150-130 · Question #115
What is the default implicit behavior at the end of an ACL?
The correct answer is C. deny any. See the full explanation below for the reasoning.
Question
What is the default implicit behavior at the end of an ACL?
Options
- Alog
- Bpermit any
- Cdeny any
- Dremark
How the community answered
(31 responses)- A13% (4)
- B10% (3)
- C74% (23)
- D3% (1)
Community Discussion
4
Wesley A.Mar 7, 2026C is correct. Every Cisco ACL has an invisible "deny any" statement at the very end, so any traffic that does not match an explicit permit entry gets silently dropped, which is exactly why you always need to think through what you are permitting before you apply an ACL to an interface.
Viktor S.Mar 7, 2026Wesley is right that the implicit deny is always there, but "silently dropped" is worth flagging because depending on your logging config and whether you have a permit statement with the log keyword, drops can absolutely show up in your syslog, so trainees should not assume stealth equals no visibility.
Ola B.Feb 14, 2026The "implicit" wording trips up some folks who confuse this with named ACLs having an explicit deny you typed yourself, but whether implicit or explicit, every Cisco ACL ends with a deny any that drops anything not matched above, so C is your answer and you will see that behavior in every lab you spin up to verify it.
Viktor S.Feb 22, 2026The answer is C, and if you missed it you are probably one of those people who memorized dump sheets instead of actually reading how ACLs work. Every Cisco ACL has an implicit "deny any" tacked on at the very end, invisibly, and it does not show up when you run "show access-lists" which is exactly what trips people up on the job when half their traffic mysteriously vanishes. The whole point of that implicit deny is security by default, meaning anything you did not explicitly permit gets dropped, so the burden is on you to write permit statements for the traffic you want, not the other way around. On my actual exam I saw a question worded in a confusing way about what happens to traffic that "does not match any ACE," and I just reminded myself that an ACL without an explicit permit is basically a brick wall, confirmed C, and moved on without second-guessing myself.