CCNA Network Services and Security Practice Question
Which TWO statements correctly describe the behavior of standard ACLs and their placement on interfaces?
⚠ Common exam trap
Cisco often tests the misconception that standard ACLs should be placed close to the source (like extended ACLs), when in fact standard ACLs lack the granularity to do so safely and must be placed near the destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Standard ACLs filter traffic based on source IP address only.
Standard ACLs filter traffic based solely on the source IP address, using numbers 1–99 or 1300–1999 in classic Cisco IOS. They do not consider destination IP, protocol, or port numbers. Because they lack granularity, placing them close to the destination (option D) prevents them from inadvertently blocking traffic that should be permitted, as they cannot distinguish between traffic destined for different services on the same destination host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Standard ACLs filter traffic based on source IP address only.
Why this is correct
Standard ACLs are the simplest type of IP access list: they match a packet solely by its source IPv4 address (using an optional wildcard mask) and permit or deny it, ignoring all other header fields. The ACL does not inspect the destination address, protocol number, or TCP/UDP ports, which is why they are less flexible than extended ACLs. This behavior makes them suitable for filtering based on the origin of traffic and for basic source‑based policy, but they cannot enforce granular application‑level controls.
- ✗
Standard ACLs should be placed as close to the source as possible.
Why it's wrong here
Placing a standard ACL close to the source is incorrect because it will evaluate every packet from that source regardless of its final destination, potentially dropping traffic that should be allowed to other networks. Since standard ACLs cannot match the destination address, a permit or deny statement applies globally to all destinations for the specified source. Cisco recommends applying standard ACLs near the destination, while extended ACLs — which can match destination — should indeed be placed close to the source to reduce unnecessary transit traffic.
- ✗
Standard ACLs can filter traffic based on destination IP address.
Why it's wrong here
Standard ACLs do not look at the destination IP address at all — each ACE contains only a permit/deny decision based on the source address, with an optional wildcard mask. Because the router never inspects the destination field of the packet, a standard ACL cannot differentiate between traffic going to one host and traffic going to another. This is why extended ACLs are required when you need to match both source and destination addresses.
- ✓
Standard ACLs should be placed as close to the destination as possible.
Why this is correct
Placing a standard ACL as close to the destination as possible is the correct strategy because the ACL can only match the source IP, so its effect is independent of the path taken until the packet reaches the destination network. If you apply the ACL closer to a specific destination, you can allow the source's traffic to reach other destinations while denying or permitting only traffic destined for that particular subnet. This placement minimizes the risk of overlapping other traffic streams and matches the Cisco recommended practice for standard IP ACLs.
- ✗
Standard ACLs can filter traffic based on TCP or UDP port numbers.
Why it's wrong here
Standard ACLs cannot filter by TCP or UDP port numbers because they operate only at Layer 3 and match solely on the source IP address and wildcard mask. Port fields are Layer 4 information, which the standard ACL code never examines; only an extended ACL (numbered 100–199 or named) can specify protocol and port numbers in its entries. Thus, any attempt to use a standard ACL to block a specific web service or application port will fail.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Standard ACLs filter traffic based on source IP address only.Correct answer▾
Why this is correct
Standard ACLs are the simplest type of IP access list: they match a packet solely by its source IPv4 address (using an optional wildcard mask) and permit or deny it, ignoring all other header fields. The ACL does not inspect the destination address, protocol number, or TCP/UDP ports, which is why they are less flexible than extended ACLs. This behavior makes them suitable for filtering based on the origin of traffic and for basic source‑based policy, but they cannot enforce granular application‑level controls.
✗Standard ACLs should be placed as close to the source as possible.Wrong answer — click to see why▾
Why this is wrong here
Standard ACLs filter only on source IP, so placing them close to the source can block traffic destined to other networks that should be allowed. The correct placement is close to the destination to minimize unintended filtering.
Why candidates choose this
Students often confuse the placement rule for standard ACLs with that of extended ACLs. Extended ACLs should be placed close to the source, but standard ACLs have the opposite recommendation.
✗Standard ACLs can filter traffic based on destination IP address.Wrong answer — click to see why▾
Why this is wrong here
Standard ACLs do not examine destination IP addresses; they only match on source IP addresses. Filtering by destination requires an extended ACL.
Why candidates choose this
Some students may think that since ACLs filter traffic, they can use any IP field, but standard ACLs are limited to source IP only.
✗Standard ACLs can filter traffic based on TCP or UDP port numbers.Wrong answer — click to see why▾
Why this is wrong here
Standard ACLs operate at Layer 3 and cannot examine Layer 4 information such as TCP or UDP port numbers. Port-based filtering requires an extended ACL.
Why candidates choose this
Students may assume that all ACLs can filter on ports, but only extended ACLs have that capability. Standard ACLs are simpler and less granular.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.