The answer is that the ACL should match the source port 80 on returning traffic, not the destination port 80. This is because an ACL applied inbound on the outside interface evaluates packets as they enter the router from the DMZ or external network. When the web server sends return traffic back to an inside client, the source port is 80 (the web server’s service port), but the destination port is a high ephemeral port assigned by the client’s operating system. If the ACL only permits inbound traffic with a destination port of 80, it will drop these returning packets, causing the ACL blocking return traffic issue. On the CCNA 200-301 v2 exam, this tests your understanding of stateful traffic flow versus stateless ACL evaluation, a common trap where students mistakenly think return traffic mirrors the original request’s destination port. A useful memory tip: “Return traffic flips the ports—source becomes the server’s service, destination becomes the client’s ephemeral.”
CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: an Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
access-list 101 permit tcp any any eq 80
interface g0/1
ip access-group 101 in
DMZ web server: 172.16.100.10
Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL should match the source port 80 on returning traffic, not the destination port 80
An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.
Key principle: An Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The ACL should match the source port 80 on returning traffic, not the destination port 80
Why this is correct
Return packets from the server use source port 80 and a random high destination port on the client.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
An Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers.
✗
HTTP traffic can never be filtered with a standard ACL
Why it's wrong here
It is true that TCP ports need an extended ACL, but that is not the precise return-traffic explanation here.
When this WOULD be correct
In a different scenario, if the question stated that only standard ACLs were being used and asked whether HTTP traffic could be filtered at all, option B would be correct, as standard ACLs cannot filter based on Layer 4 information like port numbers.
✗
The ACL must be applied outbound on the inside interface only
Why it's wrong here
ACL placement can vary; the key problem is the match logic.
When this WOULD be correct
In a different scenario where the question specifies that the ACL is only intended to restrict outbound traffic from the inside network to the DMZ, then stating that it must be applied outbound on the inside interface could be correct, as it would imply that return traffic is not a concern.
In a different question setup where the focus is on NAT configurations, if a question states that NAT is configured to allow all traffic and asks about the interaction with ACLs, option D could be correct. For example, if the question specifies that NAT is designed to handle all return traffic without restrictions, then this statement would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The ACL should match the source port 80 on returning traffic, not the destination port 80Correct answer▾
Why this is correct
Return packets from the server use source port 80 and a random high destination port on the client.
✗HTTP traffic can never be filtered with a standard ACLWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because HTTP traffic can indeed be filtered using standard ACLs; the issue here is related to the return traffic being blocked by the ACL, not the ability to filter HTTP traffic itself.
★ When this WOULD be the correct answer
In a different scenario, if the question stated that only standard ACLs were being used and asked whether HTTP traffic could be filtered at all, option B would be correct, as standard ACLs cannot filter based on Layer 4 information like port numbers.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of ACL capabilities, believing that standard ACLs are too simplistic to filter specific types of traffic like HTTP, leading to a generalization that is not accurate.
✗The ACL must be applied outbound on the inside interface onlyWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because the ACL must be applied in both directions to ensure proper traffic flow; applying it only on the inside interface would not control return traffic from the DMZ to the inside network.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that the ACL is only intended to restrict outbound traffic from the inside network to the DMZ, then stating that it must be applied outbound on the inside interface could be correct, as it would imply that return traffic is not a concern.
Why candidates choose this
Candidates may find this option tempting because it suggests a simplified view of ACL application, leading them to believe that controlling traffic in one direction is sufficient without considering the return path.
✗NAT automatically bypasses interface ACLsWrong answer — click to see why▾
Why this is wrong here
NAT does not automatically bypass interface ACLs; rather, it operates independently of ACLs, meaning that ACLs can still affect traffic even when NAT is in use. In this scenario, the ACL is explicitly blocking return traffic, regardless of NAT.
★ When this WOULD be the correct answer
In a different question setup where the focus is on NAT configurations, if a question states that NAT is configured to allow all traffic and asks about the interaction with ACLs, option D could be correct. For example, if the question specifies that NAT is designed to handle all return traffic without restrictions, then this statement would apply.
Why candidates choose this
Candidates may find this option tempting because they might believe that NAT inherently allows all traffic to bypass security controls, leading to a misunderstanding of how ACLs and NAT interact in network configurations.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is believing that return HTTP traffic will have destination port 80, just like the outbound request. This misconception causes candidates to configure ACLs that only permit inbound packets with destination port 80, which blocks legitimate return traffic because the return packets have source port 80 and a high-numbered destination port. Misunderstanding this port reversal leads to ACLs that deny return traffic, causing connectivity failures despite correct outbound rules. Another trap is confusing NAT behavior, incorrectly assuming NAT bypasses ACLs, which it does not. This misunderstanding can cause candidates to overlook ACL port matching issues.
Detailed technical explanation
How to think about this question
Access Control Lists (ACLs) are fundamental Cisco security tools used to filter traffic based on IP addresses and TCP/UDP ports. When a client inside a network initiates an HTTP connection to a web server in the DMZ, the outbound packets have a source port assigned by the client (usually a high ephemeral port) and a destination port 80 (HTTP). The return traffic from the server reverses these ports: the source port is 80, and the destination port is the client’s ephemeral port. This port reversal is crucial for ACL matching.
Cisco routers apply ACLs based on the direction and interface where they are configured. An inbound ACL on the outside interface inspects packets entering from the DMZ or external network. To permit return HTTP traffic, the ACL must allow packets with source port 80 (from the server) and destination port matching the client’s ephemeral port. If the ACL only permits inbound packets with destination port 80, it will block return traffic because the destination port on return packets is not 80. This is why extended ACLs must be carefully configured to match the correct source and destination ports for bidirectional communication.
A common exam trap is assuming that return traffic will have the same destination port as the outbound traffic, leading to ACLs that block legitimate responses. Additionally, NAT does not bypass ACL processing; ACLs still filter packets after NAT translation, so ACL logic must consider translated addresses and ports. Understanding the direction of traffic flow and port roles in TCP connections is essential for correctly configuring ACLs and avoiding connectivity issues in Cisco networks.
KKey Concepts to Remember
An Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers.
Return traffic from a web server uses the server’s source port 80 and a high-numbered ephemeral destination port assigned to the client.
Extended ACLs must match the correct source and destination ports to allow return traffic through an interface on Cisco devices.
ACLs applied inbound on an interface filter traffic entering that interface, so return packets must match the ACL’s source port criteria.
NAT does not bypass ACL processing; ACLs still inspect and filter packets after NAT translation on Cisco routers.
Incorrect ACL port matching commonly causes return traffic to be denied, even if initial outbound connections are allowed.
Applying ACLs on the correct interface and direction is critical to ensure bidirectional traffic flow for protocols like HTTP.
Standard ACLs cannot filter traffic based on TCP or UDP ports; extended ACLs are required for port-specific filtering.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
An Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review an Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — An Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers..
What is the correct answer to this question?
The correct answer is: The ACL should match the source port 80 on returning traffic, not the destination port 80 — An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.
What should I do if I get this 200-301 question wrong?
Review an Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers., then practise related 200-301 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
An Access Control List (ACL) evaluates traffic based on source and destination IP addresses and ports to permit or deny packets on Cisco routers.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.