200-301 - Security Fundamentals (15% of the exam) - Section 5.6
Configure and verify standard and extended IPv4 access control lists for traffic filtering.
Build standard ACLs that match on source address only and extended ACLs that match source, destination, protocol, and port, and place each where it does the intended job - standard near the destination, extended near the source. Recognise that ACLs are processed top-down with first-match wins, that an implicit deny any ends every list, and that wildcard masks (not subnet masks) define the address range.
Standard ACLExtended ACLWildcard maskImplicit denyACL placement
Practice question for this objective
lock_openFree sampleSecurity Fundamentalshard
An engineer must permit every host on the subnet 10.18.64.0/22 with a single ACL line and must follow Cisco's classic guideline for placing the resulting standard ACL. Which choices correctly satisfy both the wildcard match and the placement rule? Select TWO.
AUse the wildcard mask 0.0.3.255 paired with the address 10.18.64.0 to match the whole subnet.check_circle Correct
BUse the wildcard mask 0.0.255.255 with 10.18.64.0, since that covers the addresses in the block.
CPlace the standard ACL as close to the destination as possible to avoid discarding wanted traffic.check_circle Correct
DUse the wildcard mask 0.0.252.0 with 10.18.64.0, because it isolates the four subnet bits.
EPlace the standard ACL closest to the source to filter the packets at the earliest possible hop.
A /22 subnet uses the wildcard 0.0.3.255, and standard ACLs belong near the destination because they match only the source address. A wildcard mask is the bitwise inverse of the subnet mask, so /22 (255.255.252.0) inverts to 0.0.3.255 and matches the contiguous host range. A standard ACL filters on source only, so placing it near the destination avoids discarding traffic from that source headed to other permitted networks; extended ACLs instead go near the source.
Why A is correct: A /22 leaves the last ten bits variable, which is 0.0.3.255 in wildcard form, so this mask matches every host in 10.18.64.0/22 and nothing outside it.
Why B is wrong: That wildcard matches a /16 range, far wider than /22, so it would also select neighbouring subnets the engineer must not include.
Why C is correct: A standard ACL matches only source addresses, so applying it near the destination prevents it from dropping flows the source needs to reach elsewhere.
Why D is wrong: This places variable bits in the wrong octet positions and leaves host bits fixed, so it fails to match the contiguous host range of the /22.
Why E is wrong: Earliest filtering is the guideline for extended ACLs; a source-only standard ACL near the source risks blocking traffic bound for other valid destinations.
Answers that look right on this material and are not. Each one is a distractor from a different question in the 200-301 bank for this domain.
As close to the source of the traffic as possible, because a standard ACL can match on the destination address.
errorWhy it is wrong: This is the placement rule for an extended ACL, which can match destination as well as source. A standard ACL matches source address only, so applying it near the source would block all traffic from that host to every destination, not just the intended flow.
Because no deny is written, unmatched packets are permitted by the router as a default allow action.
errorWhy it is wrong: This inverts the rule and tempts those who think a deny must be typed; the hidden implicit deny drops, rather than permits, unmatched traffic.
Both standard and extended ACLs belong as close to the source as possible, because filtering early always conserves the most bandwidth regardless of ACL type.
errorWhy it is wrong: Placing a standard ACL near the source is risky because, matching source only, it can block legitimate traffic to unintended destinations; the source-placement guidance applies to extended ACLs, not both.