CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: aCLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs).. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network team wants an ACL that permits HTTPS from 10.1.50.0/24 to a web server at 203.0.113.10 and denies all Telnet traffic from that subnet to any destination. Which two ACEs are required?
To meet the requirement, one ACE must explicitly permit TCP destination port 443 to the web server, and another must deny TCP destination port 23 to any destination. Option C is wrong because HTTPS (port 443) uses TCP, not UDP. Option D reverses source and destination; the deny should apply from 10.1.50.0/24 to any, not from any to that subnet. Option E permits all IP traffic, which would override the deny for Telnet, making it ineffective.
Key principle: ACLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
This option would be correct in a scenario where the question specifies a requirement to permit a UDP-based service, such as DNS over UDP, from the specified subnet to a particular host. For example, if the question asked for permitting DNS traffic from 10.1.50.0/24 to 203.0.113.10, then this option would be appropriate.
✗
deny tcp any 10.1.50.0 0.0.0.255 eq 23
Why it's wrong here
That blocks inbound Telnet toward the subnet, not outbound sessions from it.
When this WOULD be correct
In a different scenario where the requirement is to deny Telnet traffic coming from any source to the 10.1.50.0/24 subnet, option D would be correct. For example, if the question asked to prevent any Telnet access to the subnet from all external sources, this option would fulfill that requirement.
✗
permit ip any any
Why it's wrong here
That would be too broad as part of the stated requirement.
When this WOULD be correct
In a different scenario where the requirement is to allow all traffic from any source to any destination without restrictions, such as a question asking for a default permit rule in a firewall configuration, option E would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
This permits HTTPS from that subnet to the specific web server.
✗permit udp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because HTTPS operates over TCP, not UDP. The question specifically requires permitting HTTPS traffic, which necessitates the use of TCP in the ACL entry.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question specifies a requirement to permit a UDP-based service, such as DNS over UDP, from the specified subnet to a particular host. For example, if the question asked for permitting DNS traffic from 10.1.50.0/24 to 203.0.113.10, then this option would be appropriate.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of the protocols involved, confusing HTTPS with a service that could potentially use UDP, or simply overlooking the specific requirement for TCP in the question.
✗deny tcp any 10.1.50.0 0.0.0.255 eq 23Wrong answer — click to see why▾
Why this is wrong here
Option D is incorrect because it denies Telnet traffic from any source to the specified subnet, rather than restricting Telnet traffic specifically from the 10.1.50.0/24 subnet to any destination, which is the requirement in the question.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to deny Telnet traffic coming from any source to the 10.1.50.0/24 subnet, option D would be correct. For example, if the question asked to prevent any Telnet access to the subnet from all external sources, this option would fulfill that requirement.
Why candidates choose this
Candidates might choose this option because it appears to address the denial of Telnet traffic, leading them to believe it is relevant to the question's focus on access control lists.
✗permit ip any anyWrong answer — click to see why▾
Why this is wrong here
Option E is incorrect because it permits all IP traffic from any source to any destination, which does not meet the requirement to specifically allow only HTTPS traffic from the specified subnet and deny Telnet traffic.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to allow all traffic from any source to any destination without restrictions, such as a question asking for a default permit rule in a firewall configuration, option E would be correct.
Why candidates choose this
Candidates may choose this option because it appears to provide broad access, which can seem appealing in scenarios where unrestricted communication is desired, leading to a misunderstanding of the specific requirements of the question.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
Be careful to match both the source and destination criteria in ACLs, not just the destination.
Detailed technical explanation
How to think about this question
Access Control Lists (ACLs) are fundamental security tools in Cisco networking that filter traffic based on defined criteria such as source and destination IP addresses, protocols, and port numbers. In this scenario, the ACL must permit HTTPS traffic (TCP port 443) from the 10.1.50.0/24 subnet to a specific web server at 203.0.113.10, while simultaneously denying all Telnet traffic (TCP port 23) originating from that subnet to any destination. ACLs process Access Control Entries (ACEs) sequentially, so the order and specificity of these ACEs directly affect traffic filtering behavior.
The correct ACEs include a permit statement that explicitly allows TCP traffic from the 10.1.50.0/24 subnet to the host 203.0.113.10 on port 443, ensuring HTTPS sessions are allowed. The deny statement blocks any TCP traffic from the same subnet to any destination on port 23, effectively preventing Telnet sessions. The use of wildcard masks (0.0.0.255) correctly matches the entire subnet. The ACL implicitly denies all other traffic not explicitly permitted, so no additional deny statements are necessary for Telnet or other protocols.
A common exam trap is confusing source and destination fields or misplacing port numbers in ACL statements. For example, denying TCP traffic with the destination as the subnet instead of the source will block inbound Telnet traffic rather than outbound, which does not meet the requirement. Also, using UDP instead of TCP for HTTPS is incorrect because HTTPS operates over TCP. Understanding the exact direction of traffic and the role of source/destination IPs and ports in ACLs is critical to avoid such mistakes and to implement precise security policies in Cisco environments.
KKey Concepts to Remember
ACLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs).
An ACE that permits TCP traffic to a specific host and port explicitly allows that traffic, overriding implicit denies for that flow.
Deny ACEs targeting a source subnet and destination port block unwanted traffic such as Telnet from that subnet to any destination.
The wildcard mask in ACLs specifies which bits of the IP address to match, with 0.0.0.255 matching all hosts in a /24 subnet.
ACLs implicitly deny all traffic not explicitly permitted, so careful ordering of permit and deny statements is essential.
Port numbers in ACLs must correspond to the correct transport protocol; HTTPS uses TCP port 443, not UDP.
Source and destination IP addresses in ACLs must be correctly identified to control traffic direction accurately.
Misplacing source and destination fields or using incorrect protocols or ports leads to ACLs that do not enforce the intended security policy.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
ACLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs).
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review aCLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs)., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — ACLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs)..
What is the correct answer to this question?
The correct answer is: permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443 — To meet the requirement, one ACE must explicitly permit TCP destination port 443 to the web server, and another must deny TCP destination port 23 to any destination. Option C is wrong because HTTPS (port 443) uses TCP, not UDP. Option D reverses source and destination; the deny should apply from 10.1.50.0/24 to any, not from any to that subnet. Option E permits all IP traffic, which would override the deny for Telnet, making it ineffective.
What should I do if I get this 200-301 question wrong?
Review aCLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs)., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
ACLs filter network traffic by matching source and destination IP addresses, protocols, and port numbers in sequential Access Control Entries (ACEs).
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.