CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1 via console. R1 is a router that connects two internal subnets (192.168.1.0/24 and 192.168.2.0/24) to the internet via a serial link to ISP. Currently, no ACL is applied. Your task is to configure an extended named ACL on R1 that permits only HTTP (TCP/80) and HTTPS (TCP/443) traffic from the 192.168.1.0/24 subnet to the internet, and denies all other traffic from that subnet. Traffic from 192.168.2.0/24 must be permitted without restriction. Apply the ACL inbound on the interface facing the internal subnets. Additionally, verify that the implicit deny is not blocking necessary traffic by ensuring that the ACL correctly handles the traffic.
⚠ Common exam trap
The most common trap is confusing inbound vs outbound ACL application. Remember: inbound ACL filters traffic entering the interface; outbound ACL filters traffic leaving the interface. For traffic originating from a subnet, apply the ACL inbound on the interface connected to that subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER in
The task required an extended ACL to permit HTTP/HTTPS from 192.168.1.0/24 and all traffic from 192.168.2.0/24. The candidate must create a named ACL (e.g., FILTER), add two permit statements for TCP/80 and TCP/443 from 192.168.1.0 0.0.0.255 to any, then a permit ip from 192.168.2.0 0.0.0.255 to any. The ACL is applied inbound on G0/0 (the interface facing 192.168.1.0/24) because traffic from that subnet enters R1 through G0/0. Applying it outbound on G0/0 would be incorrect, as it would only filter traffic leaving that subnet, not entering. Also, the ACL must be applied on the correct interface to avoid blocking traffic from 192.168.2.0/24, which enters via G0/1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER in
Why this is correct
This configuration correctly creates a named extended ACL with two permit statements for HTTP and HTTPS from 192.168.1.0/24, followed by a permit all for 192.168.2.0/24. The ACL is applied inbound on G0/0, which is the interface facing the 192.168.1.0/24 subnet, ensuring traffic from that subnet is filtered as required.
- ✗
ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER out
Why it's wrong here
This is incorrect because the ACL is applied outbound on G0/0. Traffic from 192.168.1.0/24 enters R1 through G0/0, so an inbound ACL on G0/0 filters it before routing. An outbound ACL on G0/0 would filter traffic leaving that interface, which is traffic destined to the 192.168.1.0/24 subnet, not traffic from it.
- ✗
ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/1 ip access-group FILTER in
Why it's wrong here
This is incorrect because the ACL is applied inbound on G0/1, which is the interface facing the 192.168.2.0/24 subnet. Traffic from 192.168.1.0/24 enters R1 through G0/0, not G0/1. Applying the ACL on G0/1 would filter traffic from 192.168.2.0/24, which should be permitted without restriction, and would not filter traffic from 192.168.1.0/24 at all.
- ✗
ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER in interface g0/1 ip access-group FILTER in
Why it's wrong here
This is incorrect because the same ACL is applied inbound on both G0/0 and G0/1. While the ACL permits all traffic from 192.168.2.0/24, applying it on G0/1 is unnecessary and could cause confusion. More importantly, the ACL does not include an explicit deny for traffic from 192.168.1.0/24 other than HTTP/HTTPS; the implicit deny at the end of the ACL will block that traffic, but applying the ACL on G0/1 would also block any traffic from 192.168.2.0/24 that is not IP (though unlikely). The requirement is to apply the ACL only on the interface facing the internal subnets, which is typically one interface per subnet. Applying it on both interfaces is not required and may lead to misconfiguration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER inCorrect answer▾
Why this is correct
This configuration correctly creates a named extended ACL with two permit statements for HTTP and HTTPS from 192.168.1.0/24, followed by a permit all for 192.168.2.0/24. The ACL is applied inbound on G0/0, which is the interface facing the 192.168.1.0/24 subnet, ensuring traffic from that subnet is filtered as required.
✗ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER outWrong answer — click to see why▾
Why this is wrong here
The ACL is applied in the wrong direction. For traffic originating from 192.168.1.0/24, the ACL must be applied inbound on the interface where that traffic enters the router (G0/0).
Why candidates choose this
Candidates often confuse inbound vs outbound ACL application. They might think 'outbound' filters traffic going out to the internet, but the direction is relative to the interface, not the destination.
✗ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/1 ip access-group FILTER inWrong answer — click to see why▾
Why this is wrong here
The ACL is applied on the wrong interface. The interface facing the restricted subnet (192.168.1.0/24) is G0/0, not G0/1.
Why candidates choose this
Candidates might mistakenly think that because the ACL permits all traffic from 192.168.2.0/24, it should be applied on that interface. However, the ACL must be applied on the interface where the traffic to be filtered enters.
✗ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER in interface g0/1 ip access-group FILTER inWrong answer — click to see why▾
Why this is wrong here
The ACL should only be applied on the interface where the restricted subnet traffic enters (G0/0). Applying it on G0/1 is redundant and could inadvertently filter traffic from 192.168.2.0/24 if the ACL is modified later.
Why candidates choose this
Candidates might think that since the ACL permits traffic from both subnets, it should be applied on both interfaces to be thorough. However, the ACL is designed to restrict traffic from 192.168.1.0/24, so it only needs to be applied where that traffic enters.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
HTTP vs HTTPS
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
Implicit deny
Implicit deny is a security rule that automatically blocks any network traffic that is not explicitly allowed by an access control list or firewall rule.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.