Question 1mediummultiple choice
Full question →mediummultiple choiceObjective-mapped
Exhibit
Source subnet: 10.20.30.0/24 Requirement: block Telnet, allow HTTP and HTTPS
Exhibit: Users in 10.20.30.0/24 should be allowed to browse the web but should not be able to open Telnet sessions to any remote device. Which access list entry best meets the requirement?
Answer choices
Why each option matters
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A
Best answer
deny tcp 10.20.30.0 0.0.0.255 any eq 23
This blocks Telnet from that subnet to any destination.
B
Distractor review
deny udp 10.20.30.0 0.0.0.255 any eq 23
Telnet uses TCP, not UDP.
C
Distractor review
deny tcp any 10.20.30.0 0.0.0.255 eq 23
That blocks inbound Telnet to the subnet, not outbound sessions from the users.
D
Distractor review
permit tcp 10.20.30.0 0.0.0.255 any eq 80
That allows HTTP but does not block Telnet.
Common exam trap
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is selecting an ACL entry that denies UDP traffic on port 23 or denies traffic with the source port set to 23. Telnet exclusively uses TCP as its transport protocol and communicates over destination port 23, so denying UDP or source port 23 traffic will not block Telnet sessions. Another common mistake is denying inbound Telnet traffic to the subnet rather than outbound traffic from the subnet, which does not prevent users inside the subnet from initiating Telnet connections. Misunderstanding these protocol and port details leads to ineffective ACLs that fail to meet the requirement.
Technical deep dive
How to think about this question
Access control lists (ACLs) are fundamental security tools in Cisco networking that control traffic flow by filtering packets based on criteria such as source and destination IP addresses, protocols, and port numbers. In the context of the CCNA exam, understanding how to write ACL entries to permit or deny specific traffic types is essential. Telnet, a legacy remote access protocol, uses TCP as its transport layer protocol and communicates over destination port 23. Therefore, to block Telnet sessions from a specific subnet, an ACL must deny TCP traffic destined for port 23 originating from that subnet. The correct ACL entry in this scenario is "deny tcp 10.20.30.0 0.0.0.255 any eq 23". This statement blocks any TCP traffic from the 10.20.30.0/24 subnet to any destination where the destination port equals 23, effectively preventing outbound Telnet sessions. The wildcard mask 0.0.0.255 matches all hosts in the subnet. It is important to place this deny statement before any permit statements to ensure Telnet traffic is blocked before other traffic is allowed. For example, permitting TCP traffic to port 80 (HTTP) allows web browsing while still blocking Telnet. A common exam trap is confusing the protocol or port number used by Telnet. Telnet uses TCP, not UDP, and specifically port 23 as the destination port, not the source port. Another trap is misunderstanding the direction of traffic filtering; denying inbound Telnet to the subnet does not stop users inside the subnet from initiating outbound Telnet sessions. Practically, ACLs must be carefully ordered and correctly specified to enforce security policies effectively, ensuring unwanted protocols like Telnet are blocked without disrupting legitimate traffic such as HTTP web browsing.
KKey Concepts to Remember
- An access control list (ACL) filters traffic based on specified criteria such as source IP, destination IP, protocol, and port numbers to control network access.
- Telnet uses TCP as its transport protocol and specifically communicates over destination port 23, which ACLs can target to block Telnet sessions.
- Denying TCP traffic from a source subnet to any destination on port 23 effectively blocks outbound Telnet sessions from that subnet.
- Permitting HTTP traffic typically involves allowing TCP traffic to destination port 80, which is distinct from Telnet’s port 23.
- ACLs process entries in sequential order, so placing a deny statement for Telnet before permit statements ensures Telnet traffic is blocked first.
- Using incorrect protocols or ports in ACL entries, such as denying UDP port 23, will fail to block Telnet because Telnet uses TCP port 23.
- Inbound and outbound ACLs differ; blocking inbound Telnet to a subnet does not prevent users in that subnet from initiating outbound Telnet sessions.
- Cisco IOS ACLs use wildcard masks to specify IP ranges, where 0.0.0.255 matches all hosts in a /24 subnet like 10.20.30.0/24.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Related practice questions
Related 200-301 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
CCNA subnetting practice questions
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
CCNA OSPF practice questions
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
CCNA VLAN practice questions
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
CCNA STP practice questions
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
CCNA EtherChannel practice questions
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
CCNA ACL practice questions
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
CCNA NAT practice questions
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
CCNA DHCP practice questions
Practise DHCP scopes, relay, leases and troubleshooting.
CCNA show ip route practice questions
Practise routing-table output, longest-prefix match, AD and route selection.
CCNA show interfaces trunk practice questions
Practise trunk verification and VLAN forwarding across switches.
CCNA wireless security practice questions
Practise WLAN security, authentication and wireless architecture concepts.
CCNA IPv6 practice questions
Practise IPv6 addressing, routes, neighbour discovery and common IPv6 exam traps.
More questions from this exam
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
A router learns the same prefix from both OSPF and EIGRP. Which route is installed by default?
Question 2
A router shows this output: R1#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:34 192.168.12.2 GigabitEthernet0/0 10.1.1.3 1 2WAY/DROTHER 00:00:39 192.168.12.3 GigabitEthernet0/0 Which statement is correct?
Question 3
What is the OSPF metric called?
Question 4
A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?
Question 5
A router interface applies this ACL inbound: 10 deny tcp any any eq 80 20 permit ip any any A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?
Question 6
A router learns route 198.51.100.0/24 from OSPF with AD 110 and also has a static route to the same prefix configured with AD 150. Which route is installed?
FAQ
Questions learners often ask
What does this 200-301 question test?
An access control list (ACL) filters traffic based on specified criteria such as source IP, destination IP, protocol, and port numbers to control network access.
What is the correct answer to this question?
The correct answer is: deny tcp 10.20.30.0 0.0.0.255 any eq 23 — To block Telnet while still allowing web traffic, the ACL should deny TCP destination port 23 from that source subnet and then permit the rest of the needed traffic. Telnet uses TCP port 23, not UDP and not source port 23.
What should I do if I get this 200-301 question wrong?
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Discussion
Loading comments…
Sign in to join the discussion.