Question 1,461 of 1,389
CCNA Network Services and Security Practice Question
Exhibit
Requirement: Allow 10.1.10.0/24 to reach 198.51.100.20 on TCP ports 80 and 443 only. Block all other traffic from 10.1.10.0/24.
An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?
⚠ Common exam trap
A frequent exam trap is selecting a standard ACL when the question requires filtering by both source and destination IP addresses plus specific protocols or ports. Standard ACLs only filter by source IP, so they cannot distinguish HTTP or HTTPS traffic to a particular destination. Another trap is confusing prefix lists or MAC access-lists as suitable options; prefix lists filter routes, not traffic by port, and MAC access-lists filter Layer 2 addresses, not Layer 3 or 4 information. Misunderstanding these differences leads to incorrect ACL type selection and exam failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Extended ACL
A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Named standard ACL
Why it's wrong here
A named standard ACL offers identification by name but still functions as a standard ACL, which can only filter based on source IP address. Standard ACLs lack the ability to inspect the protocol field or destination port numbers, so they cannot differentiate HTTP/HTTPS from other TCP services or from non-HTTP traffic. Since the administrator must permit only HTTP and HTTPS from the specified source, a standard ACL would either permit all TCP traffic from that source or none, making it insufficient. Thus, it is a distractor.
When this WOULD be correct
In a different scenario where the requirement is to permit all traffic from a specific source IP address to any destination without specifying protocols or ports, a named standard ACL would be appropriate. For example, if the question asked to allow all traffic from 10.1.10.0/24 to any destination, a named standard ACL would suffice.
- ✓
Extended ACL
Why this is correct
An extended ACL is required because the administrator needs to match both HTTP (TCP/80) and HTTPS (TCP/443) from a specific source address. Extended ACLs evaluate source and destination IP, protocol (TCP), and destination port numbers, enabling precise filtering of application-layer traffic. The syntax, such as permit tcp host 10.0.0.1 any eq 80 and eq 443, supports matching these services. This granularity is exactly what the scenario demands, making it the correct choice.
- ✗
Prefix list
Why it's wrong here
A prefix list is used in routing protocols like BGP, OSPF, and EIGRP to filter route advertisements based on network prefixes and prefix lengths. It cannot inspect IP protocol headers or TCP/UDP port numbers, so it has no mechanism to distinguish HTTP or HTTPS traffic from other TCP traffic. Prefix lists operate at Layer 3 route advertisement level, not on the data plane for packets traversing the router. Therefore, it cannot fulfill the requirement to permit specific application traffic.
When this WOULD be correct
If the exam question asked about filtering routes for a specific subnet to control which networks can be advertised or learned, a prefix list would be the correct answer. For example, a question might ask how to allow only certain subnets to be advertised to a routing protocol.
- ✗
MAC access-list
Why it's wrong here
A MAC access-list operates at Layer 2, filtering frames based on source and destination MAC addresses, Ethernet type, or VLAN, but it cannot interpret IP addresses or TCP/UDP port numbers. HTTP and HTTPS are Layer 4 protocols, and the filtering decision requires Layer 3 (IP) and Layer 4 (port) information, which a MAC ACL never sees. Additionally, MAC ACLs are typically applied on switch ports for security features like port security, not on routers for IP service filtering. Hence, it is completely unsuitable for this Layer 3/4 filtering requirement.
When this WOULD be correct
If the question were to ask about filtering traffic based on MAC addresses within a local network segment, such as allowing specific devices to communicate while blocking others, then a MAC access-list would be the correct choice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Extended ACLCorrect answer▾
Why this is correct
An extended ACL is required because the administrator needs to match both HTTP (TCP/80) and HTTPS (TCP/443) from a specific source address. Extended ACLs evaluate source and destination IP, protocol (TCP), and destination port numbers, enabling precise filtering of application-layer traffic. The syntax, such as permit tcp host 10.0.0.1 any eq 80 and eq 443, supports matching these services. This granularity is exactly what the scenario demands, making it the correct choice.
✗Named standard ACLWrong answer — click to see why▾
Why this is wrong here
A named standard ACL cannot filter traffic based on IP protocols or specific ports, which is necessary for allowing HTTP and HTTPS traffic. This option is incorrect because it does not meet the requirement of permitting specific services to a destination IP.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to permit all traffic from a specific source IP address to any destination without specifying protocols or ports, a named standard ACL would be appropriate. For example, if the question asked to allow all traffic from 10.1.10.0/24 to any destination, a named standard ACL would suffice.
Why candidates choose this
Candidates may choose this option due to familiarity with standard ACLs and their use in controlling traffic based on source IP addresses, leading them to overlook the need for protocol and port specificity in this case.
✗Prefix listWrong answer — click to see why▾
Why this is wrong here
A prefix list is used for filtering routes based on IP prefixes and is not applicable for controlling traffic based on protocols or ports, which is required in this scenario for allowing HTTP and HTTPS traffic.
★ When this WOULD be the correct answer
If the exam question asked about filtering routes for a specific subnet to control which networks can be advertised or learned, a prefix list would be the correct answer. For example, a question might ask how to allow only certain subnets to be advertised to a routing protocol.
Why candidates choose this
Candidates may confuse prefix lists with access control lists due to their similar purpose in network management, leading them to mistakenly believe that prefix lists can also handle traffic filtering based on protocols and ports.
✗MAC access-listWrong answer — click to see why▾
Why this is wrong here
A MAC access-list is used to filter traffic based on MAC addresses at Layer 2 of the OSI model, which is not applicable for controlling HTTP and HTTPS traffic that operates at Layer 7. The question specifies IP addresses and protocols, making MAC access-lists irrelevant.
★ When this WOULD be the correct answer
If the question were to ask about filtering traffic based on MAC addresses within a local network segment, such as allowing specific devices to communicate while blocking others, then a MAC access-list would be the correct choice.
Why candidates choose this
Candidates may confuse MAC access-lists with other types of access control lists due to their general understanding of network security, leading them to incorrectly assume that MAC filtering could apply to IP-based protocols like HTTP and HTTPS.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.