The answer is that the ACL is applied in the wrong place or direction, which is the most common reason a configured access list fails to block traffic. For Telnet traffic sourced from the 192.168.10.0/24 network to the destination 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination; if it is placed on the wrong interface or in the opposite direction, the router will never evaluate the traffic against the filter. On the CCNA 200-301 v2 exam, this scenario tests your understanding of ACL processing order and interface directionality—a classic trap is assuming the ACL is correctly configured when it is simply applied to the wrong router port. Remember that standard ACLs cannot match destination ports, so an extended ACL is required here, but even a perfect ACL is useless if it is not applied in the correct location. A helpful memory tip: “ACL direction follows the traffic flow—inbound on the source side, outbound on the destination side.”
CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
access-list 101 deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 23
access-list 101 permit ip any any
!
interface g0/1
ip access-group 101 out
A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is applied in the wrong place or direction
Option B is correct because the most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255
Why it's wrong here
Cisco wildcard masks work the other way around, so 0.0.0.255 is correct for a /24.
When this WOULD be correct
In a different scenario where the question specifies that the ACL is incorrectly configured to allow traffic from a broader range, such as 192.168.0.0/16, the option could be correct if it required a wildcard mask of 255.255.255.0 to block a specific subnet.
✓
The ACL is applied in the wrong place or direction
Why this is correct
The configuration logic points to an attachment problem rather than a syntax problem.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Standard ACLs should always be used for Telnet filtering
Why it's wrong here
Extended ACLs are preferred when matching protocol and destination.
When this WOULD be correct
In a scenario where the question specifies that only standard ACLs are allowed for filtering traffic, and the configuration is incorrectly using an extended ACL to block Telnet, this option would be correct. For example, if the question states that only standard ACLs can be used to filter access to a specific service, then this option would apply.
✗
The router must run PAT before ACLs can filter Telnet
In a different scenario where a question states that a router is configured with NAT and ACLs, and the ACL is not filtering Telnet traffic as expected, the correct answer could be that PAT must be configured correctly for ACLs to function as intended. This would imply that NAT is interfering with the ACL's ability to filter traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The ACL is applied in the wrong place or directionCorrect answer▾
Why this is correct
The configuration logic points to an attachment problem rather than a syntax problem.
✗The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255Wrong answer — click to see why▾
Why this is wrong here
The wildcard mask 255.255.255.0 would match only the exact host 192.168.10.0, not the entire /24 subnet. Cisco ACLs use wildcard masks where 0 means match and 1 means ignore; for a /24, the correct mask is 0.0.0.255.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that the ACL is incorrectly configured to allow traffic from a broader range, such as 192.168.0.0/16, the option could be correct if it required a wildcard mask of 255.255.255.0 to block a specific subnet.
Why candidates choose this
Students often confuse wildcard masks with subnet masks, thinking that 255.255.255.0 is the correct way to specify a /24 network, but in ACLs the logic is inverted.
✗Standard ACLs should always be used for Telnet filteringWrong answer — click to see why▾
Why this is wrong here
Standard ACLs can only filter based on source IP address and cannot match specific protocols like Telnet (TCP port 23) or destination addresses. Extended ACLs are required to filter Telnet traffic from a specific source to a specific destination.
★ When this WOULD be the correct answer
In a scenario where the question specifies that only standard ACLs are allowed for filtering traffic, and the configuration is incorrectly using an extended ACL to block Telnet, this option would be correct. For example, if the question states that only standard ACLs can be used to filter access to a specific service, then this option would apply.
Why candidates choose this
Some students think standard ACLs are simpler and sufficient for all filtering, but they lack the granularity needed for protocol-specific or destination-specific rules.
✗The router must run PAT before ACLs can filter TelnetWrong answer — click to see why▾
Why this is wrong here
PAT (Port Address Translation) is unrelated to ACL filtering. ACLs operate independently of NAT/PAT; they filter traffic based on Layer 3 and Layer 4 information regardless of whether translation is configured.
★ When this WOULD be the correct answer
In a different scenario where a question states that a router is configured with NAT and ACLs, and the ACL is not filtering Telnet traffic as expected, the correct answer could be that PAT must be configured correctly for ACLs to function as intended. This would imply that NAT is interfering with the ACL's ability to filter traffic.
Why candidates choose this
Students may confuse the order of operations or think that NAT must be applied before ACLs can work, but ACLs are processed before or after NAT depending on direction, and PAT is not a prerequisite for ACL functionality.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the concept that an ACL's effectiveness depends on its placement and direction, not just its content, and the trap here is that candidates focus on the wildcard mask or ACL type while overlooking the fundamental requirement of correct application.
Detailed technical explanation
How to think about this question
When an ACL is applied to filter Telnet (TCP port 23), the router evaluates the ACL at the point of traffic flow—either as packets enter an interface (inbound) or as they leave an interface (outbound). A common misconfiguration is applying the ACL to the wrong interface (e.g., the LAN interface instead of the WAN interface) or in the wrong direction (e.g., inbound instead of outbound on the correct interface). In real-world scenarios, this often occurs when an engineer assumes the ACL should be applied to the destination router's interface without verifying the traffic path, leading to a false sense of security.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Network Services and Security — This question tests Network Services and Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The ACL is applied in the wrong place or direction — Option B is correct because the most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.
What should I do if I get this 200-301 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.