CCNA Network Services and Security Practice Question
Exhibit
ACL 15: access-list 15 deny 10.10.10.50 access-list 15 permit any Applied inbound on G0/0, the user LAN interface.
Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?
⚠ Common exam trap
A frequent exam trap is believing that standard ACLs should always be applied inbound near the source to block unwanted traffic early. Since standard ACLs filter only by source IP, placing them inbound on a LAN interface can block all traffic from that host, including local communications within the LAN. This leads to unintended network outages and user complaints. The trap is confusing the ACL placement rule for extended ACLs, which are placed near the source, with the rule for standard ACLs, which should be placed near the destination to avoid over-blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move it outbound on the WAN-facing interface closer to the destination
A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Leave it inbound on the LAN because standard ACLs belong near the source
Why it's wrong here
The rule that standard ACLs belong near the source is incorrect; extended ACLs are placed closest to the source so they can filter on both source and destination early. Standard ACLs, which match only the source IP, should instead be applied outbound near the destination to avoid wasting internal bandwidth and to filter all routes to that destination in one shot. Leaving it inbound on the LAN forces evaluation of all internal traffic from that host and does not reliably block it from reaching the WAN if multiple paths exist.
When this WOULD be correct
In a different scenario where the question asks about the best practice for applying standard ACLs to control traffic from multiple hosts on a LAN, stating that standard ACLs belong near the source could be correct if the goal is to restrict access to a specific resource without affecting local traffic flow.
- ✓
Move it outbound on the WAN-facing interface closer to the destination
Why this is correct
A standard ACL filters only on source IP address, so it should be applied outbound on the WAN-facing interface, as far from the source as the destination path allows. This placement blocks host 10.10.10.50 from reaching the WAN/remote side with a single rule, avoiding unnecessary processing on internal LAN interfaces. It is the recommended best practice for standard ACLs.
- ✗
Convert it to a VTY access-class
Why it's wrong here
A VTY access-class limits which source addresses can initiate Telnet or SSH sessions to the router's virtual terminal lines; it does not inspect or filter forwarded data traffic. Configuring the ACL as an access-class on VTY lines would only affect management access from host 10.10.10.50, not its ability to communicate through the router, so it would fail to achieve the ACL's intended purpose.
When this WOULD be correct
In a scenario where the question asks how to restrict remote access to a router's management interface (VTY) from a specific IP address, converting an ACL to a VTY access-class would be the correct approach. This would effectively block that host from accessing the router's management functions while allowing other traffic.
- ✗
Apply it inbound on all switch access ports
Why it's wrong here
Applying the standard ACL inbound on every switch access port would replicate the filter at the access layer, causing administrative overhead and potentially inconsistent enforcement. It would also block the host's traffic to any destination immediately at the switch, which may be overly broad if the ACL is intended only to prevent it from exiting the WAN, and it violates the principle of placing standard ACLs closest to the destination.
When this WOULD be correct
In a scenario where the question specifies that all devices connected to the switch ports should be restricted from accessing a specific remote network, applying the ACL inbound on all switch access ports would be the correct approach to enforce that restriction.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Move it outbound on the WAN-facing interface closer to the destinationCorrect answer▾
Why this is correct
A standard ACL filters only on source IP address, so it should be applied outbound on the WAN-facing interface, as far from the source as the destination path allows. This placement blocks host 10.10.10.50 from reaching the WAN/remote side with a single rule, avoiding unnecessary processing on internal LAN interfaces. It is the recommended best practice for standard ACLs.
✗Leave it inbound on the LAN because standard ACLs belong near the sourceWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because applying the ACL inbound on the LAN interface blocks all local traffic from the specified host, which is not the intended outcome. Standard ACLs should be placed where they can effectively filter traffic without disrupting local communications.
★ When this WOULD be the correct answer
In a different scenario where the question asks about the best practice for applying standard ACLs to control traffic from multiple hosts on a LAN, stating that standard ACLs belong near the source could be correct if the goal is to restrict access to a specific resource without affecting local traffic flow.
Why candidates choose this
Candidates may find this option appealing because it aligns with the general principle that ACLs should be placed close to the source of traffic to minimize unnecessary processing, leading to a misconception about their placement in this specific context.
✗Convert it to a VTY access-classWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because converting the ACL to a VTY access-class does not address the requirement to block traffic from a specific host on the LAN interface. VTY access-classes are used for controlling access to device management interfaces, not for filtering traffic on data interfaces.
★ When this WOULD be the correct answer
In a scenario where the question asks how to restrict remote access to a router's management interface (VTY) from a specific IP address, converting an ACL to a VTY access-class would be the correct approach. This would effectively block that host from accessing the router's management functions while allowing other traffic.
Why candidates choose this
Candidates may find this option tempting because they might confuse the purpose of VTY access-classes with the need to control access to network resources, leading them to think it could solve the problem of blocking a specific host.
✗Apply it inbound on all switch access portsWrong answer — click to see why▾
Why this is wrong here
Applying the ACL inbound on all switch access ports would block traffic for all devices connected to those ports, not just the specific host 10.10.10.50. This is not the intended behavior for blocking a single host's access to remote networks.
★ When this WOULD be the correct answer
In a scenario where the question specifies that all devices connected to the switch ports should be restricted from accessing a specific remote network, applying the ACL inbound on all switch access ports would be the correct approach to enforce that restriction.
Why candidates choose this
Candidates may choose this option because they might confuse the need for access control on switch ports with the requirement to block a specific host's access, leading them to think that applying the ACL broadly would achieve the desired outcome.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.