CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1. The network administrator wants to permit only HTTPS traffic (TCP port 443) from the 192.0.2.0/24 network to the 203.0.113.0/24 network, while denying all other IP traffic. Currently, an ACL applied inbound on G0/1 is blocking all traffic, including HTTPS. Identify the issue and correct the ACL configuration so that only HTTPS traffic is permitted.
⚠ Common exam trap
The exam trap is that candidates may think adding a permit statement before the deny will work, but if they add a new entry without specifying a sequence number, it is inserted after the existing deny ip any any, so the deny remains first and blocks all traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.
The ACL BLOCK_IN currently has a single deny ip any any entry, which blocks all traffic inbound on G0/1. The correct solution is to first remove the existing ACL, then create a new extended ACL that permits TCP 443 from source network 192.0.2.0/24 to destination network 203.0.113.0/24, and apply it inbound on G0/1. The implicit deny at the end of the ACL will then block all other traffic, achieving the desired policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.
Why this is correct
This is correct because it removes the overly restrictive deny ip any any entry and replaces it with a permit statement that matches only HTTPS traffic from the specified source to destination. The implicit deny at the end of the ACL then blocks all other traffic, achieving the desired policy.
- ✗
Add a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443 before the existing deny ip any any entry in the ACL.
Why it's wrong here
This is incorrect because the existing ACL is a standard ACL, which can only match source IPv4 addresses. The proposed permit statement includes a protocol, a destination network, and port number 443, which are extended ACL match criteria and cannot be added to a standard numbered or named ACL. Even with sequence-number editing, a standard ACL will not accept or evaluate an entry with tcp and eq 443. Therefore, the only way to implement the required filtering is to remove the existing ACL and create a new extended ACL that supports those match parameters.
- ✗
Remove the existing ACL and create a standard ACL with permit 192.0.2.0 0.0.0.255, then apply it inbound on G0/1.
Why it's wrong here
This is incorrect because standard ACLs can only match source IP addresses, not destination IP addresses or port numbers. They cannot filter based on TCP port 443, so they would permit all traffic from the source network, not just HTTPS.
- ✗
Remove the existing ACL and create an extended ACL with a permit statement for tcp any any eq 443, then apply it inbound on G0/1.
Why it's wrong here
This is incorrect because using `tcp any any eq 443` has no source or destination restrictions; it permits HTTPS traffic from any source host to any destination address. The requirement specifically limits traffic to source 192.0.2.0/24 and destination 203.0.113.0/24, and the implicit deny at the end of the ACL cannot compensate for an over-permissive permit rule. Without the destination network constraint, the ACL allows users from outside the specified source network to reach any HTTPS server, violating the security policy. The correct ACL must specify both the exact source wildcard mask and the exact destination wildcard mask in the permit statement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.Correct answer▾
Why this is correct
This is correct because it removes the overly restrictive deny ip any any entry and replaces it with a permit statement that matches only HTTPS traffic from the specified source to destination. The implicit deny at the end of the ACL then blocks all other traffic, achieving the desired policy.
✗Add a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443 before the existing deny ip any any entry in the ACL.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the order of entries matters; a deny any any at the end would block all traffic, but here it is placed before the permit, so the deny is evaluated first.
Why candidates choose this
Candidates might think that adding a permit statement before the deny will override it, but they overlook that the deny ip any any matches all traffic and will be hit first if placed before the permit.
✗Remove the existing ACL and create a standard ACL with permit 192.0.2.0 0.0.0.255, then apply it inbound on G0/1.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that standard ACLs lack the capability to filter by protocol or port; extended ACLs are required for such granularity.
Why candidates choose this
Candidates might confuse standard and extended ACL capabilities, thinking a standard ACL can filter by port if applied correctly.
✗Remove the existing ACL and create an extended ACL with a permit statement for tcp any any eq 443, then apply it inbound on G0/1.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the permit statement uses 'any' for source and destination, making it too permissive and not matching the specified networks.
Why candidates choose this
Candidates might focus only on the port number and forget to specify the source and destination networks, leading to an overly broad permit.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP that encrypts data between a web browser and a web server using SSL/TLS protocols.
Key term
Implicit deny
Implicit deny is a security rule that automatically blocks any network traffic that is not explicitly allowed by an access control list or firewall rule.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.