Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server 10.0.0.10, applied inbound on interface GigabitEthernet0/1.
⚠ Common exam trap
A common trap is applying the ACL to an interface before creating it, or verifying before applying. Remember: create first, then apply, then verify. Also, ensure the ACL is applied in the correct direction (inbound) on the correct interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1. Enter global configuration mode 2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 3. Enter interface configuration mode for GigabitEthernet0/1 4. Apply the ACL inbound with ip access-group ACL_NAME in 5. Exit configuration mode and verify with show access-lists
After entering config mode, create the ACL to allow HTTP from the specified network to the server. Apply it inbound on the correct interface. Then exit and verify.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
1. Enter global configuration mode 2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 3. Enter interface configuration mode for GigabitEthernet0/1 4. Apply the ACL inbound with ip access-group ACL_NAME in 5. Exit configuration mode and verify with show access-lists
Why this is correct
This order correctly follows the standard workflow: enter config mode, create the ACL, enter the interface, apply it inbound, then exit and verify. The ACL syntax permits HTTP (TCP port 80) from the source network to the specific server.
- ✗
1. Enter interface configuration mode for GigabitEthernet0/1 2. Apply the ACL inbound with ip access-group ACL_NAME in 3. Enter global configuration mode 4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 5. Exit configuration mode and verify with show access-lists
Why it's wrong here
This sequence reverses the configuration workflow by entering interface configuration mode before global configuration mode. Because the ACL has not yet been created in global config, the ip access-group command references a nonexistent ACL, leaving the interface with no effective packet filtering even though the command may be accepted. The correct order requires defining the ACL in global configuration mode first, then entering interface configuration mode to apply it.
- ✗
1. Enter global configuration mode 2. Enter interface configuration mode for GigabitEthernet0/1 3. Apply the ACL inbound with ip access-group ACL_NAME in 4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 5. Exit configuration mode and verify with show access-lists
Why it's wrong here
This workflow incorrectly places the ip access-group command before the ACL definition, and it also attempts to issue the ACL creation command from interface configuration mode, where global configuration commands are not valid. After entering interface configuration mode, you cannot just create an ACL; you must return to global configuration mode, define the named ACL, then re-enter the interface to apply it. The correct sequence is to build the ACL in global config, enter the interface, and then bind it with ip access-group.
- ✗
1. Enter global configuration mode 2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 3. Exit configuration mode and verify with show access-lists 4. Enter interface configuration mode for GigabitEthernet0/1 5. Apply the ACL inbound with ip access-group ACL_NAME in
Why it's wrong here
Although the ACL is created correctly, this sequence exits global configuration mode and runs show access-lists before the ACL has been attached to any interface, so the verification only proves the ACL exists—it does not confirm that traffic is being filtered on GigabitEthernet0/1. This also forces an unnecessary re-entry into interface configuration mode, making the process inefficient. Verification should be the final step, after the access-group has been applied inbound to the interface.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓1. Enter global configuration mode 2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 3. Enter interface configuration mode for GigabitEthernet0/1 4. Apply the ACL inbound with ip access-group ACL_NAME in 5. Exit configuration mode and verify with show access-listsCorrect answer▾
Why this is correct
This order correctly follows the standard workflow: enter config mode, create the ACL, enter the interface, apply it inbound, then exit and verify. The ACL syntax permits HTTP (TCP port 80) from the source network to the specific server.
✗1. Enter interface configuration mode for GigabitEthernet0/1 2. Apply the ACL inbound with ip access-group ACL_NAME in 3. Enter global configuration mode 4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 5. Exit configuration mode and verify with show access-listsWrong answer — click to see why▾
Why this is wrong here
The ACL must be defined before it can be referenced in an ip access-group command.
Why candidates choose this
Candidates might think they can apply the ACL first and then define it, but the router will reject the application if the ACL does not exist.
✗1. Enter global configuration mode 2. Enter interface configuration mode for GigabitEthernet0/1 3. Apply the ACL inbound with ip access-group ACL_NAME in 4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 5. Exit configuration mode and verify with show access-listsWrong answer — click to see why▾
Why this is wrong here
The ip access-group command references an ACL that does not yet exist, causing an error.
Why candidates choose this
Candidates might think they can enter interface config mode early and apply the ACL later, but the application command requires the ACL to already exist.
✗1. Enter global configuration mode 2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www 3. Exit configuration mode and verify with show access-lists 4. Enter interface configuration mode for GigabitEthernet0/1 5. Apply the ACL inbound with ip access-group ACL_NAME inWrong answer — click to see why▾
Why this is wrong here
Verifying before applying does not confirm the ACL is correctly applied to the interface. The show access-lists command only shows the ACL definition, not its application.
Why candidates choose this
Candidates might think they need to verify the ACL syntax before applying it, but the correct workflow is to apply first, then verify both the ACL and its interface binding.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.