Courseiva
← 200-301
Full test
Network Services and Security →hardMultiple ChoiceObjective-mapped

CCNA Network Services and Security Practice Question

Exhibit

access-list 101 permit tcp any any eq 80
interface g0/1
 ip access-group 101 in
DMZ web server: 172.16.100.10

Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?

⚠ Common exam trap

A frequent exam trap is believing that return HTTP traffic will have destination port 80, just like the outbound request. This misconception causes candidates to configure ACLs that only permit inbound packets with destination port 80, which blocks legitimate return traffic because the return packets have source port 80 and a high-numbered destination port. Misunderstanding this port reversal leads to ACLs that deny return traffic, causing connectivity failures despite correct outbound rules. Another trap is confusing NAT behavior, incorrectly assuming NAT bypasses ACLs, which it does not. This misunderstanding can cause candidates to overlook ACL port matching issues.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The ACL should match the source port 80 on returning traffic, not the destination port 80

An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    The ACL should match the source port 80 on returning traffic, not the destination port 80

    Why this is correct

    HTTP response packets from the server use source port 80 and a randomly chosen high destination port on the client, not destination port 80. An ACL that only permits traffic with destination port 80 will therefore drop the return packets because their destination port is an ephemeral port. To correctly permit the response, the inbound ACL must match the source port and destination host, not the destination port.

  • ✗

    HTTP traffic can never be filtered with a standard ACL

    Why it's wrong here

    Standard ACLs can match only source IP addresses, so they cannot filter by TCP or UDP ports, making them incapable of selectively permitting or denying HTTP traffic based on port 80. However, the ACL in this scenario is an extended ACL because it refers to destination port 80, so standard-ACL limitations are not the cause of the failure. The actual mistake is using destination port 80 to match return traffic, which is a packet-selection error unrelated to the ACL type.

    When this WOULD be correct

    In a different scenario, if the question stated that only standard ACLs were being used and asked whether HTTP traffic could be filtered at all, option B would be correct, as standard ACLs cannot filter based on Layer 4 information like port numbers.

  • ✗

    The ACL must be applied outbound on the inside interface only

    Why it's wrong here

    The problem is not the direction or interface where the ACL is applied; an outbound ACL on the inside interface would still permit traffic leaving the inside network, but the failing return traffic enters the network and must be evaluated by an inbound ACL on the inside interface or an outbound ACL on the outside interface. Even if you moved the ACL to the 'correct' outbound inside direction, the erroneous destination-port match would still block return responses. The fundamental defect is the match logic, not the placement.

    When this WOULD be correct

    In a different scenario where the question specifies that the ACL is only intended to restrict outbound traffic from the inside network to the DMZ, then stating that it must be applied outbound on the inside interface could be correct, as it would imply that return traffic is not a concern.

  • ✗

    NAT automatically bypasses interface ACLs

    Why it's wrong here

    NAT and ACLs are processed independently; invoking NAT does not exempt packets from interface access-list checks. The exact order depends on the direction and NAT configuration, but in every case the router evaluates the translated packet against the applicable ACL before forwarding it or as part of the output process. Therefore, NAT cannot bypass or override an ACL that denies the HTTP return traffic; the ACL's match criteria must be corrected to resolve the connectivity problem.

    When this WOULD be correct

    In a different question setup where the focus is on NAT configurations, if a question states that NAT is configured to allow all traffic and asks about the interaction with ACLs, option D could be correct. For example, if the question specifies that NAT is designed to handle all return traffic without restrictions, then this statement would apply.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

✓The ACL should match the source port 80 on returning traffic, not the destination port 80Correct answer▾

Why this is correct

HTTP response packets from the server use source port 80 and a randomly chosen high destination port on the client, not destination port 80. An ACL that only permits traffic with destination port 80 will therefore drop the return packets because their destination port is an ephemeral port. To correctly permit the response, the inbound ACL must match the source port and destination host, not the destination port.

✗HTTP traffic can never be filtered with a standard ACLWrong answer — click to see why▾

Why this is wrong here

This option is incorrect because HTTP traffic can indeed be filtered using standard ACLs; the issue here is related to the return traffic being blocked by the ACL, not the ability to filter HTTP traffic itself.

★ When this WOULD be the correct answer

In a different scenario, if the question stated that only standard ACLs were being used and asked whether HTTP traffic could be filtered at all, option B would be correct, as standard ACLs cannot filter based on Layer 4 information like port numbers.

Why candidates choose this

Candidates may choose this option due to a misunderstanding of ACL capabilities, believing that standard ACLs are too simplistic to filter specific types of traffic like HTTP, leading to a generalization that is not accurate.

✗The ACL must be applied outbound on the inside interface onlyWrong answer — click to see why▾

Why this is wrong here

This option is incorrect because the ACL must be applied in both directions to ensure proper traffic flow; applying it only on the inside interface would not control return traffic from the DMZ to the inside network.

★ When this WOULD be the correct answer

In a different scenario where the question specifies that the ACL is only intended to restrict outbound traffic from the inside network to the DMZ, then stating that it must be applied outbound on the inside interface could be correct, as it would imply that return traffic is not a concern.

Why candidates choose this

Candidates may find this option tempting because it suggests a simplified view of ACL application, leading them to believe that controlling traffic in one direction is sufficient without considering the return path.

✗NAT automatically bypasses interface ACLsWrong answer — click to see why▾

Why this is wrong here

NAT does not automatically bypass interface ACLs; rather, it operates independently of ACLs, meaning that ACLs can still affect traffic even when NAT is in use. In this scenario, the ACL is explicitly blocking return traffic, regardless of NAT.

★ When this WOULD be the correct answer

In a different question setup where the focus is on NAT configurations, if a question states that NAT is configured to allow all traffic and asks about the interaction with ACLs, option D could be correct. For example, if the question specifies that NAT is designed to handle all return traffic without restrictions, then this statement would apply.

Why candidates choose this

Candidates may find this option tempting because they might believe that NAT inherently allows all traffic to bypass security controls, leading to a misunderstanding of how ACLs and NAT interact in network configurations.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Inside (Private) PC-A 10.0.0.1 PC-B 10.0.0.2 NAT Router Outside (Public) 203.0.113.1 Inside Global Server PAT: many private IPs share one public IP via unique port numbers

About these practice questions

This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.