CCNA Network Services and Security Practice Question
Exhibit
Requirement: - Block HTTPS from 10.20.20.0/24 to 172.16.5.10 - Allow all other traffic Configured entry: deny ip 10.20.20.0 0.0.0.255 host 172.16.5.10
Based on the exhibit, why is the ACL not meeting the requirement to block only HTTPS traffic to the server?
⚠ Common exam trap
Ensure you understand the difference between blocking specific ports and blocking all traffic. Misconfiguring an ACL by using 'deny ip' instead of 'deny tcp eq 443' is a common mistake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Because the ACL entry is too broad and blocks all IP traffic to the host.
The ACL fails because it uses 'deny ip' which blocks all IP traffic to the server, not just HTTPS. To block only HTTPS, the ACL should match TCP port 443 with 'deny tcp eq 443'. Option B is wrong because HTTPS uses TCP, not UDP. Option C is wrong because extended ACLs (not standard) are required to filter by port. Option D is wrong because a host destination is perfectly valid in extended ACLs; a wildcard subnet is not required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Because the ACL entry is too broad and blocks all IP traffic to the host.
Why this is correct
The ACL entry uses the keyword 'ip', which matches every IP protocol including TCP, UDP, ICMP, and GRE. To block only HTTPS, the administrator must specify 'tcp' and match destination port 443, as in 'deny tcp any host 192.0.2.10 eq 443'. Because 'deny ip' is all-encompassing, it prevents all traffic to the host, not just HTTPS, which is why the ACL fails the requirement.
- ✗
Because HTTPS uses UDP, not TCP.
Why it's wrong here
HTTPS is HTTP operating over TLS and traditionally uses TCP for reliable delivery, with destination port 443. The option confuses HTTPS with QUIC, an HTTP/3 transport that uses UDP port 443, but HTTPS itself does not use UDP. Since the ACL in question was written for TCP-based HTTPS, this reason is factually incorrect.
When this WOULD be correct
In a different question scenario where the focus is on protocols and their transport layers, if the question asked about blocking traffic for a protocol that indeed uses UDP, such as QUIC (which is used for HTTP/3), then this option could be correct.
- ✗
Because standard ACLs are required for HTTPS filtering.
Why it's wrong here
Standard ACLs are numbered 1-99 and 1300-1999, and they can filter only based on the source IP address; they cannot match protocol, destination port, or destination address. Filtering HTTPS requires an extended ACL, numbered 100-199 or 2000-2699, which provides 'tcp' and 'eq 443' matching capabilities. Therefore, the claim that standard ACLs are required is wrong.
When this WOULD be correct
In a different exam scenario where the question states that only standard ACLs can be used for filtering traffic types, and the focus is on the limitations of standard ACLs in filtering specific protocols, this option could be correct. For example, if the question specified that only standard ACLs are allowed for traffic filtering, it would imply that advanced filtering for HTTPS is not possible.
- ✗
Because the destination must always be a wildcarded subnet, not a host.
Why it's wrong here
The 'host' keyword in an ACL is a shorthand for a wildcard mask of 0.0.0.0, exactly matching the specified address, and this is valid for destinations in extended ACLs. A destination does not have to be a wildcarded subnet; using 'host 192.0.2.10' is a precise and common way to target an individual server. Thus, the assertion that a wildcarded subnet is mandatory is false.
When this WOULD be correct
In a different exam scenario where the question specifically states that only wildcarded subnets can be used for ACL entries, option D would be correct. For instance, if the question asked about a requirement to block traffic to a range of IP addresses rather than a single host, this option would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Because the ACL entry is too broad and blocks all IP traffic to the host.Correct answer▾
Why this is correct
The ACL entry uses the keyword 'ip', which matches every IP protocol including TCP, UDP, ICMP, and GRE. To block only HTTPS, the administrator must specify 'tcp' and match destination port 443, as in 'deny tcp any host 192.0.2.10 eq 443'. Because 'deny ip' is all-encompassing, it prevents all traffic to the host, not just HTTPS, which is why the ACL fails the requirement.
✗Because HTTPS uses UDP, not TCP.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because HTTPS operates over TCP, not UDP. Therefore, the statement that HTTPS uses UDP is fundamentally flawed and does not address the ACL's blocking behavior.
★ When this WOULD be the correct answer
In a different question scenario where the focus is on protocols and their transport layers, if the question asked about blocking traffic for a protocol that indeed uses UDP, such as QUIC (which is used for HTTP/3), then this option could be correct.
Why candidates choose this
Candidates may be misled by the association of HTTPS with secure communication and mistakenly recall that it could use UDP, leading them to select this option without fully understanding the transport layer details.
✗Because standard ACLs are required for HTTPS filtering.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because HTTPS operates over TCP, not UDP. Therefore, standard ACLs can be used to filter HTTPS traffic based on TCP port 443.
★ When this WOULD be the correct answer
In a different exam scenario where the question states that only standard ACLs can be used for filtering traffic types, and the focus is on the limitations of standard ACLs in filtering specific protocols, this option could be correct. For example, if the question specified that only standard ACLs are allowed for traffic filtering, it would imply that advanced filtering for HTTPS is not possible.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of the transport layer protocols, confusing HTTPS with other protocols that do use UDP, such as DNS or certain streaming services.
✗Because the destination must always be a wildcarded subnet, not a host.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because HTTPS operates over TCP, not UDP. Therefore, the issue of blocking HTTPS traffic cannot be attributed to the protocol type being used.
★ When this WOULD be the correct answer
In a different exam scenario where the question specifically states that only wildcarded subnets can be used for ACL entries, option D would be correct. For instance, if the question asked about a requirement to block traffic to a range of IP addresses rather than a single host, this option would apply.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of ACL configurations, believing that specific destination types (wildcarded subnets) are universally required for all types of traffic filtering, including HTTPS.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
UDP
UDP (User Datagram Protocol) is a communication protocol that sends data quickly without first checking if the receiver is ready or if the data arrived correctly.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.