Which of the following descriptions about the ACL matching mechanism are correct? (Multiple choice)

Question

Options

• AAfter the packet matches the ACL, only two results will be generated: "match" and "mismatch".
• BWhen the matching order of the ACL is the config mode, it will be matched in descending order of the serial number
• CWhen the packet matches the ACL and its corresponding rule, and the ACL action is "permit", the matching result is "match". When the packet hits the rule and the ACL action is "deny", it returns to the result is "does not match"
• DIf the ACL exists but there is no rule inside the ACL, the result will be directly returned as "does not match"

• A
  73% (32)
• B
  9% (4)
• C
  18% (8)

Explanation

Options A and D are correct because ACL matching produces exactly two outcomes - "match" (the packet hit a rule) or "mismatch" (no rule was triggered) - and an ACL with no configured rules behaves as if every packet misses, returning "mismatch" immediately by design.

Option B is wrong because "config" mode matches rules in ascending order of sequence number (i.e., the order they were configured), not descending. Descending order would mean evaluating the most recently added rules first, which is backwards.

Option C is wrong because it conflates the matching result with the rule action. Whether a matched rule is "permit" or "deny" determines what happens to the packet (forwarded vs. dropped), but the matching result itself is still "match" in both cases - the two concepts are independent.

Memory tip: Think of ACL matching like a ticket scanner - it only answers "did I find your ticket?" (match/mismatch). What happens after finding it (let you in = permit, turn you away = deny) is a separate decision. An empty ACL is like a scanner with no valid tickets loaded - everything mismatches.

No community discussion yet for this question.