Quick Answer
The answer is 192.168.8.0 through 192.168.8.15. This is correct because the ACL wildcard mask 0.0.0.15, when converted to binary, has zeros in the first 28 bits and ones in the last 4 bits, meaning only the final four bits of the host portion are allowed to vary. A wildcard mask of 0.0.0.15 therefore defines a block size of 16 addresses (2^4), starting from the network address 192.168.8.0 and ending at 192.168.8.15. On the CCNA 200-301 v2 exam, ACL wildcard mask calculation often appears in access-list configuration questions, where a common trap is confusing the wildcard mask with a subnet mask—remember that wildcards invert the logic, with 0 meaning “must match exactly” and 1 meaning “ignore.” A quick memory tip: subtract the wildcard mask from 255.255.255.255 to find the equivalent subnet mask; here, 255.255.255.255 minus 0.0.0.15 gives 255.255.255.240, which confirms the /28 block size of 16 addresses.
This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: an ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An ACL entry reads:
access-list 25 permit 192.168.8.0 0.0.0.15
Which address range does this statement match?
192.168.8.0 through 192.168.8.15
That is the correct range for a wildcard of 0.0.0.15.
192.168.8.0 through 192.168.8.31
Why wrong: That would match a wildcard of 0.0.0.31.
192.168.8.0 through 192.168.8.7
Why wrong: The range starts at .0, not .8.
Only host 192.168.8.15
Why wrong: A host match would use a wildcard of 0.0.0.0.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
192.168.8.0 through 192.168.8.15
A wildcard of 0.0.0.15 means the last 4 bits can vary, which corresponds to a block size of 16 addresses. Starting at 192.168.8.0, the range is 192.168.8.0 through 192.168.8.15.
Key principle: An ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
192.168.8.0 through 192.168.8.15
Why this is correct
That is the correct range for a wildcard of 0.0.0.15.
Related concept
An ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position.
192.168.8.0 through 192.168.8.31
Why it's wrong here
That would match a wildcard of 0.0.0.31.
When this WOULD be correct
If the question were modified to read 'access-list 25 permit 192.168.8.0 0.0.0.31', then option B would be correct, as it would match the entire range from 192.168.8.0 to 192.168.8.31.
192.168.8.0 through 192.168.8.7
Why it's wrong here
The range starts at .0, not .8.
When this WOULD be correct
This option would be correct if the question specified that the ACL was intended to match only the addresses within the range of 192.168.8.8 to 192.168.8.15, perhaps in a context where a specific subnet mask was applied to limit the range.
Only host 192.168.8.15
Why it's wrong here
A host match would use a wildcard of 0.0.0.0.
When this WOULD be correct
In a different question, if the ACL entry specified 'access-list 25 permit 192.168.8.15 0.0.0.0', then option D would be correct, as it would permit only the host address 192.168.8.15.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
That is the correct range for a wildcard of 0.0.0.15.
Why this is wrong here
The wildcard mask 0.0.0.15 matches only the last 4 bits, resulting in a range of 16 addresses (0-15). A wildcard of 0.0.0.31 would match 32 addresses (0-31), which is incorrect for this ACL.
★ When this WOULD be the correct answer
If the question were modified to read 'access-list 25 permit 192.168.8.0 0.0.0.31', then option B would be correct, as it would match the entire range from 192.168.8.0 to 192.168.8.31.
Why candidates choose this
Students often confuse wildcard masks with subnet masks, thinking that 0.0.0.15 corresponds to a /27 subnet (255.255.255.224) which has 32 addresses, but wildcard masks are the inverse of subnet masks.
Why this is wrong here
This range corresponds to a wildcard mask of 0.0.0.7 (block size 8), not 0.0.0.15 (block size 16).
★ When this WOULD be the correct answer
This option would be correct if the question specified that the ACL was intended to match only the addresses within the range of 192.168.8.8 to 192.168.8.15, perhaps in a context where a specific subnet mask was applied to limit the range.
Why candidates choose this
A test-taker might mistakenly think the wildcard mask indicates the starting point or that the range is centered around the given address, leading to an incorrect starting offset.
Why this is wrong here
A host match requires a wildcard mask of 0.0.0.0, not 0.0.0.15. The given ACL matches a range of 16 addresses, not a single host.
★ When this WOULD be the correct answer
In a different question, if the ACL entry specified 'access-list 25 permit 192.168.8.15 0.0.0.0', then option D would be correct, as it would permit only the host address 192.168.8.15.
Why candidates choose this
Students may see the last octet .15 in the wildcard mask and incorrectly assume it matches only the host with that specific value, confusing the wildcard mask with a host address.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Be careful not to confuse the block size determined by the wildcard mask with a full subnet or miscalculate the starting address.
Detailed technical explanation
Access Control Lists (ACLs) in Cisco networking use wildcard masks to specify which IP addresses to match in a rule. A wildcard mask is the inverse of a subnet mask, where a 0 bit means "match exactly" and a 1 bit means "ignore this bit". In the ACL entry "access-list 25 permit 192.168.8.0 0.0.0.15", the wildcard mask 0.0.0.15 allows variation in the last 4 bits of the IP address, effectively matching a block of 16 addresses starting from 192.168.8.0. The rule for determining the address range matched by an ACL entry is to add one to the wildcard mask value plus the base IP address. Since 0.0.0.15 corresponds to binary 00001111, it means the last 4 bits can vary from 0000 to 1111 (0 to 15 decimal). Therefore, the ACL matches all IP addresses from 192.168.8.0 through 192.168.8.15 inclusive. This is a common technique in ACLs to efficiently permit or deny a small subnet or range of hosts. A common exam trap is confusing wildcard masks with subnet masks or misinterpreting the starting address of the range. For example, assuming the range starts at 192.168.8.8 instead of 192.168.8.0 is incorrect because the base address must align with the wildcard mask block size. Practically, Cisco routers use this wildcard mask logic to quickly filter traffic based on IP ranges, making understanding this concept critical for ACL configuration and troubleshooting.
Key takeaway
An ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position.
Real-world example
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Review an ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — An ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position..
The correct answer is: 192.168.8.0 through 192.168.8.15 — A wildcard of 0.0.0.15 means the last 4 bits can vary, which corresponds to a block size of 16 addresses. Starting at 192.168.8.0, the range is 192.168.8.0 through 192.168.8.15.
Review an ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position., then practise related 200-301 questions on the same topic to reinforce the concept.
An ACL wildcard mask uses 0 bits to require an exact match and 1 bits to allow any value in that bit position.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.