Router# show access-lists
E. Router# show ip interface

The answers that are stated correct are (A), (D), (E). By performing (D) and (E), you’re looking at the configuration. But by performing (A), you’re not really testing the access list because your pinging locally from the router. The access list will not deny outbound traffic that is generated locally. How does this assist you in ensuring the ACL is working properly?

By: Placide

Placide — Mon, 24 Jun 2013 14:29:13 +0000

No way DG.
D is wrong answer for Q2 :
– 172.16.161.150 0.0.0.255 represent the network 172.16.161.0 not PC1 ip address
So B and C are correct answer for Q2

By: DG

DG — Mon, 24 Jun 2013 12:52:56 +0000

Q2.
Answer is surely wrong! I think it should be B and D???

By: inshad

inshad — Mon, 24 Jun 2013 08:36:05 +0000

I am going to take my ccna exam on next week. can anyone send the latest dumps to my email… agminshad@gmail.com

By: mawee

mawee — Mon, 24 Jun 2013 06:36:02 +0000

hi… i’m planning to take the ccna exam on August, please send the latest dumps to mawee1223@gmail.com. Thanks a lot for the help.

By: pratheep

pratheep — Sun, 23 Jun 2013 11:05:17 +0000

Hi everyone,
I am going to take my ccna exam on july first week. plz, send the latest dumps to email pratheepk02@gmail.com. Thanks for your help.

By: pmcd5333

pmcd5333 — Sun, 23 Jun 2013 08:30:46 +0000

this is an excellent site, although I failed my test. I know I will pass the next time. Most of the questions I saw were from here.

By: rudy

rudy — Mon, 17 Jun 2013 22:21:41 +0000

801 oh my gosh, only 1 or 2 more questions.

By: jiggiegene

jiggiegene — Mon, 17 Jun 2013 21:24:56 +0000

@ccnamob question #5 also remeber acl number 1-99 are standard access list and you can only filter on source address. 100-199 are extended access list that is why folling answer is wrong” D – access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23
access-list 1 permit ip any any”

By: Hi

Hi — Mon, 17 Jun 2013 20:35:27 +0000

Failed with 801 score some questions were new. But alot from here…

By: Raj

Raj — Fri, 14 Jun 2013 14:10:17 +0000

All,

Can anyone make me clear about q.1 – Increment: 16? How the Increment works out like this.

Look forward to hearing from you expert guys soon.

Thanks

By: CCNA noob

CCNA noob — Fri, 14 Jun 2013 09:17:02 +0000

@9Tut,

I can’t believe I missed the access list number! I even wrote that in by hand! GRRRRRR.

Thank you for spotting it! I need to pay closer attention. :)

By: 9tut

9tut — Thu, 13 Jun 2013 05:52:29 +0000

@CCNA noob: The answer “Access-list 101 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23″ is correct and it is the same as the “Access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23″ command. But the second statement of the incorrect answer (access-list permit ip any any) is missing the acl number 101.

By: CCNA noob

CCNA noob — Thu, 13 Jun 2013 00:04:29 +0000

Hey 9Tut,

First I have to say “Thank you” for all your work and dedication to helping others with their paths along Cisco certification. I plan on taking my test in the next few weeks and am VERY glad I found this site!

OK, onto the question: This comes from the ACL questions 1 section. I had an issue with one of the answers of the questions that I have put below. Thank you for your assistance.

A network administrator wants to add a line to an access list that will block only telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task.

Correct Answer: Access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any

Incorrect Answer: Access-list 101 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23
access-list permit ip any any

Why is the second option incorrect when the destination is a single address?

By: unknown

unknown — Wed, 12 Jun 2013 07:37:35 +0000

Hi All
can someone tell how the increment in q1 is 16 when it is /29 ?

By: question 1 ..its in the exhibit /29

question 1 ..its in the exhibit /29 — Wed, 12 Jun 2013 04:46:19 +0000

question 1 ..its in the exhibit /29 .. but in the explanation increments as it is /28

By: Nero

Nero — Tue, 04 Jun 2013 09:13:27 +0000

Dear Pk,

I think i know what you are concerned about.In q8 the access-list denies the 5.1.1.8/30 ip range, so those two pc’s on that subnet cant access telnet.
The access list does not want to block the whole /24 range but only those pc’s.

By: Nero

Nero — Tue, 04 Jun 2013 09:10:34 +0000

Hi PK,

Dont forget, you have a broadcast addres as well, so if you have a range of four addresses, then you practically only have two assignable ip.
Put it in an example: 192.168.1.4/30
so you have 192.168.1.4, which is the network address
192.168.1.5, 192.168.1.6, usable host addresses
192.168.1.7 this is the broadcast address, so you cant assign this address.

By: anonymous

anonymous — Sun, 02 Jun 2013 12:38:21 +0000

Question 7

access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 20 any
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 21 any
–the syntax is wrong.. eq 20 shud be after any..
or am i wrong? does it still work?

By: Anonymous

Anonymous — Thu, 30 May 2013 14:20:56 +0000

It is a good practice to apply the ACL on the interface closest to the source of the traffic. According to cisco`http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml
`

By: PK

PK — Sun, 26 May 2013 12:07:05 +0000

Q8. Oh no. I have confused in the network diagram it is /24 then it comes to Access list only 0.0.0.3 . Interesting. Is this means you can block just 4 hosts out of 254 host here?

By: PK

PK — Sun, 26 May 2013 11:59:40 +0000

Q8 I don’t understand if the the increment is 4,
5.1.1.8 0.0.0.3 which means 5.1.1.8/ 255.255.255.252
5.1.1.12
host assignable IP range should be 5.1.1.9-5.1.1.11

How it has allocated subnet ID on a host?
I am confused. Can this be done? Can someone explain to me?