In Cisco IOS, which of the following commands is a correct example of a standard IP access list statement used to match specific IPv4 traffic?

Difficulty: Medium

Correct Answer: access-list 1 deny 172.16.10.1 0.0.0.0

Explanation:


Introduction / Context:
Access control lists, often called ACLs, are a core topic in Cisco certification exams and real world router configurations. Standard IP access lists use only source IPv4 addresses and wildcard masks and are identified by specific number ranges or names. This question asks you to recognise a correctly formed standard access list command among several similar but incorrect examples.


Given Data / Assumptions:

    We are working with numbered Cisco IOS standard IP access lists.
    Standard lists use numbers from 1 to 99 and 1300 to 1999.
    Standard lists match only source IP addresses with an optional wildcard mask, not protocols or ports.
    The syntax must follow the Cisco IOS format: access-list list-number {permit|deny} source wildcard-mask.


Concept / Approach:
To identify a valid standard ACL line, you need to check three things. First, confirm that the list number is in the standard ACL range. Second, ensure that the syntax matches the simple source plus wildcard form, without protocol or port information that would make it an extended ACL. Third, verify that spacing and keywords are correct and that no extra words such as the word standard appear in the command where they do not belong.


Step-by-Step Solution:
Look at option a: access-list 110 uses list number 110, which is in the extended ACL range, not the standard range, so this is not a standard ACL. Option b uses access-list 1, which is in the standard range, and the format deny 172.16.10.1 0.0.0.0 is valid, because a wildcard mask of 0.0.0.0 matches exactly that single host address. Option c also uses list 1 but combines 172.16.10.1 with 255.255.0.0, which looks like a subnet mask rather than a wildcard mask; a correct wildcard for a big block would look like 0.0.255.255 instead. Option d uses access-list standard 1 1.1.1.1, which is not valid IOS syntax because the keyword standard is not used this way in numbered ACLs. Option e uses list number 101, which again falls into the extended ACL range and is not a standard ACL example.


Verification / Alternative check:
Cisco documentation shows examples such as access-list 1 permit 10.0.0.0 0.255.255.255 and access-list 1 deny host 172.16.10.1 or access-list 1 deny 172.16.10.1 0.0.0.0. All of these follow the pattern list number in the standard range, followed by permit or deny, source address and wildcard mask. Comparing these examples with the options confirms that option b matches the expected form of a standard ACL entry.


Why Other Options Are Wrong:
Option a uses list number 110, which belongs to extended ACLs and would normally include protocol and possibly ports. It is not a standard ACL.
Option c uses a value that looks like a subnet mask, not a wildcard mask, and therefore does not reflect a correct standard ACL example for basic exam style questions.
Option d introduces the keyword standard in the wrong place, making the syntax invalid.
Option e uses list number 101, which is an extended ACL and would not be classified as a standard ACL.


Common Pitfalls:
Learners sometimes mix up wildcard masks with subnet masks or assume that any access-list command is standard regardless of its number. Another common mistake is forgetting that standard ACLs only match source addresses and never include transport layer ports or destination addresses. Remember that the list number and the presence or absence of protocol information are strong clues about whether an ACL is standard or extended.


Final Answer:
The correct example of a standard IP access list is access-list 1 deny 172.16.10.1 0.0.0.0.

More Questions from CISCO Certification

Discussion & Comments

No comments yet. Be the first to comment!
Join Discussion