CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Standard IPv4 ACLs use numbers in the range 100-199.

  Why it's wrong here

  Standard IPv4 ACLs are numbered in the ranges 1–99 and 1300–1999, not 100–199. The number range 100–199 is explicitly reserved for extended numbered ACLs, which evaluate source and destination IP addresses, protocol, and port numbers. Misidentifying 100–199 as standard ACL numbers confuses the ACL type and its underlying matching logic.

• ✓

  Extended IPv4 ACLs should be placed as close to the source as possible to minimize unnecessary traffic on the network.

  Why this is correct

  Extended IPv4 ACLs can match on source and destination addresses, protocol, and TCP/UDP ports, so they can selectively deny specific traffic flows while permitting unrelated traffic. Placing such an ACL closest to the source of that traffic stops unwanted packets immediately at the ingress edge, preventing them from consuming bandwidth and router processing power on every intermediate link toward the destination. This granularity makes source-side placement safe and efficient, unlike standard ACLs.

• ✓

  IPv6 ACLs are always named and can filter traffic based on source and destination IPv6 addresses, as well as protocol types.

  Why this is correct

  IPv6 ACLs are always configured as named extended ACLs; there is no numbered IPv6 ACL concept. They examine IPv6 source and destination addresses, the Next Header field (analogous to the IPv4 protocol field), and TCP/UDP ports, along with other IPv6-specific options such as ICMPv6 message types. Because entries are processed sequentially until a match is found, careful ordering is essential to enforce policy correctly, with an implicit deny-all at the end.

• ✗

  Standard IPv4 ACLs filter only the source IP address and are best placed close to the source to be most effective.

  Why it's wrong here

  Standard ACLs indeed filter only on the source IP address, but that limited matching capability requires them to be placed as close to the destination as possible, not the source. If placed near the source, a standard ACL entry that denies a particular source would block that source's traffic to all destinations, including legitimate ones. Positioning near the destination limits the ACL's impact to the intended target network, avoiding accidental collateral denial.

• ✗

  Numbered ACLs allow individual access control entries (ACEs) to be deleted without removing the entire ACL.

  Why it's wrong here

  Numbered ACLs do not permit deletion of an individual access control entry; to remove one ACE, the entire ACL must be deleted and re-entered without that entry. Named ACLs, in contrast, assign sequence numbers to each ACE, allowing selective deletion, insertion, and resequencing without recreating the full list. This operational limitation of numbered ACLs applies to both standard and extended numbered variants and is a common source of configuration errors.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question