CCNA Network Services and Security Practice Question
A standard ACL and an extended ACL are both available for a design. Which requirement most strongly indicates that an extended ACL is needed?
⚠ Common exam trap
Remember that standard ACLs can only filter based on source IP addresses. If the requirement involves protocols or ports, think extended ACL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy must distinguish traffic by destination, protocol, or port.
An extended ACL is most strongly indicated when the policy must match not just on source address, but also on destination, protocol, or port information. In practical terms, if the requirement is something like “block HTTP but allow SSH” or “deny traffic to one server but not another,” a standard ACL is too limited because it mainly matches only the source. Option B (matching only one source subnet) can be done with a standard ACL, so it does not demand an extended ACL. Option C (placement near destination) is a guideline for standard ACLs, not a reason to choose an extended ACL. Option D (IPv6) is irrelevant because the scenario explicitly states both ACL types are available and standard ACLs do not exist for IPv6—this question is about IPv4 ACLs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy must distinguish traffic by destination, protocol, or port.
Why this is correct
A standard ACL identifies traffic solely by source IPv4 address, so any policy that must differentiate flows by destination address, protocol number, or TCP/UDP port is impossible with a standard ACL. Extended access lists (100–199 and 2000–2699) are required because they evaluate source, destination, protocol, and port fields. Thus, this criterion forces the extended ACL choice.
- ✗
The policy needs to match only one source subnet.
Why it's wrong here
If the policy needs to match only a single source subnet, a standard access list using a wildcard mask like 0.0.255.255 fully satisfies that goal. Standard ACLs evaluate only the source address, so one permit or deny statement can identify the subnet without extra protocol or port granularity. This requirement does not require an extended ACL at all.
When this WOULD be correct
In a different scenario, if the exam question specifically states that the requirement is to implement a simple access control that only needs to allow or deny traffic from a single source subnet to a specific destination, then option B would be the correct choice.
- ✗
The ACL must be placed near the destination.
Why it's wrong here
Placement near the destination is a recommended practice once an extended ACL is selected, because it limits extraneous traffic traversing the network. However, the physical or logical placement of an ACL does not determine whether a standard or extended ACL is required; a standard ACL can also be deployed, although it is typically positioned near the source. Therefore, this is a design guideline, not a selection premise.
When this WOULD be correct
In a scenario where a question asks about the most effective ACL placement strategy for managing traffic flows to a specific server, stating that the ACL must be placed near the destination could be correct if the focus is on minimizing unnecessary traffic across the network.
- ✗
The network uses IPv6 instead of IPv4.
Why it's wrong here
Whether the network is IPv4 or IPv6 does not alter the fundamental limitation: a named IPv6 ACL is essentially equivalent to an extended ACL in capability, and the choice between standard-like and extended-like matching still depends on the need for granular match criteria. If the requirement is only to match a source subnet, either address family can use a simple source-only ACL. Thus, using IPv6 does not inherently force the extended ACL variant.
When this WOULD be correct
In a different scenario, if the question asked about the necessity of ACLs for a network exclusively using IPv6, and the focus was on matching traffic based on IPv6-specific features, then this option could be correct, as extended ACLs are often used in IPv6 environments.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The policy must distinguish traffic by destination, protocol, or port.Correct answer▾
Why this is correct
A standard ACL identifies traffic solely by source IPv4 address, so any policy that must differentiate flows by destination address, protocol number, or TCP/UDP port is impossible with a standard ACL. Extended access lists (100–199 and 2000–2699) are required because they evaluate source, destination, protocol, and port fields. Thus, this criterion forces the extended ACL choice.
✗The policy needs to match only one source subnet.Wrong answer — click to see why▾
Why this is wrong here
Option B is incorrect because a standard ACL can effectively match a single source subnet without needing the additional capabilities of an extended ACL, which is designed for more complex filtering based on multiple criteria.
★ When this WOULD be the correct answer
In a different scenario, if the exam question specifically states that the requirement is to implement a simple access control that only needs to allow or deny traffic from a single source subnet to a specific destination, then option B would be the correct choice.
Why candidates choose this
Candidates may find this option tempting because it suggests a straightforward requirement that seems manageable with a standard ACL, leading them to overlook the need for more detailed traffic filtering capabilities that extended ACLs provide.
✗The ACL must be placed near the destination.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the requirement to place the ACL near the destination does not inherently necessitate an extended ACL; standard ACLs can also be effective in controlling traffic based on source addresses regardless of placement.
★ When this WOULD be the correct answer
In a scenario where a question asks about the most effective ACL placement strategy for managing traffic flows to a specific server, stating that the ACL must be placed near the destination could be correct if the focus is on minimizing unnecessary traffic across the network.
Why candidates choose this
Candidates may find this option tempting because they understand that placement can impact performance and security, leading them to believe that it is a critical factor in determining the type of ACL needed.
✗The network uses IPv6 instead of IPv4.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the requirement for an extended ACL is based on the need to filter traffic by multiple criteria such as protocol or port, which is not addressed by simply matching one source subnet.
★ When this WOULD be the correct answer
In a different scenario, if the question asked about the necessity of ACLs for a network exclusively using IPv6, and the focus was on matching traffic based on IPv6-specific features, then this option could be correct, as extended ACLs are often used in IPv6 environments.
Why candidates choose this
Candidates may find this option tempting because they might associate IPv6 with advanced filtering needs, leading them to believe that it inherently requires extended ACLs, without considering the specific requirements of the question.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
IPv4
IPv4 is the fourth version of the Internet Protocol, a set of rules that assigns unique numerical addresses to devices so they can communicate over networks like the internet.
Key term
Standard ACL
A Standard Access Control List (ACL) is a sequential set of permit or deny rules that filters network traffic based solely on the source IP address.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.