Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the interface facing the source.
⚠ Common exam trap
Watch out for the order of ACL statements: deny must come before permit. Also, remember that ACLs must be created before they can be applied to an interface. Do not forget the implicit deny at the end of every ACL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.
First, global config, then create ACL with deny and permit statements (order matters: deny first), then enter the source-facing interface and apply inbound; applying before creating ACL would fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.
Why this is correct
This is correct because the standard procedure is to first enter global configuration mode, then create the ACL with the deny statement for Telnet traffic followed by a permit any statement (since ACLs have an implicit deny at the end), then apply the ACL inbound on the interface facing the source. Applying before creating the ACL would fail.
- ✗
Enter the interface facing the source, apply the ACL inbound, then enter global configuration mode and create the ACL with deny and permit statements.
Why it's wrong here
You cannot apply an access-list to an interface before it exists. The 'ip access-group' command on an interface references a named or numbered ACL that must already be defined in the running configuration; if it is not, the router returns an error and the command is rejected. Even if ACL creation were possible from interface configuration mode, which it is not, the interface would have no policy to reference, so entering global configuration mode to create the ACL first is mandatory.
- ✗
Enter global configuration mode, create the ACL with permit ip any any first, then deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound.
Why it's wrong here
ACLs are evaluated sequentially from top to bottom, and the first matching entry determines what happens. Placing 'permit ip any any' as the first line matches every IP packet, including the Telnet traffic from 192.168.1.0/24 to 10.0.0.0/24, so the subsequent deny statement is never evaluated and the Telnet filter is completely bypassed. To block Telnet, the specific deny entry must appear before any broad permit, making the line order critical for the ACL to function correctly.
- ✗
Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound, without adding a permit statement.
Why it's wrong here
Every IP access-list has an implicit 'deny ip any any' at the end, so any traffic not explicitly matched is dropped. Since the only explicit entry is the deny for Telnet, all other traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network would also be denied when this ACL is applied inbound on the source-facing interface. To meet the requirement of blocking only Telnet while permitting everything else, you must add an explicit 'permit ip any any' after the deny entry, making the intended allow behavior explicit and overriding the implicit deny.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.Correct answer▾
Why this is correct
This is correct because the standard procedure is to first enter global configuration mode, then create the ACL with the deny statement for Telnet traffic followed by a permit any statement (since ACLs have an implicit deny at the end), then apply the ACL inbound on the interface facing the source. Applying before creating the ACL would fail.
✗Enter the interface facing the source, apply the ACL inbound, then enter global configuration mode and create the ACL with deny and permit statements.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that applying an ACL before creating it will result in an error because the ACL does not exist.
Why candidates choose this
Candidates might think that applying the ACL first is acceptable because they may confuse the order of operations or think that the ACL can be created after application.
✗Enter global configuration mode, create the ACL with permit ip any any first, then deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that ACL statements are processed sequentially; a permit any any before a deny would permit the Telnet traffic, defeating the purpose.
Why candidates choose this
Candidates might think that the order does not matter or that they can place the permit first to ensure other traffic is allowed, not realizing that the deny would never be reached.
✗Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound, without adding a permit statement.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is forgetting that ACLs have an implicit deny at the end, so only Telnet traffic is explicitly denied, but all other traffic would also be denied unless a permit statement is added.
Why candidates choose this
Candidates might think that only the Telnet traffic needs to be denied and that other traffic will be allowed by default, not realizing the implicit deny.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.