Which statement about FlexConnect ACLs is true?

Which statement about FlexConnect ACLs is true?

• A. They do not support the implicit deny rule
• B. They can be configured with a per-rule direction
• C. They are supported on the native VLAN
• D. They are applied per AP and per interface

Answer: (C)

FlexConnect ACLs run on the AP when traffic is locally switched, giving you edge enforcement of policy for WLAN user traffic. Because these ACLs operate on the VLANs mapped to the FlexConnect interfaces, they can apply to the native VLAN just like any other VLAN configured for the WLAN. That means untagged traffic on the AP–switch link (the native VLAN) can be filtered by a FlexConnect ACL, which is why this statement is true. In practice, ACLs are evaluated at the AP for locally switched traffic, and they apply to the VLANs associated with the FlexConnect interface. The idea that they lack an implicit deny, or that they are defined per-rule direction, or that they’re strictly applied per AP and per interface, doesn’t align with how FlexConnect ACLs are implemented—those concepts don’t reflect how these ACLs are defined and enforced in real use.

FlexConnect ACLs run on the AP when traffic is locally switched, giving you edge enforcement of policy for WLAN user traffic. Because these ACLs operate on the VLANs mapped to the FlexConnect interfaces, they can apply to the native VLAN just like any other VLAN configured for the WLAN. That means untagged traffic on the AP–switch link (the native VLAN) can be filtered by a FlexConnect ACL, which is why this statement is true.

In practice, ACLs are evaluated at the AP for locally switched traffic, and they apply to the VLANs associated with the FlexConnect interface. The idea that they lack an implicit deny, or that they are defined per-rule direction, or that they’re strictly applied per AP and per interface, doesn’t align with how FlexConnect ACLs are implemented—those concepts don’t reflect how these ACLs are defined and enforced in real use.