CCNA Network Services and Security Practice Question
Exhibit
Requirement: - Block HTTP from 10.10.10.0/24 to 172.16.1.10 - Permit all other traffic access-list 110 ?
An administrator needs to configure an ACL to block HTTP traffic from subnet 10.10.10.0/24 to the web server at 172.16.1.10 while permitting all other traffic. Which ACL entry should be placed first?
⚠ Common exam trap
Be careful to distinguish between blocking all traffic and blocking specific services. Ensure you understand the requirement to block only HTTP traffic, not all IP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
The ACL needs a narrow deny statement that matches only TCP port 80 from the specified source subnet to the specific server. In practical terms, the requirement is not to block all IP traffic or all access to the host. It is to stop normal HTTP while allowing everything else. That means the entry must be precise. This is the kind of ACL question the CCNA exam likes because it forces you to distinguish protocol, destination, and service rather than relying on vague source-only logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why this is correct
This ACE must be listed first because ACLs are evaluated top-down, and this entry precisely matches TCP segments destined to port 80 from the 10.10.10.0/24 subnet to host 172.16.1.10. By specifying both the protocol (TCP) and the destination port (80), it denies only HTTP traffic to that server while leaving all other IP traffic, such as HTTPS or SSH, untouched and available for subsequent permit statements.
- ✗
deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10
Why it's wrong here
This entry is overly broad because it denies all IP traffic—regardless of protocol, port, or application—from the 10.10.10.0/24 subnet to host 172.16.1.10. It would block not only HTTP on port 80 but also HTTPS, SSH, ICMP, DNS, and every other service to that server, far exceeding the requirement to deny HTTP only. In a real ACL, such an entry would cause an outage for legitimate services and would not demonstrate the precision required for a security policy.
When this WOULD be correct
If the exam question asked for a rule to block all traffic from 10.10.10.0/24 to the web server at 172.16.1.10, regardless of the protocol, then option B would be the correct answer as it effectively blocks all IP traffic.
- ✗
permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why it's wrong here
This ACE does exactly the opposite of what is required: it explicitly permits TCP traffic to destination port 80 from the source subnet to the targeted host. Because ACL processing stops at the first matching entry, this permit would allow the HTTP traffic to pass immediately and would never reach a later deny statement, making the ACL fail to block the specified traffic. The entry must be a deny, not a permit, to enforce the desired restriction.
When this WOULD be correct
In a different scenario where the question asks for an ACL entry to allow HTTP traffic from a specific subnet to a web server while blocking all other traffic, option C would be correct. For example, if the question stated to permit only HTTP traffic from 10.10.10.0/24 to 172.16.1.10, option C would fit.
- ✗
deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why it's wrong here
HTTP is an application-layer protocol that relies exclusively on TCP as its transport protocol, so web traffic will never be encapsulated in UDP segments with destination port 80. This ACE would therefore match no HTTP packets at all, leaving the traffic it is supposed to block completely unaffected, which makes it ineffective. Moreover, UDP port 80 is commonly used by other protocols, so this entry could inadvertently block unrelated traffic while failing to meet the stated security requirement.
When this WOULD be correct
In a different scenario where the question asks to block UDP traffic specifically from 10.10.10.0/24 to a service running on port 80 of the web server, option D would be the correct choice. For example, if the web server was configured to use a UDP-based protocol on port 80, this entry would be valid.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Correct answer▾
Why this is correct
This ACE must be listed first because ACLs are evaluated top-down, and this entry precisely matches TCP segments destined to port 80 from the 10.10.10.0/24 subnet to host 172.16.1.10. By specifying both the protocol (TCP) and the destination port (80), it denies only HTTP traffic to that server while leaving all other IP traffic, such as HTTPS or SSH, untouched and available for subsequent permit statements.
✗deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10Wrong answer — click to see why▾
Why this is wrong here
Option B is incorrect because it denies all IP traffic from the specified source to the destination, which is broader than required and does not specifically target HTTP traffic on port 80.
★ When this WOULD be the correct answer
If the exam question asked for a rule to block all traffic from 10.10.10.0/24 to the web server at 172.16.1.10, regardless of the protocol, then option B would be the correct answer as it effectively blocks all IP traffic.
Why candidates choose this
Candidates may choose this option because it appears to address the requirement of blocking traffic, but they overlook that it does not specify the HTTP protocol, leading to a broader and unintended denial of service.
✗permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Wrong answer — click to see why▾
Why this is wrong here
Option C is incorrect because it permits HTTP traffic from the specified source to the web server, which is contrary to the requirement to block this traffic. The question specifically asks for a rule that denies HTTP access.
★ When this WOULD be the correct answer
In a different scenario where the question asks for an ACL entry to allow HTTP traffic from a specific subnet to a web server while blocking all other traffic, option C would be correct. For example, if the question stated to permit only HTTP traffic from 10.10.10.0/24 to 172.16.1.10, option C would fit.
Why candidates choose this
Candidates may choose this option because it includes the correct source and destination addresses and specifies the correct protocol (TCP) and port (80), leading them to mistakenly believe it aligns with the intent of the question.
✗deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Wrong answer — click to see why▾
Why this is wrong here
Option D is incorrect because it specifies 'deny udp', which does not block HTTP traffic, as HTTP uses TCP, not UDP. Therefore, it fails to meet the requirement of blocking HTTP from the specified source to the web server.
★ When this WOULD be the correct answer
In a different scenario where the question asks to block UDP traffic specifically from 10.10.10.0/24 to a service running on port 80 of the web server, option D would be the correct choice. For example, if the web server was configured to use a UDP-based protocol on port 80, this entry would be valid.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of the protocols involved, confusing HTTP (TCP) with potential UDP traffic, or they may incorrectly assume that blocking any traffic to the web server is sufficient.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Cisco Discovery Protocol
A proprietary Layer 2 network protocol used by Cisco devices to discover information about directly connected neighbor devices.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.