CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use the narrowest possible match so only the intended traffic is denied.

  Why this is correct

  Using the narrowest possible match—such as a specific extended ACL entry with the exact destination IP, protocol, and port—ensures that only packets destined for that one web server are denied, leaving all other traffic untouched. This precision prevents accidental blocking of other services or hosts sharing the same subnet, which is the core principle of least-privilege ACL design.

• ✗

  Always deny all IP traffic to the destination subnet first.

  Why it's wrong here

  Denying all IP traffic to the destination subnet first is overly broad because it would block every host and service on that subnet, not just the single web server. For example, if the server's IP is 192.168.1.10 on the 192.168.1.0/24 subnet, a deny statement for 192.168.1.0/24 will also block email, DNS, or other hosts on that subnet, violating the requirement to restrict only the specific server.

  When this WOULD be correct

  In a scenario where an administrator needs to implement a security policy that restricts all traffic to a specific subnet due to security concerns, such as isolating a compromised server, this option would be correct as it ensures no traffic reaches that subnet.

• ✗

  Use a standard ACL because destination details never matter.

  Why it's wrong here

  Standard ACLs filter based solely on the source IP address and cannot inspect destination fields, so they are incapable of matching traffic destined for a particular web server. To deny traffic to a specific destination, you must use an extended ACL, which permits matching on the destination IP address, protocol, and port number. Therefore, the claim that destination details never matter is factually incorrect in this scenario.

  When this WOULD be correct

  In a scenario where an exam question asks about a network setup that only requires filtering based on source IP addresses, a standard ACL would be appropriate. For instance, if the question specifies that all traffic from a certain subnet should be denied regardless of the destination, then using a standard ACL would be the correct choice.

• ✗

  Place the ACL only where no routing exists.

  Why it's wrong here

  Placing an ACL where no routing exists is ineffective because an ACL must be applied to an interface along the actual forwarding path of the traffic to filter it. If no route exists to the web server, the traffic would never reach that location anyway, so the ACL would have no effect, and the real problem of blocking specific traffic remains unresolved. The correct approach is to place the ACL on a routed interface where the traffic passes, not on a null path.

  When this WOULD be correct

  In a scenario where a network design requires an ACL to be applied on a switch port that does not route traffic but still needs to control access to specific devices, placing the ACL at that point could be correct. For example, if the question specifies controlling access to a printer on a VLAN without routing, this option would apply.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”