Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Which of the following is the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the router's G0/0 interface?
⚠ Common exam trap
Be careful with the order of operations: ACLs must be created before they can be applied, and the order of entries within the ACL matters. Also, remember that 'ip access-group' is an interface command, not global.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enter global configuration mode, create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, permit ip any any, then enter interface G0/0, apply ip access-group <acl-number> in
The correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from 192.168.1.0/24 to 10.0.0.0/24, applied inbound on G0/0, is: first enter global configuration mode, create the ACL with a deny statement for the specific source and destination, then add a permit ip any any statement, then enter interface G0/0, and apply the ACL inbound with ip access-group <acl-number> in. Option B is incorrect because the ACL must be created before entering the interface. Option C is incorrect because the order of ACEs within the ACL must have the specific deny before the broad permit. Option D is incorrect because ip access-group must be applied on an interface, not globally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enter global configuration mode, create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, permit ip any any, then enter interface G0/0, apply ip access-group <acl-number> in
Why this is correct
This is the correct sequence because you must first enter global configuration mode, then define an extended numbered ACL that precisely matches the Telnet traffic from source 192.168.1.0/24 to destination 10.0.0.0/24 with the eq telnet keyword. The explicit permit ip any any statement ensures all other traffic is allowed, and the ACL is then applied inbound on interface G0/0 with the ip access-group command. This ordering guarantees that the deny rule is evaluated first, before the implicit deny at the end of every ACL, and the wildcard masks correctly identify the source and destination networks.
- ✗
Enter interface G0/0, apply ip access-group <acl-number> in, then create ACL with deny tcp any any eq telnet, permit ip any any
Why it's wrong here
This option is wrong because you are trying to apply an ACL to interface G0/0 before the ACL has been created in global configuration mode; the interface command would reference a non-existent ACL and fail. The ACL statements themselves are also incorrect—deny tcp any any eq telnet is too broad and does not match the specific source 192.168.1.0/24 and destination 10.0.0.0/24 networks. The proper workflow is to first create the ACL in global config, then enter interface mode and apply it, but this option reverses that order and uses overly permissive/generic matching.
- ✗
Enter global configuration mode, create ACL with permit ip any any, deny tcp any any eq telnet, then enter interface G0/0, apply ip access-group <acl-number> in
Why it's wrong here
This option is incorrect because of the order in which the ACL statements are placed: the permit ip any any statement appears first, which would match and permit all IP traffic, including the Telnet traffic you are trying to block, before the deny rule can be evaluated. Even if the deny were placed first, the deny tcp any any eq telnet rule is overly broad—it blocks Telnet from any source to any destination, not just from 192.168.1.0/24 to 10.0.0.0/24—so it would not meet the specific requirement. Additionally, the question requires the deny to match the exact source and destination networks, which this ACL fails to do.
- ✗
Enter global configuration mode, create ACL with deny tcp any any eq telnet, permit ip any any, then apply ip access-group <acl-number> in without entering interface
Why it's wrong here
This option fails because the ip access-group command is being applied in global configuration mode, but it is only valid in interface configuration mode; the router would reject it or require entering interface G0/0 first. Even if applied correctly, the ACL definition itself is too generic—deny tcp any any eq telnet blocks Telnet from all sources to all destinations, not just from 192.168.1.0/24 to 10.0.0.0/24—so it does not match the requirement. The sequence also skips the mandatory step of entering the specific interface, so the access-group cannot be bound to the correct inbound direction.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enter global configuration mode, create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, permit ip any any, then enter interface G0/0, apply ip access-group <acl-number> inCorrect answer▾
Why this is correct
This is the correct sequence because you must first enter global configuration mode, then define an extended numbered ACL that precisely matches the Telnet traffic from source 192.168.1.0/24 to destination 10.0.0.0/24 with the eq telnet keyword. The explicit permit ip any any statement ensures all other traffic is allowed, and the ACL is then applied inbound on interface G0/0 with the ip access-group command. This ordering guarantees that the deny rule is evaluated first, before the implicit deny at the end of every ACL, and the wildcard masks correctly identify the source and destination networks.
✗Enter interface G0/0, apply ip access-group <acl-number> in, then create ACL with deny tcp any any eq telnet, permit ip any anyWrong answer — click to see why▾
Why this is wrong here
The specific factual error: ACLs must be defined in global config before they can be applied to an interface.
Why candidates choose this
Candidates might think the order of applying the ACL first is acceptable because they focus on the interface step, but they forget the ACL must exist first.
✗Enter global configuration mode, create ACL with permit ip any any, deny tcp any any eq telnet, then enter interface G0/0, apply ip access-group <acl-number> inWrong answer — click to see why▾
Why this is wrong here
The specific factual error: ACLs are processed top-down; a permit all statement before the deny would allow Telnet traffic.
Why candidates choose this
Candidates may mistakenly think the order of entries doesn't matter or that the deny will override the permit, but ACLs stop processing after the first match.
✗Enter global configuration mode, create ACL with deny tcp any any eq telnet, permit ip any any, then apply ip access-group <acl-number> in without entering interfaceWrong answer — click to see why▾
Why this is wrong here
The specific factual error: The ip access-group command is an interface configuration command, not a global configuration command.
Why candidates choose this
Candidates might confuse the application of ACLs with other global commands, or think that 'ip access-group' can be used globally like 'access-list'.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.