What is the primary purpose of an access control list (ACL) on a Cisco IOS device?

To encrypt traffic between two sites over an untrusted network

To filter traffic based on criteria such as source/destination IP, protocol, and port

To provide dynamic routing information to neighboring routers

To translate private IP addresses to public IP addresses for internet access

A security engineer needs to block traffic from a specific host (172.16.5.10) to a web server (10.10.10.5) on port 443, but must allow all other traffic between these two hosts. The engineer creates an extended ACL. Which entry should be placed first in the ACL to meet this requirement?

deny tcp host 172.16.5.10 host 10.10.10.5 eq 443

deny ip host 172.16.5.10 host 10.10.10.5

Which of the following is a typical criterion that an extended ACL can use to filter traffic?

Source and destination IP addresses, protocol, and port numbers

Which command is used to create a numbered extended ACL on a Cisco IOS router?

access-list 100 permit tcp any any eq 80

access-list 10 permit host 192.168.1.1

Which type of traffic is directly affected by Control Plane Policing?

Traffic destined to the router's CPU, such as routing protocol packets

Traffic that is forwarded through the router between two remote networks

Traffic that is generated by the router itself, such as SNMP traps

Traffic that is broadcast on a LAN segment

CiscoCertified Network Professional Enterprise

Domain 5Objective 2

5.2 Configure and Verify Infrastructure Security Features 350-401 Practice Questions (Page 1)

Part of the 5.0 Security domain, which accounts for 20% of the 350-401 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

7concepts

20%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of an access control list (ACL) on a Cisco IOS device?
Select an answer first
2application · medium
A security engineer needs to block traffic from a specific host (172.16.5.10) to a web server (10.10.10.5) on port 443, but must allow all other traffic between these two hosts. The engineer creates an extended ACL. Which entry should be placed first in the ACL to meet this requirement?
Select an answer first
3foundation · easy
Which of the following is a typical criterion that an extended ACL can use to filter traffic?
Select an answer first
4foundation · easy
Which command is used to create a numbered extended ACL on a Cisco IOS router?
Select an answer first
5foundation · easy
Which type of traffic is directly affected by Control Plane Policing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-401” is a trademark of its owner, used for identification only.