The answer is an extended ACL, because the policy requires protocol and port filtering that a standard ACL cannot provide. Standard ACLs only filter based on source IP address, but this scenario demands distinguishing HTTPS (TCP port 443) from Telnet (TCP port 23) between the same source subnet and destination server. An extended ACL can match both the protocol—in this case TCP—and the specific destination port numbers, enabling the precise allow and deny rules needed. On the CCNA 200-301 v2 exam, this concept tests your understanding of ACL capabilities and is a common trap where students mistakenly choose a standard ACL, forgetting that port-level control requires extended syntax. A reliable memory tip: if you need to filter by port or protocol, think “extended for extended control”—standard ACLs stop at the source address.
CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator wants to allow HTTPS traffic from a source subnet to a server but deny all Telnet traffic from that same subnet to the same server. Which ACL capability is required to express that policy accurately?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An extended ACL that can match protocol and destination port information
The policy requires extended ACL capability because it must distinguish traffic by protocol and destination port, not just by source address. In practical terms, the rule needs to treat TCP port 443 differently from TCP port 23 even though the source and destination networks are the same. A standard ACL is too limited for that.
This question is about matching precision. When the policy depends on protocol and port, extended ACLs are the right tool.
Key principle: Extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
An extended ACL that can match protocol and destination port information
Why this is correct
This is correct because the requirement depends on protocol/port-level filtering.
Related concept
Extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control.
✗
A standard ACL because source matching is enough
Why it's wrong here
This is wrong because the policy must distinguish HTTPS from Telnet.
When this WOULD be correct
If the question asked for a policy that only required blocking or allowing traffic based solely on source IP addresses without regard to specific protocols or ports, then a standard ACL would be appropriate. For example, if the requirement was to allow all traffic from a specific subnet to a server without specifying protocols.
✗
A wildcard mask with all zeros only
Why it's wrong here
This is wrong because wildcard details alone do not provide protocol/port granularity.
When this WOULD be correct
In a question where the requirement is to apply an ACL to a single device and the focus is solely on that device's IP address, a wildcard mask with all zeros could be correct for specifying that exact host without needing to consider any other traffic types or protocols.
✗
A wireless SSID ACL
Why it's wrong here
This is wrong because the question is about IP traffic filtering, not WLAN naming or association policy.
When this WOULD be correct
If the question asked about managing access controls specifically for wireless clients connecting to a network, where the focus was on restricting or allowing traffic based on SSID settings, then a wireless SSID ACL would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓An extended ACL that can match protocol and destination port informationCorrect answer▾
Why this is correct
This is correct because the requirement depends on protocol/port-level filtering.
✗A standard ACL because source matching is enoughWrong answer — click to see why▾
Why this is wrong here
Standard ACLs can only match on source IP address, not on protocol or port numbers. Since the policy requires distinguishing HTTPS from Telnet traffic, which both use TCP but different destination ports, a standard ACL cannot enforce this rule.
★ When this WOULD be the correct answer
If the question asked for a policy that only required blocking or allowing traffic based solely on source IP addresses without regard to specific protocols or ports, then a standard ACL would be appropriate. For example, if the requirement was to allow all traffic from a specific subnet to a server without specifying protocols.
Why candidates choose this
Students might think that because the source subnet is the same for both allowed and denied traffic, matching only the source is sufficient. However, they overlook the need to differentiate between the two services based on destination port.
✗A wildcard mask with all zeros onlyWrong answer — click to see why▾
Why this is wrong here
A wildcard mask with all zeros (e.g., 0.0.0.0) is used to match a single host IP address, but it does not provide any capability to filter based on protocol or port numbers. The policy requires protocol/port-level granularity, which wildcard masks alone cannot achieve.
★ When this WOULD be the correct answer
In a question where the requirement is to apply an ACL to a single device and the focus is solely on that device's IP address, a wildcard mask with all zeros could be correct for specifying that exact host without needing to consider any other traffic types or protocols.
Why candidates choose this
Students may confuse wildcard masks with ACL functionality, thinking that specifying a wildcard mask is the key to creating an ACL. However, the mask only defines which bits of the IP address to match, not the protocol or port.
