CCNA Network Services and Security Practice Question
An administrator wants to allow HTTPS traffic from a source subnet to a server but deny all Telnet traffic from that same subnet to the same server. Which ACL capability is required to express that policy accurately?
⚠ Common exam trap
A frequent exam trap is selecting a standard ACL to enforce policies that require filtering by protocol or port number. Standard ACLs only filter by source IP address and cannot distinguish between different types of traffic like HTTPS and Telnet. This leads to incorrect assumptions that standard ACLs can block Telnet while allowing HTTPS from the same subnet. The trap lies in overlooking the need for protocol and port-level filtering, which only extended ACLs provide. Candidates must remember that without extended ACLs, the router cannot differentiate traffic based on application-layer details, causing the policy to fail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An extended ACL that can match protocol and destination port information
The policy requires extended ACL capability because it must distinguish traffic by protocol and destination port, not just by source address. In practical terms, the rule needs to treat TCP port 443 differently from TCP port 23 even though the source and destination networks are the same. A standard ACL is too limited for that. This question is about matching precision. When the policy depends on protocol and port, extended ACLs are the right tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An extended ACL that can match protocol and destination port information
Why this is correct
An extended ACL is the correct tool because it evaluates both protocol type (TCP) and the destination port (443) in its permit or deny statements, giving the router the granularity needed to allow only HTTPS while blocking other TCP-based services. Unlike standard ACLs, extended ACLs can be placed closest to the source and still enforce policy based on layer-4 information. The specific requirement to allow HTTPS from the source subnet and deny all other traffic, including Telnet, cannot be met without this port-level matching.
- ✗
A standard ACL because source matching is enough
Why it's wrong here
A standard ACL matches only the source IP address (or subnet) in each rule and has no fields for protocol or destination port, so it cannot differentiate HTTPS from Telnet or any other application. Even if you match the exact source subnet, a standard ACL would either permit all traffic from that subnet or deny all of it, which does not satisfy the requirement of allowing only HTTPS while denying other traffic. Thus, source matching alone is insufficient for this policy.
When this WOULD be correct
If the question asked for a policy that only required blocking or allowing traffic based solely on source IP addresses without regard to specific protocols or ports, then a standard ACL would be appropriate. For example, if the requirement was to allow all traffic from a specific subnet to a server without specifying protocols.
- ✗
A wildcard mask with all zeros only
Why it's wrong here
A wildcard mask with all zeros (0.0.0.0) matches a single exact host IP address, and by itself provides no capability to distinguish protocols or destination ports in an ACL. While a wildcard mask is a component of an extended ACL entry, it only defines which address bits must match; it tells the router nothing about the HTTPS service. To allow HTTPS, you would still need the protocol and port fields of an extended ACL, so this option is incomplete and incorrect for the stated policy.
When this WOULD be correct
In a question where the requirement is to apply an ACL to a single device and the focus is solely on that device's IP address, a wildcard mask with all zeros could be correct for specifying that exact host without needing to consider any other traffic types or protocols.
- ✗
A wireless SSID ACL
Why it's wrong here
A wireless SSID ACL controls which client devices can associate with a particular WLAN name (SSID) or what they can do at the wireless link layer, not which IP traffic is permitted or denied. The question is about filtering TCP port 443 traffic from a source subnet to a server, which is a network-layer policy independent of the wireless network's name or its association rules. Therefore, an SSID ACL cannot enforce the required HTTPS allow/deny behavior.
When this WOULD be correct
If the question asked about managing access controls specifically for wireless clients connecting to a network, where the focus was on restricting or allowing traffic based on SSID settings, then a wireless SSID ACL would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓An extended ACL that can match protocol and destination port informationCorrect answer▾
Why this is correct
An extended ACL is the correct tool because it evaluates both protocol type (TCP) and the destination port (443) in its permit or deny statements, giving the router the granularity needed to allow only HTTPS while blocking other TCP-based services. Unlike standard ACLs, extended ACLs can be placed closest to the source and still enforce policy based on layer-4 information. The specific requirement to allow HTTPS from the source subnet and deny all other traffic, including Telnet, cannot be met without this port-level matching.
✗A standard ACL because source matching is enoughWrong answer — click to see why▾
Why this is wrong here
Standard ACLs can only match on source IP address, not on protocol or port numbers. Since the policy requires distinguishing HTTPS from Telnet traffic, which both use TCP but different destination ports, a standard ACL cannot enforce this rule.
★ When this WOULD be the correct answer
If the question asked for a policy that only required blocking or allowing traffic based solely on source IP addresses without regard to specific protocols or ports, then a standard ACL would be appropriate. For example, if the requirement was to allow all traffic from a specific subnet to a server without specifying protocols.
Why candidates choose this
Students might think that because the source subnet is the same for both allowed and denied traffic, matching only the source is sufficient. However, they overlook the need to differentiate between the two services based on destination port.
✗A wildcard mask with all zeros onlyWrong answer — click to see why▾
Why this is wrong here
A wildcard mask with all zeros (e.g., 0.0.0.0) is used to match a single host IP address, but it does not provide any capability to filter based on protocol or port numbers. The policy requires protocol/port-level granularity, which wildcard masks alone cannot achieve.
★ When this WOULD be the correct answer
In a question where the requirement is to apply an ACL to a single device and the focus is solely on that device's IP address, a wildcard mask with all zeros could be correct for specifying that exact host without needing to consider any other traffic types or protocols.
Why candidates choose this
Students may confuse wildcard masks with ACL functionality, thinking that specifying a wildcard mask is the key to creating an ACL. However, the mask only defines which bits of the IP address to match, not the protocol or port.
✗A wireless SSID ACLWrong answer — click to see why▾
Why this is wrong here
Wireless SSID ACLs are used to control access to wireless networks based on SSID or client MAC addresses, not to filter IP traffic based on protocol or port. This question is about IP traffic filtering between subnets and servers, which is unrelated to wireless SSID policies.
★ When this WOULD be the correct answer
If the question asked about managing access controls specifically for wireless clients connecting to a network, where the focus was on restricting or allowing traffic based on SSID settings, then a wireless SSID ACL would be the correct answer.
Why candidates choose this
Students might mistakenly think that 'ACL' in a wireless context can apply to any type of filtering, but SSID ACLs are specific to wireless LANs and do not operate at the IP or transport layer.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Standard ACL
A Standard Access Control List (ACL) is a sequential set of permit or deny rules that filters network traffic based solely on the source IP address.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.