CCNA Network Services and Security Practice Question
Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?
⚠ Common exam trap
Cisco often tests the misconception that standard ACLs should be placed close to the source, when in fact extended ACLs are placed close to the source and standard ACLs close to the destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Extended ACLs are typically placed closest to the source of the traffic.
Extended ACLs evaluate multiple criteria (source/destination IP, port, protocol), so placing them closest to the source prevents unwanted traffic from consuming bandwidth across the network. Option C is correct because a wildcard mask of 0.0.0.0 means all 32 bits must match, matching a single host. Option A is incorrect—standard ACLs are placed closest to the destination, not the source. Option D is incorrect—a wildcard mask of 255.255.255.255 matches any address (ignores all bits), not all bits. Option E is incorrect—extended ACLs placed near the destination would not conserve bandwidth; they should be near the source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Standard ACLs are typically placed closest to the source of the traffic.
Why it's wrong here
Standard ACLs identify traffic based solely on the source IP address and have no way to distinguish destination or ports. Placing a standard ACL close to the source would incorrectly permit or deny traffic to any destination, potentially blocking legitimate traffic that should be allowed to reach other hosts. Therefore, standard ACLs are typically placed as close to the destination as possible to minimize the risk of over-filtering.
- ✓
Extended ACLs are typically placed closest to the source of the traffic.
Why this is correct
Extended ACLs are placed closest to the source of traffic because they can filter on multiple fields such as source and destination IP, Layer 4 ports, and protocols. Filtering early at the source prevents unwanted traffic from wasting bandwidth and router CPU resources across the entire network path. This placement also ensures that the more specific extended criteria are applied as soon as traffic enters the network, making the filtering efficient and effective.
- ✓
A wildcard mask of 0.0.0.0 in an ACL matches all bits of the IP address.
Why this is correct
In an ACL wildcard mask, a 0 bit means the corresponding bit in the IP address must be checked and match exactly, while a 1 bit is ignored. A mask of 0.0.0.0 (all zeros) forces every bit of the 32-bit address to be compared, so the entire IP address must match exactly. This is why a host-specific ACL entry uses the full IP address followed by 0.0.0.0.
- ✗
A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.
Why it's wrong here
A wildcard mask of 255.255.255.255 is used to ignore all bits, meaning every bit in the IP address is treated as a wildcard and does not need to match. Therefore, this mask matches any IP address, equivalent to the keyword 'any.' The claim that it matches all bits is incorrect because binary 255 in each octet indicates 'don't care' for every bit, not a strict match.
- ✗
Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.
Why it's wrong here
Placing extended ACLs near the destination is poor practice because the unwanted traffic still traverses the entire network, consuming bandwidth and processing on every intermediate router before it is finally dropped. Extended ACLs can filter on details like destination port and protocol, so enforcing them at the source interface blocks the traffic early and avoids wasting network resources. This contradicts the design principle that extended ACLs should be closest to the source, not the destination.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Extended ACLs are typically placed closest to the source of the traffic.Correct answer▾
Why this is correct
Extended ACLs are placed closest to the source of traffic because they can filter on multiple fields such as source and destination IP, Layer 4 ports, and protocols. Filtering early at the source prevents unwanted traffic from wasting bandwidth and router CPU resources across the entire network path. This placement also ensures that the more specific extended criteria are applied as soon as traffic enters the network, making the filtering efficient and effective.
✗Standard ACLs are typically placed closest to the source of the traffic.Wrong answer — click to see why▾
Why this is wrong here
Standard ACLs filter only on source IP address, so placing them close to the source can block traffic that should be allowed to other destinations, causing unnecessary denial of service.
Why candidates choose this
Students often confuse the placement rule for standard ACLs with extended ACLs, thinking that placing ACLs near the source is always beneficial, but standard ACLs lack the granularity to filter based on destination.
✗A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.Wrong answer — click to see why▾
Why this is wrong here
A wildcard mask of 255.255.255.255 means 'ignore all bits,' so it matches any IP address, equivalent to the 'any' keyword. It does not match all bits.
Why candidates choose this
Students may mistakenly think that a mask of all 255s means checking all bits, confusing wildcard masks with subnet masks where 255 indicates network bits.
✗Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.Wrong answer — click to see why▾
Why this is wrong here
Extended ACLs are more effective when placed near the source to filter unwanted traffic early, not near the destination. Placing them near the destination allows unwanted traffic to traverse the network unnecessarily.
Why candidates choose this
Some students believe that filtering near the destination is more efficient because it only affects the final segment, but this ignores the bandwidth and processing wasted on transit.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Wildcard mask
A wildcard mask is a sequence of 32 bits used alongside an IP address to define which bits must match and which are ignored for routing, access control, or network matching purposes.
Key term
Bandwidth
Bandwidth is the maximum amount of data that can travel over a network connection in a given amount of time, usually measured in bits per second.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.