To improve security, a network engineer needs to configure an access list on a router. In which mode can this list be configured?

Global configuration mode (entered via 'configure terminal' from privileged EXEC mode) is where ACL entries are created using commands such as 'access-list 101 permit ...' or 'ip access-list extended NAME'. Once the ACL is defined at the global level, it is then applied to a specific interface in interface configuration mode using 'ip access-group', but the list definition itself must exist in global configuration.

User EXEC mode provides only basic monitoring commands such as 'ping' and limited 'show' commands and does not permit any configuration of ACLs or security policies.

Privileged EXEC mode enables elevated monitoring and management operations but is not a configuration context - creating an ACL requires entering global configuration mode from privileged EXEC.

Interface configuration mode is used only to bind an already-defined ACL to an interface with 'ip access-group', not to create the ACL entries themselves, which must be defined first in global configuration.