Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?
⚠ Common exam trap
Be careful with the order of ACL entries: always place more specific permits before general denies. Also, remember that ACLs must be created before they can be applied, and the direction (inbound/outbound) must match the requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.
First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.
Why this is correct
This sequence is correct because standard IOS ACL processing requires the permit to be evaluated before the deny. By entering global configuration mode first, you can define the extended ACL with a permit statement matching HTTP traffic from the 192.168.1.0/24 subnet to host 10.0.0.1, followed by the implicit/explicit deny ip any any. Then switch to interface configuration mode for GigabitEthernet0/1 and apply the ACL inbound (ip access-group <acl> in), which filters traffic as it enters the interface from the 192.168.1.0/24 source network, exactly enforcing the stated policy.
- ✗
Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.
Why it's wrong here
This sequence is invalid because the ACL must exist before you can apply it to an interface. In Cisco IOS, entering interface configuration mode and attempting to bind a non-existent ACL (e.g., with ip access-group) will produce an error or an empty group, so the permit and deny entries are never defined. The proper order is: create the ACL in global configuration mode, exit, then enter interface configuration mode and apply it inbound—never the reverse.
- ✗
Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.
Why it's wrong here
This ordering is incorrect because ACLs are processed sequentially, top-to-bottom, and the first match takes action. Placing deny ip any any as the first entry causes all packets—including the HTTP traffic from 192.168.1.0/24 to 10.0.0.1—to be immediately dropped, and the subsequent permit statement will never be evaluated. To allow the desired HTTP traffic and block everything else, the permit statement must precede the deny all entry.
- ✗
Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.
Why it's wrong here
This option fails primarily because the ACL is applied outbound on GigabitEthernet0/1, whereas the requirement specifies inbound filtering. On a LAN-facing interface, inbound evaluates packets arriving from the source network before routing; outbound would apply after routing, missing the intended placement and potentially not matching the traffic path. Additionally, the permit statement here is underspecified—it lacks the source and destination details (192.168.1.0/24 to 10.0.0.1)—so even with correct direction, it would not enforce the desired granularity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.Correct answer▾
Why this is correct
This sequence is correct because standard IOS ACL processing requires the permit to be evaluated before the deny. By entering global configuration mode first, you can define the extended ACL with a permit statement matching HTTP traffic from the 192.168.1.0/24 subnet to host 10.0.0.1, followed by the implicit/explicit deny ip any any. Then switch to interface configuration mode for GigabitEthernet0/1 and apply the ACL inbound (ip access-group <acl> in), which filters traffic as it enters the interface from the 192.168.1.0/24 source network, exactly enforcing the stated policy.
✗Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.Wrong answer — click to see why▾
Why this is wrong here
An ACL must be created before it can be applied to an interface; applying it first is invalid.
Why candidates choose this
Candidates might think they can apply the ACL first and then define it, but Cisco IOS requires the ACL to exist before application.
✗Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.Wrong answer — click to see why▾
Why this is wrong here
Placing the deny all before the permit would block all traffic, including the desired HTTP traffic, defeating the purpose of the ACL.
Why candidates choose this
Candidates might think they need to deny everything first and then permit specific traffic, but ACLs use a first-match approach.
✗Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.Wrong answer — click to see why▾
Why this is wrong here
The ACL is applied outbound, but the requirement specifies inbound traffic, which would not filter the correct direction.
Why candidates choose this
Candidates may confuse inbound and outbound directions, especially if they think about traffic flow from the source perspective.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.