CCNA Network Services and Security Practice Question
Exhibit
access-list 110 ?
Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry should appear first in the ACL?
⚠ Common exam trap
A frequent exam trap is selecting a deny ip statement to block HTTP traffic, which seems simpler but actually blocks all IP traffic from the source subnet to the destination host. This overbroad denial disrupts legitimate communications such as DNS, SSH, or other TCP/UDP services, violating the requirement to allow all other traffic. Another trap is denying UDP port 80, which is incorrect because HTTP uses TCP, not UDP. Candidates may also mistakenly place a permit statement first, which would allow the HTTP traffic instead of blocking it. Recognizing the correct protocol and port and placing the deny statement first is critical to avoid these pitfalls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
The requirement is specific: block HTTP traffic from one source subnet to one server, but allow everything else. In plain terms, you do not want to shut off all communication to the server or all communication from the users. You only want to stop normal web traffic that uses TCP port 80. That means the ACL should start with a deny statement that matches TCP from 10.10.10.0/24 to host 172.16.1.10 on destination port 80. Using `deny ip` would block every IP-based protocol to that host, which is broader than the requirement. Using UDP port 80 does not match normal HTTP. And a permit statement would do the opposite of what is needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why it's wrong here
This statement is wrong because permit performs the exact opposite of the required action by explicitly allowing TCP port 80 traffic from the 10.10.10.0/24 subnet to host 172.16.1.10. In a Cisco ACL, rules are evaluated top-down and the first match wins, so if this permit appears before any deny statement, the HTTP packets will be forwarded and the users will successfully reach the web server, violating the requirement. Even if a deny statement were placed later, it would never be evaluated for those packets, making this permit a direct failure of the access-control objective.
When this WOULD be correct
In a different scenario where the requirement is to allow HTTP traffic from 10.10.10.0/24 to 172.16.1.10 while denying all other traffic, option A would be correct. For example, if the question stated that users should be allowed to access the web server but not other services, this entry would fit.
- ✗
deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10
Why it's wrong here
This rule is incorrect because deny ip matches all IP protocols—TCP, UDP, ICMP, GRE, and everything else—between the 10.10.10.0/24 subnet and the host 172.16.1.10, not just web traffic. The requirement asks only to prevent users from reaching the web, so this broad action would also block legitimate services such as ping, DNS, RDP, and any other IP communication to that server. Furthermore, the ip protocol does not support the eq operator, so this statement cannot even be narrowed to a specific port, making it an overreaching and unsuitable ACL entry.
When this WOULD be correct
In a scenario where the objective is to block all traffic from the 10.10.10.0/24 subnet to the web server at 172.16.1.10, regardless of the protocol, this option would be correct. For example, if the question asked to prevent any communication to the server, not just HTTP, this would be the right choice.
- ✓
deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why this is correct
This extended ACL entry correctly uses the deny keyword with protocol tcp, source 10.10.10.0 0.0.0.255, destination host 172.16.1.10, and destination port eq 80 to match HTTP traffic. Because web browsing uses TCP port 80, this statement blocks exactly the HTTP requests from the 10.10.10.0/24 users to that specific web server while leaving all other protocols and ports unaffected. The wildcard mask 0.0.0.255 limits the match to the 10.10.10.0/24 subnet, and the explicit host keyword ties the rule to one destination, satisfying the narrow security requirement.
- ✗
deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why it's wrong here
This option is wrong because it targets UDP port 80, while standard web/HTTP traffic is carried over TCP port 80, not UDP. A deny udp ... eq 80 statement would have no effect on actual HTTP requests from 10.10.10.0/24 to 172.16.1.10, so those users could still browse the website, leaving the requirement unsatisfied. Conversely, any non-web UDP application using port 80 could be unintentionally blocked, but that is irrelevant here; the core flaw is mistaking the transport protocol for HTTP traffic.
When this WOULD be correct
In a scenario where the question specifies that users should be prevented from accessing a service that uses UDP on port 80 (hypothetically, if a web service were using UDP), then option D would be the correct answer. For example, if the question stated that UDP traffic from 10.10.10.0/24 to 172.16.1.10 on port 80 should be denied, this option would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Correct answer▾
Why this is correct
This extended ACL entry correctly uses the deny keyword with protocol tcp, source 10.10.10.0 0.0.0.255, destination host 172.16.1.10, and destination port eq 80 to match HTTP traffic. Because web browsing uses TCP port 80, this statement blocks exactly the HTTP requests from the 10.10.10.0/24 users to that specific web server while leaving all other protocols and ports unaffected. The wildcard mask 0.0.0.255 limits the match to the 10.10.10.0/24 subnet, and the explicit host keyword ties the rule to one destination, satisfying the narrow security requirement.
✗permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Wrong answer — click to see why▾
Why this is wrong here
Option A is wrong because it permits TCP traffic on port 80 from the specified subnet to the web server, which contradicts the requirement to prevent HTTP access to that server.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to allow HTTP traffic from 10.10.10.0/24 to 172.16.1.10 while denying all other traffic, option A would be correct. For example, if the question stated that users should be allowed to access the web server but not other services, this entry would fit.
Why candidates choose this
Candidates may find option A tempting because it directly addresses the HTTP traffic on port 80, which is a common requirement in access control lists, leading to confusion about the context of the question.
✗deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because it denies all IP traffic from the 10.10.10.0/24 subnet to the web server, which is too broad and would block all types of traffic, not just HTTP. The requirement is to specifically block only HTTP traffic.
★ When this WOULD be the correct answer
In a scenario where the objective is to block all traffic from the 10.10.10.0/24 subnet to the web server at 172.16.1.10, regardless of the protocol, this option would be correct. For example, if the question asked to prevent any communication to the server, not just HTTP, this would be the right choice.
Why candidates choose this
Candidates may choose this option because it seems to address the requirement of blocking traffic, and they might misinterpret the question as needing to block all access to the server rather than just HTTP.
✗deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Wrong answer — click to see why▾
Why this is wrong here
Option D is incorrect because it attempts to deny UDP traffic to the web server, while the question specifically requires blocking HTTP traffic, which uses TCP. Thus, this ACL entry does not meet the requirement of preventing access over HTTP.
★ When this WOULD be the correct answer
In a scenario where the question specifies that users should be prevented from accessing a service that uses UDP on port 80 (hypothetically, if a web service were using UDP), then option D would be the correct answer. For example, if the question stated that UDP traffic from 10.10.10.0/24 to 172.16.1.10 on port 80 should be denied, this option would apply.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of the protocols involved, mistakenly believing that blocking UDP traffic could also impact HTTP traffic, or because they see 'deny' and assume it aligns with the goal of restricting access.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
HTTP
HTTP stands for Hypertext Transfer Protocol, the set of rules web browsers and servers use to communicate and transfer web pages over the internet.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.