Quick Answer
The answer is the extended IPv4 ACL. This is the correct choice because extended ACLs are designed for granular traffic filtering, allowing you to match not only source and destination IP addresses but also the specific protocol (like TCP or UDP) and the Layer 4 port numbers, such as HTTP port 80 or DNS port 53. On the CCNA 200-301 v2 exam, this concept tests your understanding of how to control traffic flow with precision, often appearing in configuration scenarios where you must permit or deny specific application traffic between two hosts. A common trap is confusing extended ACLs with standard ACLs, which can only filter based on the source IP address. For a quick memory tip, remember that extended ACLs are “extended” because they go beyond the source—they check the destination, protocol, and port, giving you four layers of matching power: source, destination, protocol, and port.
This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: extended IPv4 ACLs filter traffic based on multiple criteria including source and destination IP addresses, protocol types, and Layer 4 port numbers such as TCP and UDP ports.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which ACL type can filter using source and destination IP addresses as well as TCP or UDP port numbers?
Standard IPv4 ACL
Why wrong: Standard ACLs primarily match source IP addresses only.
Extended IPv4 ACL
Correct. Extended ACLs support the granularity described.
Prefix list
Why wrong: Prefix lists are mainly used for route filtering.
Native VLAN ACL
Why wrong: That is not the ACL type being tested here.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Extended IPv4 ACL
Extended ACLs provide more granular matching, including source, destination, protocol, and Layer 4 port information.
Key principle: Extended IPv4 ACLs filter traffic based on multiple criteria including source and destination IP addresses, protocol types, and Layer 4 port numbers such as TCP and UDP ports.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Standard IPv4 ACL
Extended IPv4 ACL
Prefix list
Why it's wrong here
Prefix lists are mainly used for route filtering.
Native VLAN ACL
Why it's wrong here
That is not the ACL type being tested here.
When this WOULD be correct
If the exam question asked about controlling traffic on a specific VLAN or managing VLAN membership based on certain criteria, then a Native VLAN ACL could be the correct answer, as it would pertain to the configuration of VLANs and their associated access controls.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Correct. Extended ACLs support the granularity described.
Why this is wrong here
Standard IPv4 ACLs can only filter based on source IP address; they cannot match destination IP addresses or TCP/UDP port numbers, which are required for the granular filtering described in the question.
★ When this WOULD be the correct answer
If the question asked which ACL type can filter traffic solely based on source IP addresses without considering destination IPs or port numbers, then a Standard IPv4 ACL would be the correct answer.
Why candidates choose this
Students may confuse standard ACLs with extended ACLs because both are used for traffic filtering, but standard ACLs are simpler and often taught first, leading to the misconception that they can filter on more criteria.
Why this is wrong here
Prefix lists are designed for route filtering in routing protocols (e.g., BGP, OSPF) and match IP prefixes and prefix lengths, not TCP/UDP port numbers or individual packet headers. They cannot filter traffic based on port numbers.
★ When this WOULD be the correct answer
If the question asked about filtering routes in a routing protocol, such as OSPF or BGP, and specified the need to match IP prefixes rather than specific IP addresses or ports, then a prefix list would be the correct answer.
Why candidates choose this
The term 'prefix' might be associated with IP addresses, and students may think prefix lists can filter traffic like ACLs, but their purpose is entirely different—route advertisement control rather than packet filtering.
Why this is wrong here
Native VLAN ACL is not a standard Cisco ACL type; the correct term is VLAN ACL (VACL), which filters traffic within a VLAN but still uses standard or extended ACL logic. However, 'Native VLAN ACL' is a misnomer and does not refer to a specific ACL type that filters on source/destination IP and port numbers.
★ When this WOULD be the correct answer
If the exam question asked about controlling traffic on a specific VLAN or managing VLAN membership based on certain criteria, then a Native VLAN ACL could be the correct answer, as it would pertain to the configuration of VLANs and their associated access controls.
Why candidates choose this
The term 'Native VLAN' is familiar from trunking concepts, and students might incorrectly assume there is a special ACL for the native VLAN, but no such ACL type exists in the CCNA curriculum.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
A frequent exam trap is assuming that standard IPv4 ACLs can filter traffic based on destination IP addresses or TCP/UDP port numbers. Standard ACLs only match the source IP address, so relying on them for detailed filtering leads to incorrect answers. Another pitfall is confusing prefix lists or native VLAN ACLs with extended ACLs; prefix lists are for route filtering, and native VLAN ACLs do not provide the same level of granularity. This misunderstanding can cause candidates to select incorrect options that seem plausible but do not meet the question’s requirements for filtering by source, destination, and port numbers.
Detailed technical explanation
Access Control Lists (ACLs) are fundamental tools in Cisco networking used to filter traffic and enforce security policies. Among ACL types, extended IPv4 ACLs provide the highest granularity by allowing filtering based on source and destination IP addresses, protocol types (such as TCP, UDP, ICMP), and Layer 4 port numbers. This capability enables precise control over which traffic is permitted or denied, making extended ACLs essential for detailed security enforcement in enterprise networks. When configuring ACLs, the decision to use standard or extended ACLs depends on the filtering requirements. Standard ACLs filter only by source IP address, which limits their usefulness in complex environments. Extended ACLs, however, allow administrators to specify both source and destination IP addresses and match on transport layer ports, enabling control over specific applications or services. Cisco IOS evaluates ACL entries in order, so careful design and ordering of extended ACL rules are critical to achieving the desired traffic filtering. A common exam trap involves confusing standard and extended ACL capabilities. Candidates may incorrectly assume that standard ACLs can filter by destination IP or port numbers, which they cannot. Additionally, prefix lists and native VLAN ACLs serve different purposes and do not offer the same filtering granularity as extended ACLs. Understanding these distinctions is vital for both exam success and practical network security implementation, as misconfiguration can lead to unintended traffic flow or security vulnerabilities.
Key takeaway
Extended IPv4 ACLs filter traffic based on multiple criteria including source and destination IP addresses, protocol types, and Layer 4 port numbers such as TCP and UDP ports.
Real-world example
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Review extended IPv4 ACLs filter traffic based on multiple criteria including source and destination IP addresses, protocol types, and Layer 4 port numbers such as TCP and UDP ports., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — Extended IPv4 ACLs filter traffic based on multiple criteria including source and destination IP addresses, protocol types, and Layer 4 port numbers such as TCP and UDP ports..
The correct answer is: Extended IPv4 ACL — Extended ACLs provide more granular matching, including source, destination, protocol, and Layer 4 port information.
Review extended IPv4 ACLs filter traffic based on multiple criteria including source and destination IP addresses, protocol types, and Layer 4 port numbers such as TCP and UDP ports., then practise related 200-301 questions on the same topic to reinforce the concept.
Extended IPv4 ACLs filter traffic based on multiple criteria including source and destination IP addresses, protocol types, and Layer 4 port numbers such as TCP and UDP ports.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.