CCNA Network Services and Security Practice Question
An ACL is intended to block Telnet from 10.1.1.0/24 to router VTY access while still allowing SSH from the same subnet. Which statement best explains why an extended ACL is appropriate here?
⚠ Common exam trap
Do not confuse the ability to filter by protocol and port with filtering by IP address alone; extended ACLs are required for the former.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Because the ACL must distinguish traffic by protocol or destination port, not just by source address.
An extended ACL is appropriate because the requirement is based not only on source address but also on the specific protocol and application port involved. In practical terms, the policy must distinguish Telnet from SSH even though both originate from the same source subnet. A standard ACL would be too limited because it mainly matches only on source address. This is the kind of requirement that shows why extended ACLs exist. They allow more granular traffic control by matching protocol and destination details, not just who sent the packet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Because the ACL must distinguish traffic by protocol or destination port, not just by source address.
Why this is correct
This is correct because Telnet and SSH are both TCP-based and may originate from the same source network. A standard ACL can only filter based on source IP, so it cannot differentiate between Telnet (port 23) and SSH (port 22). An extended ACL must match the TCP destination port 23 along with source and destination addresses to block Telnet from 10.1.1.0/24 without impacting other traffic. Without this granularity, the ACL would either block all IP traffic from the source or fail to block Telnet specifically.
- ✗
Because standard ACLs can match destination TCP ports just as well.
Why it's wrong here
Standard ACLs (numbered 1-99 and 1300-1999) match only source IP addresses, not protocol or port fields. Matching a destination TCP port requires router inspection of Layer 4 information, which is only possible with an extended ACL (numbered 100-199 and 2000-2699) that supports specifying protocol, source, destination, and port. Therefore, this statement is false because standard ACLs lack the syntax to match ports.
When this WOULD be correct
In a different scenario where the question states that both Telnet and SSH traffic are being filtered based solely on source IP addresses, and there is no requirement to distinguish between protocols or ports, option B could be correct. For example, if the question asked if a standard ACL could block all traffic from a specific subnet without regard to protocol, this option would apply.
- ✗
Because extended ACLs are required for every router login policy regardless of criteria.
Why it's wrong here
Extended ACLs are required only when filtering must be based on Layer 3 and Layer 4 criteria such as protocol, source/destination IP, and ports. A login policy that restricts based solely on source IP can be implemented with a standard ACL applied to vty lines. Thus, the need for an extended ACL depends on the specific matching criteria, not on an absolute rule for every router login policy.
When this WOULD be correct
In a different exam scenario, if the question stated that all types of ACLs must be extended for any login policy regardless of the criteria involved, then option C would be correct. For example, if the question specified that only extended ACLs can be used for any form of access control, then this option would apply.
- ✗
Because SSH and Telnet always use the same port number.
Why it's wrong here
SSH uses TCP port 22, while Telnet uses TCP port 23; these are distinct well-known ports assigned by IANA. They are separate protocols with different security characteristics—Telnet is unencrypted, whereas SSH encrypts the session. Therefore, an ACL can differentiate between them by destination port, which is exactly why an extended ACL is necessary to block Telnet specifically from 10.1.1.0/24.
When this WOULD be correct
In a different scenario where the question states that both SSH and Telnet are configured to use the same port number for some reason, such as a misconfiguration or a specific lab setup, then this option could be correct. The question would need to specify that both protocols are intentionally set to operate on the same port.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Because the ACL must distinguish traffic by protocol or destination port, not just by source address.Correct answer▾
Why this is correct
This is correct because Telnet and SSH are both TCP-based and may originate from the same source network. A standard ACL can only filter based on source IP, so it cannot differentiate between Telnet (port 23) and SSH (port 22). An extended ACL must match the TCP destination port 23 along with source and destination addresses to block Telnet from 10.1.1.0/24 without impacting other traffic. Without this granularity, the ACL would either block all IP traffic from the source or fail to block Telnet specifically.
✗Because standard ACLs can match destination TCP ports just as well.Wrong answer — click to see why▾
Why this is wrong here
Standard ACLs can only filter based on source IP address, not destination ports or protocols. They lack the granularity to distinguish between Telnet and SSH traffic.
★ When this WOULD be the correct answer
In a different scenario where the question states that both Telnet and SSH traffic are being filtered based solely on source IP addresses, and there is no requirement to distinguish between protocols or ports, option B could be correct. For example, if the question asked if a standard ACL could block all traffic from a specific subnet without regard to protocol, this option would apply.
Why candidates choose this
Students may confuse standard ACLs with extended ACLs, thinking they can match ports, but standard ACLs are limited to source addresses only.
✗Because extended ACLs are required for every router login policy regardless of criteria.Wrong answer — click to see why▾
Why this is wrong here
Extended ACLs are not required for every router login policy; they are only needed when filtering must consider protocol or port information. Simple source-based filtering can use standard ACLs.
★ When this WOULD be the correct answer
In a different exam scenario, if the question stated that all types of ACLs must be extended for any login policy regardless of the criteria involved, then option C would be correct. For example, if the question specified that only extended ACLs can be used for any form of access control, then this option would apply.
Why candidates choose this
The phrase 'required for every router login policy' might mislead students into thinking extended ACLs are mandatory for VTY access, but the need depends on the specific filtering criteria.
✗Because SSH and Telnet always use the same port number.Wrong answer — click to see why▾
Why this is wrong here
SSH uses TCP port 22, while Telnet uses TCP port 23. They are distinct ports, so an ACL can differentiate them based on destination port.
★ When this WOULD be the correct answer
In a different scenario where the question states that both SSH and Telnet are configured to use the same port number for some reason, such as a misconfiguration or a specific lab setup, then this option could be correct. The question would need to specify that both protocols are intentionally set to operate on the same port.
Why candidates choose this
Students might mistakenly think both services use the same port due to their similar function (remote login), but they are separate protocols with different port numbers.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.