ExamworthyExamworthy
Open the appStart free

200-301 - Security Fundamentals - Section 5.6

Configure and verify standard and extended IPv4 access control lists for traffic filtering.

Build standard ACLs that match on source address only and extended ACLs that match source, destination, protocol, and port, and place each where it does the intended job - standard near the destination, extended near the source. Recognise that ACLs are processed top-down with first-match wins, that an implicit deny any ends every list, and that wildcard masks (not subnet masks) define the address range.

Standard ACLExtended ACLWildcard maskImplicit denyACL placement

Practice question for this objective

Free sampleSecurity Fundamentalshard

An engineer must permit every host on the subnet 10.18.64.0/22 with a single ACL line and must follow Cisco's classic guideline for placing the resulting standard ACL. Which choices correctly satisfy both the wildcard match and the placement rule? Select TWO.

  • AUse the wildcard mask 0.0.3.255 paired with the address 10.18.64.0 to match the whole subnet. Correct
  • BUse the wildcard mask 0.0.255.255 with 10.18.64.0, since that covers the addresses in the block.
  • CPlace the standard ACL as close to the destination as possible to avoid discarding wanted traffic. