A Cisco ACL ends with several permit statements but no catch-all permit. What happens to a packet matching none of them?

1. The router automatically creates a permit entry
2. The implicit deny discards it
3. The packet is permitted because no explicit deny exists
4. The packet bypasses the ACL on its second attempt