Drag and drop the following steps into the correct order to configure and apply an extended IPv4 ACL on a Cisco router to block Telnet traffic from subnet 192.168.1.0/24 to host 10.0.0.1 and permit all other IP traffic.

CCNA Network Services and Security Practice Question

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

7Step 7

Correct answer & explanation

✓

Identify the traffic to filter (deny Telnet from 192.168.1.0/24 to 10.0.0.1) and determine that the ACL should be applied inbound on interface GigabitEthernet0/1.

Correct order: 1) Identify the traffic to filter and the interface/direction because this planning determines all subsequent configuration choices. 2) Enter global configuration mode to access ACL definition. 3) Configure the deny statement first — ACLs are processed top-down, so the specific deny must precede the general permit to actually block the unwanted traffic. 4) Add the permit statement after the deny to allow everything else. 5) Enter interface configuration mode to attach the ACL to a specific port. 6) Apply the ACL with the correct direction (inbound) using the ip access-group command, which activates the filtering. 7) Verify the ACL is correctly applied to confirm the configuration is functioning as intended.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Identify the traffic to filter (deny Telnet from 192.168.1.0/24 to 10.0.0.1) and determine that the ACL should be applied inbound on interface GigabitEthernet0/1.
Why this is correct
The first step is to clearly define what traffic must be blocked: Telnet traffic (TCP port 23) originating from the 192.168.1.0/24 network and destined for host 10.0.0.1. It also requires determining the correct ACL placement — because this traffic enters the router via GigabitEthernet0/1, applying the ACL inbound on that interface stops the Telnet packets before they are routed or consumed by the router itself. This prevents wasted processing and is consistent with the best practice of placing the ACL as close to the source as possible.
✓
Enter global configuration mode.
Why this is correct
Extended ACL configuration commands such as access-list are global configuration commands, so your first step on the CLI is to enter global configuration mode with 'configure terminal'. Without this context, the router will reject administrative commands or interpret them in the wrong mode, causing errors. This mode provides the environment where named and numbered access-lists are defined.
✓
Configure the extended ACL: access-list 100 deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq 23
Why this is correct
The command 'access-list 100 deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq 23' is the precise extended ACL statement that matches Telnet traffic from the entire 192.168.1.0/24 network to the single host 10.0.0.1. The number 100 designates an extended ACL (100-199), 'tcp' is the protocol, the wildcard mask 0.0.0.255 inverts the /24 mask, 'host' equals a wildcard of 0.0.0.0, and 'eq 23' filters for Telnet. This single line is the enforcement rule that will be evaluated against each inbound packet.
✓
Add the permit statement: access-list 100 permit ip any any
Why this is correct
Every standard or extended ACL contains an implicit 'deny all' at the end, so unless you explicitly allow other traffic, all IP packets will be dropped after the deny rule is processed. The statement 'access-list 100 permit ip any any' permits all remaining IP traffic, ensuring that only the Telnet flows from 192.168.1.0/24 to 10.0.0.1 are blocked while all other communication continues to function. Omitting this line is a common cause of accidental network outages when applying an ACL.
✓
Enter interface configuration mode for GigabitEthernet0/1.
Why this is correct
An ACL is only effective when it is applied to an interface, and the interface must be specified in interface configuration mode. You enter this mode with the command 'interface GigabitEthernet0/1', which tells the router that the subsequent ACL binding will affect this physical or logical interface. This step is essential because the ACL is global until it is attached, and the router needs to know which ingress/egress point should filter the traffic.
✓
Apply the ACL inbound: ip access-group 100 in
Why this is correct
The command 'ip access-group 100 in' binds the previously defined ACL 100 to GigabitEthernet0/1 and applies it to traffic that is entering the interface. The keyword 'in' is critical — applying 'out' would instead filter traffic leaving that interface, which would not match the intended traffic path and would likely have no effect. This step makes the access-control entries operational and triggers the router to compare every inbound packet against the ACL rules.
✓
Verify the ACL is active: show ip interface GigabitEthernet0/1 | include access list
Why this is correct
Verification is an operational necessity: 'show ip interface GigabitEthernet0/1 | include access list' displays whether an access list is applied, and the filter 'include access list' isolates the relevant line. This confirms both that the ACL is bound to the correct interface and that the direction is 'in'. A more detailed alternative is 'show access-list 100', which also shows match counters and helps confirm that the deny rule is being hit.

CCNA Network Services and Security Practice Question

Why each option matters

Option-by-option breakdown

Question Discussion