CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1, a branch router. Configure an extended ACL named BRANCH_IN that permits only HTTP (TCP port 80) traffic from the internal network 192.168.1.0/24 to the web server at 203.0.113.10, and permits ICMP echo-reply from any source to any destination. Apply the ACL inbound on the interface facing the internal network. Then verify that only the specified traffic is allowed.
⚠ Common exam trap
Pay close attention to the direction of traffic flow. The ACL must be applied inbound on the interface that receives traffic from the internal network. Also, be precise with ICMP types: 'echo-reply' is the response to a ping, not the initial echo request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in
It creates an extended ACL that permits TCP port 80 from the internal 192.168.1.0/24 to the web server 203.0.113.10 and permits only ICMP echo-reply, then applies it inbound on the internal interface G0/0, matching the requirement. Option B is wrong because the ACL is applied outbound on G0/0, but traffic from internal hosts to the web server exits via the WAN interface (G0/1), not G0/0. Option C is wrong because it permits all ICMP (any any) instead of only echo-reply, allowing unnecessary ICMP traffic. Option D is wrong because it applies the ACL inbound on both G0/0 and G0/1; applying it on G0/1 would incorrectly filter inbound traffic from the ISP, potentially blocking the web server's responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in
Why this is correct
This configuration correctly defines the extended ACL with the required permit statements and applies it inbound on the internal-facing interface. The first permit allows HTTP from the internal subnet to the web server, and the second permit allows ICMP echo-reply from any source. The implicit deny at the end blocks all other traffic.
- ✗
ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN out
Why it's wrong here
Applying the ACL outbound on GigabitEthernet0/0 is directionally incorrect: inbound evaluates packets arriving from the 192.168.1.0/24 LAN before routing, whereas outbound evaluates packets leaving that interface toward the LAN, which would not inspect the HTTP requests going toward 203.0.113.10. The ACL is therefore useless for the stated purpose, and the implicit deny would still block the permitted traffic. The task specifically requires inbound application on the internal-facing interface.
- ✗
ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in
Why it's wrong here
The ICMP statement `permit icmp any any` is overly broad because it matches every ICMP message type, including echo requests, destination unreachable, and parameter problem. The requirement is to allow only ICMP echo-reply (type 0) so that return pings from the server are accepted; any other ICMP type should fall through to the implicit deny. Without the `echo-reply` keyword, the ACL permits far more control traffic than intended.
- ✗
ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in ! interface GigabitEthernet0/1 ip access-group BRANCH_IN in
Why it's wrong here
Binding the same ACL to both GigabitEthernet0/0 and GigabitEthernet0/1 inbound creates an asymmetric filter: on G0/1 it inspects packets entering from the external network, and because the only TCP permit is sourced from 192.168.1.0/24, legitimate return traffic from the web server (source 203.0.113.10) would be denied by the implicit deny. Applying an ACL on the external-facing interface also violates the explicit instruction to apply it only on the internal-facing interface, and it disrupts inbound connectivity that the requirements never intended to restrict.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN inCorrect answer▾
Why this is correct
This configuration correctly defines the extended ACL with the required permit statements and applies it inbound on the internal-facing interface. The first permit allows HTTP from the internal subnet to the web server, and the second permit allows ICMP echo-reply from any source. The implicit deny at the end blocks all other traffic.
✗ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN outWrong answer — click to see why▾
Why this is wrong here
The ACL is applied in the wrong direction. Applying it outbound would filter traffic leaving the interface, not entering it.
Why candidates choose this
Candidates might confuse the direction of traffic flow and think that outbound on the internal interface is correct because traffic from internal users goes out.
✗ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any ! interface GigabitEthernet0/0 ip access-group BRANCH_IN inWrong answer — click to see why▾
Why this is wrong here
The ACL permits all ICMP traffic instead of only echo-reply. This violates the requirement to permit only ICMP echo-reply.
Why candidates choose this
Candidates may think that permitting all ICMP is acceptable or may forget to specify the echo-reply type, especially if they are used to allowing ping in both directions.
✗ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in ! interface GigabitEthernet0/1 ip access-group BRANCH_IN inWrong answer — click to see why▾
Why this is wrong here
Applying the ACL to an additional interface (G0/1) is unnecessary and may cause unintended filtering. The requirement specifies only one interface.
Why candidates choose this
Candidates might think that applying the ACL to both interfaces provides better security, or they may misidentify which interface is internal.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
HTTP
HTTP stands for Hypertext Transfer Protocol, the set of rules web browsers and servers use to communicate and transfer web pages over the internet.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.