CCNA Network Services and Security Practice Question
Which TWO statements correctly describe the behavior of standard ACLs when applied to an interface?
⚠ Common exam trap
Cisco often tests the misconception that standard ACLs can filter on destination addresses or protocols, leading candidates to choose option A or C, when in fact standard ACLs only match source IP addresses and always end with an implicit deny any.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Standard ACLs should be placed as close to the destination as possible.
Standard ACLs filter traffic based solely on the source IP address, not the destination. Because they do not consider destination addresses, placing them as close to the destination as possible prevents them from inadvertently blocking traffic that should reach other parts of the network. This placement ensures that only the intended traffic is filtered at the final hop before the destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Standard ACLs filter traffic based on source and destination IP addresses.
Why it's wrong here
Standard ACLs are limited to examining the source IP address in the packet header, ignoring the destination IP entirely. A standard numbered ACL (1-99 or 1300-1999) uses only a source address and wildcard mask as match criteria. Therefore, any claim that standard ACLs filter on both source and destination is incorrect; that capability belongs exclusively to extended ACLs.
- ✓
Standard ACLs should be placed as close to the destination as possible.
Why this is correct
Because standard ACLs only match the source IP address, applying them near the source can inadvertently drop traffic intended for other destinations. To minimize this risk, standard ACLs should be placed as close to the destination as possible, where the source address's reach is limited and the filter's impact is scoped. This placement reduces collateral damage to legitimate traffic that should only be filtered near the target network.
- ✗
Standard ACLs can filter traffic based on protocol type (TCP, UDP, ICMP).
Why it's wrong here
Standard ACLs cannot filter by protocol type because their match criteria are confined to the source IP address and wildcard mask. They have no mechanism to inspect the protocol field (e.g., TCP, UDP, ICMP) in the IP header; extended ACLs are required for protocol- and port-based filtering. Thus, a standard ACL cannot selectively permit or deny TCP while allowing UDP, as such granularity is outside its design.
- ✓
Standard ACLs use an implicit deny any statement at the end.
Why this is correct
All IP access lists, including standard ACLs, conclude with an implicit 'deny any' statement that is not visible in the running configuration. This means any packet that does not match an explicit permit entry is automatically discarded. This built-in safety default ensures that the default behavior is to deny all traffic when no rule matches.
- ✗
Standard ACLs are applied to interfaces in the inbound direction only.
Why it's wrong here
Standard ACLs can be applied to an interface in either the inbound or outbound direction using the ip access-group command. Inbound filtering evaluates packets as they arrive on the interface, while outbound filtering evaluates packets as they depart. The direction is selected based on the desired control point; therefore, restricting standard ACLs to only inbound is incorrect.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Standard ACLs should be placed as close to the destination as possible.Correct answer▾
Why this is correct
Because standard ACLs only match the source IP address, applying them near the source can inadvertently drop traffic intended for other destinations. To minimize this risk, standard ACLs should be placed as close to the destination as possible, where the source address's reach is limited and the filter's impact is scoped. This placement reduces collateral damage to legitimate traffic that should only be filtered near the target network.
✗Standard ACLs filter traffic based on source and destination IP addresses.Wrong answer — click to see why▾
Why this is wrong here
This describes the capability of extended ACLs, not standard ACLs.
✗Standard ACLs can filter traffic based on protocol type (TCP, UDP, ICMP).Wrong answer — click to see why▾
Why this is wrong here
Protocol filtering is a feature of extended ACLs, not standard ACLs.
✗Standard ACLs are applied to interfaces in the inbound direction only.Wrong answer — click to see why▾
Why this is wrong here
Both inbound and outbound application are possible, though placement depends on the filtering strategy.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.