CCNA Network Services and Security Practice Question
Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?
⚠ Common exam trap
A common exam trap is selecting a deny statement that blocks all IP traffic (option B) instead of just HTTP traffic. This overblocking disrupts legitimate services beyond HTTP, violating the requirement to allow all other traffic. Another trap is denying UDP port 80 (option C), which is ineffective because HTTP uses TCP, not UDP. Additionally, mistakenly permitting TCP port 80 traffic (option D) contradicts the goal of blocking HTTP access. Understanding the difference between protocol types and the impact of broad versus specific ACL entries is essential to avoid these pitfalls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
The correct ACL entry is an extended ACL deny statement that matches TCP from the source subnet to the destination host on port 80. In practical terms, the requirement is narrow: block HTTP only, from one source network to one server, while allowing everything else. That means using `deny tcp` with the right source, destination, and port is more accurate than using a broad `deny ip`. This is a classic ACL precision question. The exam is testing whether you can match the requirement exactly rather than overblocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why this is correct
This is correct because it blocks only TCP port 80 traffic from the source subnet to the web server.
- ✗
deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10
Why it's wrong here
This is wrong because it blocks all IP traffic to the server, not just HTTP.
When this WOULD be correct
In a scenario where the requirement is to block all IP traffic from the 10.10.10.0/24 subnet to the web server at 172.16.1.10, regardless of the protocol, option B would be the correct choice. For instance, if the question specified to block all access to the server, including HTTPS and other protocols, this option would apply.
- ✗
deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why it's wrong here
This is wrong because normal HTTP uses TCP, not UDP.
When this WOULD be correct
If the question specified that the web server communicates over UDP for a specific application, such as a video streaming service that uses UDP for transport, then this option would correctly deny UDP traffic from the specified subnet to the web server.
- ✗
permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80
Why it's wrong here
This is wrong because it would explicitly allow the traffic that should be blocked.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to allow HTTP traffic from the 10.10.10.0/24 subnet to the web server at 172.16.1.10, perhaps in a question that specifies that users need access to the web server for legitimate purposes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Correct answer▾
Why this is correct
This is correct because it blocks only TCP port 80 traffic from the source subnet to the web server.
✗deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10Wrong answer — click to see why▾
Why this is wrong here
This entry denies all IP traffic (any protocol) from the source subnet to the web server, which blocks more than just HTTP and violates the requirement to allow all other traffic.
★ When this WOULD be the correct answer
In a scenario where the requirement is to block all IP traffic from the 10.10.10.0/24 subnet to the web server at 172.16.1.10, regardless of the protocol, option B would be the correct choice. For instance, if the question specified to block all access to the server, including HTTPS and other protocols, this option would apply.
Why candidates choose this
Students might think 'ip' covers all traffic including HTTP, but they overlook that it blocks everything, not just HTTP.
✗deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Wrong answer — click to see why▾
Why this is wrong here
HTTP uses TCP, not UDP. This entry would not block HTTP traffic because it specifies UDP, so the HTTP traffic would still be allowed.
★ When this WOULD be the correct answer
If the question specified that the web server communicates over UDP for a specific application, such as a video streaming service that uses UDP for transport, then this option would correctly deny UDP traffic from the specified subnet to the web server.
Why candidates choose this
Students may confuse TCP and UDP, or think that HTTP could use UDP in some cases, but standard HTTP always uses TCP.
✗permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80Wrong answer — click to see why▾
Why this is wrong here
This entry permits the traffic that should be blocked. It would allow HTTP traffic from the source subnet to the web server, which is the opposite of the requirement.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to allow HTTP traffic from the 10.10.10.0/24 subnet to the web server at 172.16.1.10, perhaps in a question that specifies that users need access to the web server for legitimate purposes.
Why candidates choose this
Students might mistakenly think 'permit' is needed to allow other traffic, but the requirement is to block HTTP; a deny entry is needed for that specific traffic.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Extended ACL
An extended access control list (ACL) is a set of rules that filters network traffic based on source and destination IP addresses, protocol type, and port numbers, providing more granular control than a standard ACL.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.