An assessor's office adds a new deny ACE to a civic edge ACL and needs proof the entry is matching production traffic. Which verification cue is most direct?
Select an answer to reveal the explanation.
Short Explanation
Hit counters are the turnstile clicker on each ACL line. If the new deny's number keeps climbing, that entry is actually catching traffic.
Full Explanation
When an assessor's office adds a new deny ACE to a civic edge ACL and needs proof the entry is matching production traffic, the most direct verification cue is ACL hit counters on that specific ACE incrementing as matching packets arrive. Hit counters are per-entry evidence that the ACE is reachable in top-down evaluation and that packets match its criteria. The correct cue works because configuration presence alone does not prove matching; counters (and careful clearing/retesting) do. Expecting the ACL filename in flash to change every time a packet matches fails because ACL hit processing does not rewrite flash filenames. Believing BGP community lists rewrite themselves when hits occur fails conceptually: community lists are routing-policy objects unrelated to data-plane ACL hit accounting. Assuming the interface bandwidth statement automatically decreases by the deny count fails because bandwidth is an administrative metric for routing/QoS references, not a live deny counter. Exam caveat: an ACE with zero hits may be correct but shadowed by an earlier match, or traffic may not be taking the expected path—zero is diagnostic, not always "broken ACE syntax." Operational check: clear counters on the ACL, generate or wait for matching traffic, show access-lists and confirm the new deny's hits increment; if not, check order, direction, and actual packet path through the civic edge.