CCNA Network Services and Security Practice Question
Exhibit
R1# show ip access-lists
Extended IP access list 110
10 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 (145 matches)
20 permit ip 192.168.10.0 0.0.0.255 any (95 matches)
Extended IP access list BLOCK_WEB
10 deny tcp any any eq 80
20 deny tcp any any eq 443
30 permit ip any any (5 matches)
Standard IP access list 10
10 permit 192.168.10.0 0.0.0.255 (21 matches)
20 deny any (8 matches)Refer to the exhibit. A network administrator is troubleshooting connectivity issues. Hosts on the 192.168.10.0/24 network cannot reach servers on the 192.168.20.0/24 network, but they can successfully reach other networks, including the Internet. The administrator runs the show ip access-lists command on the router (output shown). What is the most likely cause?
⚠ Common exam trap
Cisco often tests the concept of ACL order of operations, where candidates mistakenly think that a later permit statement will override an earlier deny, or that the implicit deny is the culprit when an explicit deny is actually matching first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The order of the ACL entries causes the deny statement to match first.
The ACL is processed top-down, and the first matching entry determines the action. In this scenario, the deny statement for 192.168.10.0/24 to 192.168.20.0/24 appears before any permit statement for that traffic, so packets from the 192.168.10.0/24 network to the 192.168.20.0/24 network are denied immediately, even if a later permit statement would have allowed them. This explains why hosts can reach other networks (including the Internet) but not the 192.168.20.0/24 servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL is applied in the wrong direction on the interface.
Why it's wrong here
If the ACL were applied in the wrong direction, traffic from 192.168.10.0/24 to other networks would also be blocked, but the problem states that hosts can reach other networks. The output does not show interface application information, so direction is not indicated by the exhibit.
- ✗
The ACL is missing a permit statement for the 192.168.20.0/24 destination.
Why it's wrong here
The ACL has a permit ip any statement (entry 20) that would match traffic to 192.168.20.0/24 if it were evaluated before the deny. The missing permit is not the issue; the order causes the deny to match first.
- ✓
The order of the ACL entries causes the deny statement to match first.
Why this is correct
Extended IP access list 110 processes entries sequentially. Entry 10 denies traffic from 192.168.10.0/24 to 192.168.20.0/24, and entry 20 permits the same source to any destination. Because the deny is listed first, it is matched before the permit, causing the traffic to be dropped.
- ✗
The implicit deny at the end is blocking the traffic to 192.168.20.0/24.
Why it's wrong here
The implicit deny would only block traffic that does not match any explicit entry. Here, the traffic matches the explicit deny rule (entry 10), so the implicit deny is not reached. The hit counter on entry 10 confirms explicit matching.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The order of the ACL entries causes the deny statement to match first.Correct answer▾
Why this is correct
Extended IP access list 110 processes entries sequentially. Entry 10 denies traffic from 192.168.10.0/24 to 192.168.20.0/24, and entry 20 permits the same source to any destination. Because the deny is listed first, it is matched before the permit, causing the traffic to be dropped.
✗The ACL is applied in the wrong direction on the interface.Wrong answer — click to see why▾
Why this is wrong here
Candidates may assume any ACL misbehavior is due to wrong interface direction, ignoring that the specific symptom (only 192.168.20.0 is unreachable) points to the deny rule itself.
✗The ACL is missing a permit statement for the 192.168.20.0/24 destination.Wrong answer — click to see why▾
Why this is wrong here
Candidates often focus on what an ACL ‘lacks’ rather than the sequence, missing that the existing permit any covers the destination but is shadowed by the earlier deny.
✗The implicit deny at the end is blocking the traffic to 192.168.20.0/24.Wrong answer — click to see why▾
Why this is wrong here
Candidates might recall that all ACLs have an implicit deny, but they fail to realize that a packet matching an earlier deny is already discarded, and the implicit deny only applies to unmatched traffic.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.