✗A wireless SSID ACLWrong answer — click to see why▾
Why this is wrong here
Wireless SSID ACLs are used to control access to wireless networks based on SSID or client MAC addresses, not to filter IP traffic based on protocol or port. This question is about IP traffic filtering between subnets and servers, which is unrelated to wireless SSID policies.
★ When this WOULD be the correct answer
If the question asked about managing access controls specifically for wireless clients connecting to a network, where the focus was on restricting or allowing traffic based on SSID settings, then a wireless SSID ACL would be the correct answer.
Why candidates choose this
Students might mistakenly think that 'ACL' in a wireless context can apply to any type of filtering, but SSID ACLs are specific to wireless LANs and do not operate at the IP or transport layer.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is selecting a standard ACL to enforce policies that require filtering by protocol or port number. Standard ACLs only filter by source IP address and cannot distinguish between different types of traffic like HTTPS and Telnet. This leads to incorrect assumptions that standard ACLs can block Telnet while allowing HTTPS from the same subnet. The trap lies in overlooking the need for protocol and port-level filtering, which only extended ACLs provide. Candidates must remember that without extended ACLs, the router cannot differentiate traffic based on application-layer details, causing the policy to fail.
Detailed technical explanation
How to think about this question
Access Control Lists (ACLs) are fundamental tools in Cisco networking used to filter traffic based on defined criteria. Standard ACLs filter traffic solely based on source IP addresses, which limits their ability to differentiate traffic types. Extended ACLs, however, provide granular control by allowing filtering based on multiple parameters including source and destination IP addresses, protocol types (such as TCP or UDP), and specific port numbers. This capability is essential when policies require distinguishing between different application traffic, such as HTTPS and Telnet.
In the scenario where an administrator wants to permit HTTPS traffic (TCP port 443) while denying Telnet traffic (TCP port 23) from the same source subnet to a server, an extended ACL is necessary. The extended ACL can explicitly match the TCP protocol and the destination port number, enabling precise control over which traffic is allowed or denied. Standard ACLs cannot differentiate traffic by port or protocol, making them insufficient for this requirement.
A common exam trap is assuming that standard ACLs can enforce policies based on application types or ports, which they cannot. Extended ACLs are the correct choice because they provide the necessary filtering granularity. Practically, using extended ACLs ensures that only the intended traffic (HTTPS) reaches the server, while unwanted traffic (Telnet) is blocked, enhancing network security and compliance with access policies.
KKey Concepts to Remember
Extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control.
Standard ACLs filter traffic only by source IP address and cannot differentiate between protocols or ports, limiting their use for application-specific policies.
An extended ACL can explicitly permit HTTPS traffic by matching TCP protocol and destination port 443 while denying Telnet traffic on TCP port 23 from the same source subnet.
Cisco routers process ACL entries in sequential order, stopping at the first match, so rule order is critical in extended ACL configuration.
Using extended ACLs improves network security by allowing administrators to enforce policies that distinguish between different application traffic types.
ACLs applied inbound or outbound on interfaces control traffic flow and can prevent unauthorized access to network resources based on defined criteria.
Misusing standard ACLs for protocol or port filtering is a common mistake that leads to ineffective access control and potential security risks.
Extended ACLs are essential in scenarios requiring granular control over traffic, such as permitting HTTPS while denying Telnet from the same source to the same destination.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — Extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control..
What is the correct answer to this question?
The correct answer is: An extended ACL that can match protocol and destination port information — The policy requires extended ACL capability because it must distinguish traffic by protocol and destination port, not just by source address. In practical terms, the rule needs to treat TCP port 443 differently from TCP port 23 even though the source and destination networks are the same. A standard ACL is too limited for that.
This question is about matching precision. When the policy depends on protocol and port, extended ACLs are the right tool.
What should I do if I get this 200-301 question wrong?
Review extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Extended ACLs allow filtering based on source and destination IP addresses, protocols, and port numbers, enabling precise traffic control.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.