This 200-301 practice question tests your understanding of network services and security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: an extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Requirement: Allow 10.1.10.0/24 to reach 198.51.100.20 on TCP ports 80 and 443 only. Block all other traffic from 10.1.10.0/24.
An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?
Requirement: Allow 10.1.10.0/24 to reach 198.51.100.20 on TCP ports 80 and 443 only. Block all other traffic from 10.1.10.0/24.
Named standard ACL
Why wrong: Distractor.
Extended ACL
Correct choice.
Prefix list
Why wrong: Distractor.
MAC access-list
Why wrong: Distractor.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Extended ACL
A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.
Key principle: An extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Named standard ACL
Why it's wrong here
Distractor.
When this WOULD be correct
In a different scenario where the requirement is to permit all traffic from a specific source IP address to any destination without specifying protocols or ports, a named standard ACL would be appropriate. For example, if the question asked to allow all traffic from 10.1.10.0/24 to any destination, a named standard ACL would suffice.
Extended ACL
Why this is correct
Correct choice.
Related concept
An extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control.
Prefix list
Why it's wrong here
Distractor.
When this WOULD be correct
If the exam question asked about filtering routes for a specific subnet to control which networks can be advertised or learned, a prefix list would be the correct answer. For example, a question might ask how to allow only certain subnets to be advertised to a routing protocol.
MAC access-list
Why it's wrong here
Distractor.
When this WOULD be correct
If the question were to ask about filtering traffic based on MAC addresses within a local network segment, such as allowing specific devices to communicate while blocking others, then a MAC access-list would be the correct choice.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Correct choice.
Why this is wrong here
A named standard ACL cannot filter traffic based on IP protocols or specific ports, which is necessary for allowing HTTP and HTTPS traffic. This option is incorrect because it does not meet the requirement of permitting specific services to a destination IP.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to permit all traffic from a specific source IP address to any destination without specifying protocols or ports, a named standard ACL would be appropriate. For example, if the question asked to allow all traffic from 10.1.10.0/24 to any destination, a named standard ACL would suffice.
Why candidates choose this
Candidates may choose this option due to familiarity with standard ACLs and their use in controlling traffic based on source IP addresses, leading them to overlook the need for protocol and port specificity in this case.
Why this is wrong here
A prefix list is used for filtering routes based on IP prefixes and is not applicable for controlling traffic based on protocols or ports, which is required in this scenario for allowing HTTP and HTTPS traffic.
★ When this WOULD be the correct answer
If the exam question asked about filtering routes for a specific subnet to control which networks can be advertised or learned, a prefix list would be the correct answer. For example, a question might ask how to allow only certain subnets to be advertised to a routing protocol.
Why candidates choose this
Candidates may confuse prefix lists with access control lists due to their similar purpose in network management, leading them to mistakenly believe that prefix lists can also handle traffic filtering based on protocols and ports.
Why this is wrong here
A MAC access-list is used to filter traffic based on MAC addresses at Layer 2 of the OSI model, which is not applicable for controlling HTTP and HTTPS traffic that operates at Layer 7. The question specifies IP addresses and protocols, making MAC access-lists irrelevant.
★ When this WOULD be the correct answer
If the question were to ask about filtering traffic based on MAC addresses within a local network segment, such as allowing specific devices to communicate while blocking others, then a MAC access-list would be the correct choice.
Why candidates choose this
Candidates may confuse MAC access-lists with other types of access control lists due to their general understanding of network security, leading them to incorrectly assume that MAC filtering could apply to IP-based protocols like HTTP and HTTPS.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
A frequent exam trap is selecting a standard ACL when the question requires filtering by both source and destination IP addresses plus specific protocols or ports. Standard ACLs only filter by source IP, so they cannot distinguish HTTP or HTTPS traffic to a particular destination. Another trap is confusing prefix lists or MAC access-lists as suitable options; prefix lists filter routes, not traffic by port, and MAC access-lists filter Layer 2 addresses, not Layer 3 or 4 information. Misunderstanding these differences leads to incorrect ACL type selection and exam failure.
Detailed technical explanation
Access Control Lists (ACLs) are fundamental tools in Cisco networking used to filter traffic based on defined criteria. Standard ACLs filter traffic solely by the source IP address, making them suitable for broad filtering but insufficient for granular control. Extended ACLs, however, allow filtering by source and destination IP addresses, protocol types (such as TCP or UDP), and specific port numbers, enabling precise control over which traffic is permitted or denied. In this scenario, the administrator needs to permit HTTP (TCP port 80) and HTTPS (TCP port 443) traffic from the subnet 10.1.10.0/24 to a specific web server at 198.51.100.20, while denying all other traffic from that subnet. This requirement demands filtering based on both source and destination IP addresses and specific TCP ports, which only an extended ACL can provide. The ACL must explicitly permit TCP traffic to ports 80 and 443 on the destination IP and then deny all other traffic from the source subnet. A common exam trap is confusing standard ACLs with extended ACLs, assuming standard ACLs can filter by destination or port. Additionally, prefix lists and MAC access-lists serve different purposes and cannot filter by TCP ports or specific IP destinations. Practically, applying an extended ACL closest to the traffic source optimizes network security and performance by blocking unwanted traffic early. Understanding these distinctions is critical for correct ACL implementation and passing the CCNA exam.
Key takeaway
An extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Review an extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — An extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control..
The correct answer is: Extended ACL — A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.
Review an extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control., then practise related 200-301 questions on the same topic to reinforce the concept.
An extended ACL permits filtering based on source and destination IP addresses, as well as protocol types and port numbers, enabling precise traffic control.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.