Courseiva
Network Services and SecuritymediumMultiple SelectObjective-mapped

CCNA Network Services and Security Practice Question

Which TWO statements correctly describe the behavior of standard ACLs when applied to an interface?

⚠ Common exam trap

Cisco often tests the misconception that standard ACLs can filter on destination addresses or protocols, leading candidates to choose option A or C, when in fact standard ACLs only match source IP addresses and always end with an implicit deny any.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Standard ACLs should be placed as close to the destination as possible.

Standard ACLs filter traffic based solely on the source IP address, not the destination. Because they do not consider destination addresses, placing them as close to the destination as possible prevents them from inadvertently blocking traffic that should reach other parts of the network. This placement ensures that only the intended traffic is filtered at the final hop before the destination.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Standard ACLs filter traffic based on source and destination IP addresses.

    Why it's wrong here

    Standard ACLs are limited to examining the source IP address in the packet header, ignoring the destination IP entirely. A standard numbered ACL (1-99 or 1300-1999) uses only a source address and wildcard mask as match criteria. Therefore, any claim that standard ACLs filter on both source and destination is incorrect; that capability belongs exclusively to extended ACLs.

  • Standard ACLs should be placed as close to the destination as possible.

    Why this is correct

    Because standard ACLs only match the source IP address, applying them near the source can inadvertently drop traffic intended for other destinations. To minimize this risk, standard ACLs should be placed as close to the destination as possible, where the source address's reach is limited and the filter's impact is scoped. This placement reduces collateral damage to legitimate traffic that should only be filtered near the target network.

  • Standard ACLs can filter traffic based on protocol type (TCP, UDP, ICMP).

    Why it's wrong here

    Standard ACLs cannot filter by protocol type because their match criteria are confined to the source IP address and wildcard mask. They have no mechanism to inspect the protocol field (e.g., TCP, UDP, ICMP) in the IP header; extended ACLs are required for protocol- and port-based filtering. Thus, a standard ACL cannot selectively permit or deny TCP while allowing UDP, as such granularity is outside its design.

  • Standard ACLs use an implicit deny any statement at the end.

    Why this is correct

    All IP access lists, including standard ACLs, conclude with an implicit 'deny any' statement that is not visible in the running configuration. This means any packet that does not match an explicit permit entry is automatically discarded. This built-in safety default ensures that the default behavior is to deny all traffic when no rule matches.

  • Standard ACLs are applied to interfaces in the inbound direction only.

    Why it's wrong here

    Standard ACLs can be applied to an interface in either the inbound or outbound direction using the ip access-group command. Inbound filtering evaluates packets as they arrive on the interface, while outbound filtering evaluates packets as they depart. The direction is selected based on the desired control point; therefore, restricting standard ACLs to only inbound is incorrect.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Standard ACLs should be placed as close to the destination as possible.Correct answer

Why this is correct

Because standard ACLs only match the source IP address, applying them near the source can inadvertently drop traffic intended for other destinations. To minimize this risk, standard ACLs should be placed as close to the destination as possible, where the source address's reach is limited and the filter's impact is scoped. This placement reduces collateral damage to legitimate traffic that should only be filtered near the target network.

Standard ACLs filter traffic based on source and destination IP addresses.Wrong answer — click to see why

Why this is wrong here

This describes the capability of extended ACLs, not standard ACLs.

Standard ACLs can filter traffic based on protocol type (TCP, UDP, ICMP).Wrong answer — click to see why

Why this is wrong here

Protocol filtering is a feature of extended ACLs, not standard ACLs.

Standard ACLs are applied to interfaces in the inbound direction only.Wrong answer — click to see why

Why this is wrong here

Both inbound and outbound application are possible, though placement depends on the filtering strategy.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.