Exam 200-301 topic 1 question 625 discussion

NOT A: I see alot say A, but A has a hidden deny any on the end of the list as has every access list.

A. not even sure what that means. B. is the answer because its too specific meaning its allowing everthing it shouldnt C. not the answer because if it was failing to match, then traffic would be getting denied D. not the answer because traffic would be getting denied. E. is the answer because it wouldnt matter how many deny commands if you are permitting it first at the top of the ACL

If ACL is empty it allows all packet. hidden deny works not here check here https://community.cisco.com/t5/routing/apply-empty-acl-what-happens/td-p/740473 So A is correct And D is correct B is half correct. so we have to chose 2 anwsers

A is not correct because , by default ACL block every traffic rather permit everything

B & E are correct A is incorrect, an empty ACL has "deny any any" by default

A is also correct, an empty ACL permits all traffic, there is no implicit deny..........i tried it in packet tracer and gns3

Only works with B and E

cannot be A becauyse all acl have a implicit deny any ACE at the end (no other ACE is matched)

It´s AE. An empty ACL will PERMIT all traffic. Implicit deny condition will work only if ACL has at least one user-defined condition.

B and E is correct. Because a matching permit is too broadly defined and is located too high in the list, it cannot filter any incoming traffic. A is not the answer because the empty ACL allows ALL traffics, not just incoming traffics. The question just specified all 'incoming' traffic, not 'outbound' traffic.

It can't be A because there are hidden deny end of the ACL

Like "Kijken" member said.

options BE

A can't be correct. and If a permit statement in the access list is too broad and matches more packets than intended, all incoming packets may be allowed, even though an ACL is applied to the interface.

"The behavior for access-class when the specified access list is empty (or does not exist) has changed over time. In some (quite early) versions of IOS the default behavior was followed and all traffic was denied. In most versions of IOS (in its various flavors) has been that an empty (or non existent) access list results in all traffic being permitted." Link: https://community.cisco.com/t5/routing/empty-access-list/td-p/630883

"The statement that an ACL always has an implicit deny any at the bottom has one exception. And that exception is when the ACL is empty. If you use ip access-group to apply an ACL and that ACL has no statements then all traffic is permitted." https://community.cisco.com/t5/routing/apply-empty-acl-what-happens/td-p/740473#:~:text=If%20you%20use%20ip%20access,empty%20ACL%20would%20deny%20traffic.

Answers B and E