CCNA Network Services and Security Practice Question
Exhibit
Requirement: - Block Telnet from 10.30.30.0/24 to 172.16.9.9 - Allow all other traffic Configured ACL entry: deny tcp 10.30.30.0 0.0.0.255 host 172.16.9.9
Based on the exhibit, why is the ACL blocking more traffic than intended?
⚠ Common exam trap
The exam trap here is assuming that denying TCP traffic to a server without specifying the Telnet port will only block Telnet sessions. In reality, the ACL entry without the destination port qualifier matches all TCP traffic to that server, blocking multiple services unintentionally. This mistake often arises from confusing standard ACLs, which filter only by source IP, with extended ACLs that require explicit port numbers for service-specific filtering. Candidates may overlook the need for the 'eq 23' qualifier for Telnet, leading to broader traffic denial and failing the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Because the ACL denies all TCP traffic to the server instead of only Telnet.
The ACL is blocking more traffic than intended because it uses a broad deny against all TCP traffic to the server instead of only the one service that should be denied. In practical terms, the requirement is narrow, but the configured entry is much wider. As a result, multiple TCP-based applications to that server are blocked, not just the intended one. This is a classic precision problem in ACL design. It tests whether you can compare what the business requirement says against what the ACL actually matches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Because the ACL denies all TCP traffic to the server instead of only Telnet.
Why this is correct
The ACL statement is missing the destination port qualifier (eq 23) after the destination host, so it matches any TCP segment destined to that server, not just Telnet. As a result, SSH, HTTPS, and any other TCP service are also denied, which is why more traffic is being blocked than the administrator intended. To restrict only Telnet, the extended ACL must include 'eq 23' or 'eq telnet' at the end.
- ✗
Because Telnet uses UDP, not TCP.
Why it's wrong here
Telnet is an application-layer protocol that relies on TCP port 23 to provide a reliable, connection-oriented byte stream for interactive terminal sessions. UDP is a connectionless protocol not used by Telnet, so any ACL that tries to filter Telnet as UDP would fail to match Telnet traffic entirely. Therefore, this statement is factually incorrect.
When this WOULD be correct
In a different question scenario where the focus is on a misconfigured ACL affecting UDP traffic, the option could be correct if the question stated that Telnet-like services were incorrectly configured to use UDP instead of TCP, thus blocking legitimate traffic.
- ✗
Because the ACL should be a standard ACL, not an extended ACL.
Why it's wrong here
Standard ACLs (numbered 1-99 or 1300-1999) can match only the source IP address and cannot examine protocol types or destination ports. Because the intention is to block only Telnet traffic to a specific server, an extended ACL is required to specify TCP and the destination port. So the claim that it should be a standard ACL is wrong.
When this WOULD be correct
In a different scenario, if the question asked why a network administrator mistakenly configured a standard ACL to block specific IP addresses without considering port numbers, this option could be correct. The question would need to focus on the limitations of standard ACLs in filtering traffic based on protocols.
- ✗
Because the host keyword can never be used with TCP statements.
Why it's wrong here
The 'host' keyword in an extended ACL is used to specify a single IP address for a source or destination, and it can be combined with any IP protocol, including TCP, UDP, and ICMP. There is no restriction preventing 'host' from being used in TCP permit or deny statements. Thus, this statement is invalid as a reason for the ACL blocking extra traffic.
When this WOULD be correct
In a different exam scenario where the question specifies that the ACL is incorrectly configured to block all TCP traffic and explicitly states that the host keyword cannot be used with TCP statements, this option would be correct. For example, if the question asked why a specific ACL configuration is invalid due to the misuse of keywords, then this option would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Because the ACL denies all TCP traffic to the server instead of only Telnet.Correct answer▾
Why this is correct
The ACL statement is missing the destination port qualifier (eq 23) after the destination host, so it matches any TCP segment destined to that server, not just Telnet. As a result, SSH, HTTPS, and any other TCP service are also denied, which is why more traffic is being blocked than the administrator intended. To restrict only Telnet, the extended ACL must include 'eq 23' or 'eq telnet' at the end.
✗Because Telnet uses UDP, not TCP.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because Telnet operates over TCP, not UDP. Therefore, stating that Telnet uses UDP misrepresents the protocol's functionality and its interaction with ACLs.
★ When this WOULD be the correct answer
In a different question scenario where the focus is on a misconfigured ACL affecting UDP traffic, the option could be correct if the question stated that Telnet-like services were incorrectly configured to use UDP instead of TCP, thus blocking legitimate traffic.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of protocol types, confusing TCP and UDP, especially if they have encountered similar questions about ACLs and protocol filtering in their studies.
✗Because the ACL should be a standard ACL, not an extended ACL.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because extended ACLs are necessary to filter traffic based on protocols and ports, such as allowing or denying specific TCP traffic like Telnet. A standard ACL cannot provide the granularity needed for such control.
★ When this WOULD be the correct answer
In a different scenario, if the question asked why a network administrator mistakenly configured a standard ACL to block specific IP addresses without considering port numbers, this option could be correct. The question would need to focus on the limitations of standard ACLs in filtering traffic based on protocols.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of ACL types, believing that standard ACLs are sufficient for all filtering needs, especially if they are familiar with basic ACL concepts but not the specifics of extended ACL functionality.
✗Because the host keyword can never be used with TCP statements.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because the host keyword can be used with TCP statements in ACL configurations. The confusion may arise from misunderstanding how ACLs are structured and the specific application of the host keyword.
★ When this WOULD be the correct answer
In a different exam scenario where the question specifies that the ACL is incorrectly configured to block all TCP traffic and explicitly states that the host keyword cannot be used with TCP statements, this option would be correct. For example, if the question asked why a specific ACL configuration is invalid due to the misuse of keywords, then this option would apply.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of ACL syntax and the role of the host keyword, leading them to believe that it is universally incompatible with TCP configurations.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.