Quick Answer
The answer is to move the standard ACL outbound on the WAN-facing interface closer to the destination. This is correct because a standard ACL filters traffic based solely on the source IP address, so placing it near the source—like inbound on the LAN interface—will inadvertently block that host from reaching all networks, including local ones, rather than just the intended remote destinations. On the CCNA 200-301 v2 exam, this concept tests your understanding of the fundamental ACL placement rule: standard ACLs go near the destination, while extended ACLs go near the source. A common trap is applying a standard ACL inbound on the source router, which causes unintended local blocking, as seen in the exhibit. Remember the memory tip: “Standard stays close to the destination; extended extends toward the source.”
This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: a standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
ACL 15: access-list 15 deny 10.10.10.50 access-list 15 permit any Applied inbound on G0/0, the user LAN interface.
Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?
ACL 15: access-list 15 deny 10.10.10.50 access-list 15 permit any Applied inbound on G0/0, the user LAN interface.
Leave it inbound on the LAN because standard ACLs belong near the source
Why wrong: Distractor.
Move it outbound on the WAN-facing interface closer to the destination
Correct choice.
Convert it to a VTY access-class
Why wrong: Distractor.
Apply it inbound on all switch access ports
Why wrong: Distractor.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Move it outbound on the WAN-facing interface closer to the destination
A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.
Key principle: A standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Leave it inbound on the LAN because standard ACLs belong near the source
Why it's wrong here
Distractor.
When this WOULD be correct
In a different scenario where the question asks about the best practice for applying standard ACLs to control traffic from multiple hosts on a LAN, stating that standard ACLs belong near the source could be correct if the goal is to restrict access to a specific resource without affecting local traffic flow.
Move it outbound on the WAN-facing interface closer to the destination
Why this is correct
Correct choice.
Related concept
A standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria.
Convert it to a VTY access-class
Why it's wrong here
Distractor.
When this WOULD be correct
In a scenario where the question asks how to restrict remote access to a router's management interface (VTY) from a specific IP address, converting an ACL to a VTY access-class would be the correct approach. This would effectively block that host from accessing the router's management functions while allowing other traffic.
Apply it inbound on all switch access ports
Why it's wrong here
Distractor.
When this WOULD be correct
In a scenario where the question specifies that all devices connected to the switch ports should be restricted from accessing a specific remote network, applying the ACL inbound on all switch access ports would be the correct approach to enforce that restriction.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Correct choice.
Why this is wrong here
This option is incorrect because applying the ACL inbound on the LAN interface blocks all local traffic from the specified host, which is not the intended outcome. Standard ACLs should be placed where they can effectively filter traffic without disrupting local communications.
★ When this WOULD be the correct answer
In a different scenario where the question asks about the best practice for applying standard ACLs to control traffic from multiple hosts on a LAN, stating that standard ACLs belong near the source could be correct if the goal is to restrict access to a specific resource without affecting local traffic flow.
Why candidates choose this
Candidates may find this option appealing because it aligns with the general principle that ACLs should be placed close to the source of traffic to minimize unnecessary processing, leading to a misconception about their placement in this specific context.
Why this is wrong here
This option is incorrect because converting the ACL to a VTY access-class does not address the requirement to block traffic from a specific host on the LAN interface. VTY access-classes are used for controlling access to device management interfaces, not for filtering traffic on data interfaces.
★ When this WOULD be the correct answer
In a scenario where the question asks how to restrict remote access to a router's management interface (VTY) from a specific IP address, converting an ACL to a VTY access-class would be the correct approach. This would effectively block that host from accessing the router's management functions while allowing other traffic.
Why candidates choose this
Candidates may find this option tempting because they might confuse the purpose of VTY access-classes with the need to control access to network resources, leading them to think it could solve the problem of blocking a specific host.
Why this is wrong here
Applying the ACL inbound on all switch access ports would block traffic for all devices connected to those ports, not just the specific host 10.10.10.50. This is not the intended behavior for blocking a single host's access to remote networks.
★ When this WOULD be the correct answer
In a scenario where the question specifies that all devices connected to the switch ports should be restricted from accessing a specific remote network, applying the ACL inbound on all switch access ports would be the correct approach to enforce that restriction.
Why candidates choose this
Candidates may choose this option because they might confuse the need for access control on switch ports with the requirement to block a specific host's access, leading them to think that applying the ACL broadly would achieve the desired outcome.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
A frequent exam trap is believing that standard ACLs should always be applied inbound near the source to block unwanted traffic early. Since standard ACLs filter only by source IP, placing them inbound on a LAN interface can block all traffic from that host, including local communications within the LAN. This leads to unintended network outages and user complaints. The trap is confusing the ACL placement rule for extended ACLs, which are placed near the source, with the rule for standard ACLs, which should be placed near the destination to avoid over-blocking.
Detailed technical explanation
Access Control Lists (ACLs) are fundamental tools in Cisco networking used to filter traffic based on defined criteria. Standard ACLs specifically filter traffic by matching only the source IP address, without regard to the destination or protocol. This simplicity means that any packet originating from a matched source IP will be filtered regardless of its intended destination. Because of this, standard ACLs are limited in granularity but are efficient for simple source-based filtering tasks. The placement of a standard ACL is crucial to its effectiveness and to avoid unintended network disruptions. The general rule for standard ACLs is to place them as close to the destination as possible. This ensures that only traffic destined for the remote network is filtered, while local traffic from the same source IP is allowed to pass freely. Placing a standard ACL near the source interface, such as inbound on a LAN interface, can block all traffic from that source IP, including local LAN traffic, which is often undesirable. A common exam trap is to assume that standard ACLs should always be placed near the source to block unwanted traffic early. However, because standard ACLs filter only by source IP, placing them near the source can inadvertently block legitimate local traffic. In practical Cisco network deployments, moving the standard ACL outbound on the WAN-facing interface aligns with best practices by filtering traffic as it leaves toward remote destinations, preserving local connectivity and minimizing unintended disruptions.
Key takeaway
A standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Review a standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — A standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria..
The correct answer is: Move it outbound on the WAN-facing interface closer to the destination — A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.
Review a standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria., then practise related 200-301 questions on the same topic to reinforce the concept.
A standard ACL filters traffic based solely on the source IP address and does not consider destination IP addresses in its matching criteria.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.