CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  As close to the source as practical

  Why this is correct

  Placing an extended ACL as close to the source as practical is the standard rule because extended ACLs can match both source and destination addresses, ports, and protocols. By filtering at the ingress point near the source, you prevent unwanted traffic from consuming bandwidth and processing resources on intermediate routers and links. This early filtering also reduces the risk of the traffic causing harm deeper inside the network, making the policy more efficient and effective.

• ✗

  As close to the destination as possible in all cases

  Why it's wrong here

  The guidance to place an ACL close to the destination is normally reserved for standard ACLs, which can only filter on source addresses. A standard ACL near the source would accidentally block all traffic from that source, regardless of destination; placing it near the destination lets you permit or deny based on the destination's location. For extended ACLs, however, this would let unwanted traffic traverse the network unnecessarily, wasting bandwidth and potentially triggering security issues before being denied at the destination.

  When this WOULD be correct

  In a scenario where the question specifies that the network is highly segmented and traffic must be controlled at the destination for compliance reasons, placing an extended ACL close to the destination might be the best approach to enforce specific access policies for that segment.

• ✗

  Only on the default gateway

  Why it's wrong here

  Default gateway placement is insufficient because extended ACLs are not restricted to the gateway's interface and the gateway may not see all internal traffic. If two hosts on the same VLAN or same subnet communicate directly, that traffic never reaches the default gateway, so ACLs placed only there would miss those flows. Additionally, the correct placement is determined by the packet's source and the filtering goal, not by a router's role as a default gateway in the topology.

  When this WOULD be correct

  In a scenario where a question specifies that all traffic must be filtered at the default gateway due to a specific network design or security policy, stating that extended ACLs should only be on the default gateway could be correct. For example, if the question indicates that the network is small and all traffic must pass through the gateway, this option would apply.

• ✗

  Only on WAN interfaces

  Why it's wrong here

  Limiting extended ACL placement to WAN interfaces is too restrictive and ignores the key principle of source proximity. WAN interfaces are commonly used for edge filtering, but extended ACLs can be applied to LAN interfaces, trunk interfaces, or any interface where the traffic enters the network. The real objective is to stop unwanted packets as early as possible, which often means placing the ACL on an interface closer to the source, regardless of whether that interface is a WAN link.

  When this WOULD be correct

  In a scenario where the exam question specifies that the network design requires strict control over traffic entering and leaving a WAN connection, placing an extended ACL only on WAN interfaces could be the correct answer. This would apply in a situation where all traffic must be filtered at the edge of the network for security compliance.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question