CCNA Network Services and Security Practice Question
Exhibit
ip access-list standard USERS_ONLY permit 192.168.30.0 0.0.0.255 deny any interface g0/1 ip access-group USERS_ONLY out
A named standard ACL is configured to permit only the 192.168.30.0/24 subnet, but users from 192.168.31.0/24 are still passing traffic. What is the most likely reason?
⚠ Common exam trap
Remember that ACLs must be applied in the correct direction to affect traffic flow as intended.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is probably applied in the wrong place or direction for the traffic flow
Standard ACLs filter traffic based solely on the source IP address. If users from 192.168.31.0/24 are still passing traffic despite the ACL permitting only 192.168.30.0/24, the most likely reason is that the ACL is applied in the wrong place or direction. For example, if the ACL is applied inbound on an interface where traffic from 192.168.31.0/24 does not enter, or outbound on an interface where the traffic does not exit, the filter will not affect the intended flow. The implicit deny statement denies all unmatched traffic, so if the ACL were correctly placed, traffic from 192.168.31.0/24 would be denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Standard ACLs cannot match source addresses
Why it's wrong here
This statement is incorrect because standard ACLs are fundamentally defined by their ability to match the source IP address (using a wildcard mask). They do not inspect destination addresses, port numbers, or protocols, but the source field is precisely the one criterion they do evaluate. Thus, an inability to match source addresses would contradict the very nature of a standard ACL.
When this WOULD be correct
A question that asks 'Which type of ACL cannot filter based on destination IP address?' would make this correct, as standard ACLs only match source addresses.
- ✓
The ACL is probably applied in the wrong place or direction for the traffic flow
Why this is correct
Standard ACLs match only the source IP address, so they cannot safely filter based on destination or service. Placement and direction are therefore crucial: if the ACL is applied on the wrong interface or in the wrong inbound/outbound direction, the permit statement will never be evaluated against the traffic it is meant to allow. A common mistake is applying a standard ACL too close to the source, where it may block transit traffic, or on the wrong interface, so the intended packets bypass the filter entirely.
- ✗
Named ACLs ignore wildcard masks
Why it's wrong here
Named standard ACLs use exactly the same matching logic as numbered standard ACLs, including the wildcard mask that accompanies the source address. The wildcard mask determines which bits of the source address are significant, and it is mandatory for specifying a subnet or range. There is no difference in behavior between named and numbered ACLs regarding wildcard masking.
When this WOULD be correct
In a question about IPv6 ACLs, where named ACLs use prefix-length instead of wildcard masks, a candidate might mistakenly think wildcard masks are ignored for IPv4 named ACLs.
- ✗
The deny any line must appear before the permit
Why it's wrong here
This would defeat the purpose of the ACL. Because Cisco routers evaluate ACL entries in top-down order, a single 'deny any' placed before the permit rule would match every packet and drop it, so the subsequent permit statement would never be reached. The correct structure is to list the permit first and rely on the implicit 'deny any' at the end, not to make the deny line explicit before the permit.
When this WOULD be correct
In an extended ACL scenario where you want to explicitly deny all traffic after permitting specific traffic, placing 'deny any' before the permit would be incorrect; but if the question asked about the order of ACEs in a named ACL where the implicit deny is overridden, you might need to add 'deny any' at the end to ensure all other traffic is denied.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The ACL is probably applied in the wrong place or direction for the traffic flowCorrect answer▾
Why this is correct
Standard ACLs match only the source IP address, so they cannot safely filter based on destination or service. Placement and direction are therefore crucial: if the ACL is applied on the wrong interface or in the wrong inbound/outbound direction, the permit statement will never be evaluated against the traffic it is meant to allow. A common mistake is applying a standard ACL too close to the source, where it may block transit traffic, or on the wrong interface, so the intended packets bypass the filter entirely.
✗Standard ACLs cannot match source addressesWrong answer — click to see why▾
Why this is wrong here
Standard ACLs can match source addresses; they just cannot match destination addresses or port numbers. The question states the ACL is configured to permit only 192.168.30.0/24, so it is correctly matching the source.
★ When this WOULD be the correct answer
A question that asks 'Which type of ACL cannot filter based on destination IP address?' would make this correct, as standard ACLs only match source addresses.
Why candidates choose this
Candidates may confuse standard ACLs with extended ACLs, thinking standard ACLs cannot match any IP address, or they may misremember the capabilities of standard ACLs.
✗Named ACLs ignore wildcard masksWrong answer — click to see why▾
Why this is wrong here
Named ACLs do support wildcard masks; the wildcard mask is required when specifying the source network in both standard and extended ACLs.
★ When this WOULD be the correct answer
In a question about IPv6 ACLs, where named ACLs use prefix-length instead of wildcard masks, a candidate might mistakenly think wildcard masks are ignored for IPv4 named ACLs.
Why candidates choose this
Candidates may confuse named ACLs with other features that don't use wildcard masks (e.g., prefix lists) or misunderstand that the 'ip access-list standard' command still requires a wildcard mask.
✗The deny any line must appear before the permitWrong answer — click to see why▾
Why this is wrong here
In a standard ACL, the implicit deny any is already at the end, so adding an explicit 'deny any' before the permit would block all traffic, including the intended subnet. The correct order is permit first, then deny any is unnecessary.
★ When this WOULD be the correct answer
In an extended ACL scenario where you want to explicitly deny all traffic after permitting specific traffic, placing 'deny any' before the permit would be incorrect; but if the question asked about the order of ACEs in a named ACL where the implicit deny is overridden, you might need to add 'deny any' at the end to ensure all other traffic is denied.
Why candidates choose this
Candidates often confuse the implicit deny any rule and think they must explicitly add it, or they misremember ACL processing order, believing that deny statements must come before permit statements.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.