Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Drag and drop the following steps into the correct order to configure and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.1, with the ACL applied inbound on the router's GigabitEthernet0/0 interface, and then verify the configuration.
⚠ Common exam trap
Pay attention to the direction of ACL application (inbound vs outbound) and the specific verification command. Also, ensure you exit configuration mode before verifying, as some show commands are available in config mode but the standard workflow is to exit first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show access-lists'.
First, enter config mode. Create the ACL permitting HTTP from the source network to the destination host. Apply it inbound on the correct interface. Then exit and verify.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show access-lists'.
Why this is correct
This sequence correctly enters configuration mode, creates an extended ACL (number 100) that permits HTTP (TCP port 80, 'www') from the source network to the destination host, applies it inbound on the correct interface, and verifies with 'show access-lists'.
- ✗
Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it outbound on GigabitEthernet0/0 with 'ip access-group 100 out', then exit and verify with 'show access-lists'.
Why it's wrong here
This option fails because the ACL is bound to the outbound direction of GigabitEthernet0/0, but the required policy governs traffic entering that interface. An outbound ACL evaluates packets only after routing, just before they leave the interface, so the HTTP-permit statement would never be matched against the traffic arriving from 192.168.1.0/24. Since the requirement explicitly specifies inbound filtering, applying the access-group as 'out' is the wrong interface direction, regardless of correct ACL syntax or verification command.
- ✗
Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then verify with 'show running-config' without exiting configuration mode.
Why it's wrong here
This is incorrect because the steps omit exiting configuration mode before verification. While 'show running-config' can be run in config mode, the typical verification step is done in privileged EXEC mode after exiting. More importantly, the order lacks a clear exit step, which is part of the standard workflow.
- ✗
Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show ip interface brief'.
Why it's wrong here
The ACL is correctly created and applied inbound on the correct interface, but the verification command is inappropriate. 'show ip interface brief' only displays IP addresses, line protocol statuses, and administrative states; it cannot confirm whether an access-group is attached to the interface or what entries exist in the ACL. To validate the configuration, the correct command is 'show access-lists' or 'show running-config | include access-list', which would show the ACL entries and their hit counters. Because the chosen command does nothing to verify ACL enforcement, the workflow is incomplete.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show access-lists'.Correct answer▾
Why this is correct
This sequence correctly enters configuration mode, creates an extended ACL (number 100) that permits HTTP (TCP port 80, 'www') from the source network to the destination host, applies it inbound on the correct interface, and verifies with 'show access-lists'.
✗Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it outbound on GigabitEthernet0/0 with 'ip access-group 100 out', then exit and verify with 'show access-lists'.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The ACL direction is outbound instead of inbound.
Why candidates choose this
Candidates might confuse inbound and outbound directions, especially if they think of traffic flowing from the source network to the server as 'outbound' from the router.
✗Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then verify with 'show running-config' without exiting configuration mode.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The verification is performed while still in configuration mode, which is not the standard practice; also, the exit step is missing.
Why candidates choose this
Candidates might think that 'show running-config' can be used in any mode, but the question expects a specific order that includes exiting configuration mode before verification.
✗Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show ip interface brief'.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The verification command 'show ip interface brief' does not show ACL details.
Why candidates choose this
Candidates might confuse 'show ip interface brief' with 'show access-lists' because both are common show commands, but they serve different purposes.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.