CCNA Network Services and Security Practice Question
A network team wants an ACL that permits HTTPS from 10.1.50.0/24 to a web server at 203.0.113.10 and denies all Telnet traffic from that subnet to any destination. Which two ACEs are required?
⚠ Common exam trap
Be careful to match both the source and destination criteria in ACLs, not just the destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443
To meet the requirement, one ACE must explicitly permit TCP destination port 443 to the web server, and another must deny TCP destination port 23 to any destination. Option C is wrong because HTTPS (port 443) uses TCP, not UDP. Option D reverses source and destination; the deny should apply from 10.1.50.0/24 to any, not from any to that subnet. Option E permits all IP traffic, which would override the deny for Telnet, making it ineffective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443
Why this is correct
This ACL entry uses the wildcard mask 0.0.0.255 to match the entire 10.1.50.0/24 subnet as the source and specifies the single host 203.0.113.10 as the destination with the port number 443. Because HTTPS is a TCP-based protocol, the 'tcp' keyword is essential; this rule precisely permits outbound HTTPS traffic from that subnet to only that web server while leaving all other traffic unaffected.
- ✓
deny tcp 10.1.50.0 0.0.0.255 any eq 23
Why this is correct
This entry explicitly denies Telnet (TCP port 23) from the 10.1.50.0/24 subnet to any destination IP address. It is correct as a security control to block legacy unencrypted Telnet sessions originating from that subnet, regardless of where they are headed. However, it does not by itself permit HTTPS; it must be combined with the HTTPS permit entry to fulfill the stated requirement of allowing HTTPS while blocking Telnet.
- ✗
permit udp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443
Why it's wrong here
HTTPS uses TCP on port 443 for reliable connection-oriented delivery, not UDP. Although UDP port 443 is sometimes used for protocols like QUIC, standard HTTPS is defined over TCP, so this 'udp' rule will never match legitimate HTTPS traffic. As a result, this ACL entry would not permit the desired HTTPS sessions, making it an ineffective and incorrect solution.
When this WOULD be correct
This option would be correct in a scenario where the question specifies a requirement to permit a UDP-based service, such as DNS over UDP, from the specified subnet to a particular host. For example, if the question asked for permitting DNS traffic from 10.1.50.0/24 to 203.0.113.10, then this option would be appropriate.
- ✗
deny tcp any 10.1.50.0 0.0.0.255 eq 23
Why it's wrong here
This deny statement matches Telnet traffic from any source IP destined to the 10.1.50.0/24 subnet with a destination port of 23. That is the opposite direction of the stated requirement, which concerns outbound HTTPS sessions initiated from the subnet. Additionally, applying 'eq 23' to the destination port would block inbound Telnet sessions to those hosts, not prevent the subnet from initiating outbound Telnet, so it fails the requirement and could disrupt management access.
When this WOULD be correct
In a different scenario where the requirement is to deny Telnet traffic coming from any source to the 10.1.50.0/24 subnet, option D would be correct. For example, if the question asked to prevent any Telnet access to the subnet from all external sources, this option would fulfill that requirement.
- ✗
permit ip any any
Why it's wrong here
The 'permit ip any any' rule allows all IP traffic, including both TCP and UDP, from any source to any destination, with no port restrictions. This is far broader than the requirement to permit only HTTPS from the 10.1.50.0/24 subnet to a specific host, and it would trivialize the ACL by permitting everything. On a Cisco device, this would completely negate the security intent of the ACL, so it is not a valid answer.
When this WOULD be correct
In a different scenario where the requirement is to allow all traffic from any source to any destination without restrictions, such as a question asking for a default permit rule in a firewall configuration, option E would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443Correct answer▾
Why this is correct
This ACL entry uses the wildcard mask 0.0.0.255 to match the entire 10.1.50.0/24 subnet as the source and specifies the single host 203.0.113.10 as the destination with the port number 443. Because HTTPS is a TCP-based protocol, the 'tcp' keyword is essential; this rule precisely permits outbound HTTPS traffic from that subnet to only that web server while leaving all other traffic unaffected.
✗permit udp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because HTTPS operates over TCP, not UDP. The question specifically requires permitting HTTPS traffic, which necessitates the use of TCP in the ACL entry.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question specifies a requirement to permit a UDP-based service, such as DNS over UDP, from the specified subnet to a particular host. For example, if the question asked for permitting DNS traffic from 10.1.50.0/24 to 203.0.113.10, then this option would be appropriate.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of the protocols involved, confusing HTTPS with a service that could potentially use UDP, or simply overlooking the specific requirement for TCP in the question.
✗deny tcp any 10.1.50.0 0.0.0.255 eq 23Wrong answer — click to see why▾
Why this is wrong here
Option D is incorrect because it denies Telnet traffic from any source to the specified subnet, rather than restricting Telnet traffic specifically from the 10.1.50.0/24 subnet to any destination, which is the requirement in the question.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to deny Telnet traffic coming from any source to the 10.1.50.0/24 subnet, option D would be correct. For example, if the question asked to prevent any Telnet access to the subnet from all external sources, this option would fulfill that requirement.
Why candidates choose this
Candidates might choose this option because it appears to address the denial of Telnet traffic, leading them to believe it is relevant to the question's focus on access control lists.
✗permit ip any anyWrong answer — click to see why▾
Why this is wrong here
Option E is incorrect because it permits all IP traffic from any source to any destination, which does not meet the requirement to specifically allow only HTTPS traffic from the specified subnet and deny Telnet traffic.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to allow all traffic from any source to any destination without restrictions, such as a question asking for a default permit rule in a firewall configuration, option E would be correct.
Why candidates choose this
Candidates may choose this option because it appears to provide broad access, which can seem appealing in scenarios where unrestricted communication is desired, leading to a misunderstanding of the specific requirements of the question.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
UDP
UDP (User Datagram Protocol) is a communication protocol that sends data quickly without first checking if the receiver is ready or if the data arrived correctly.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.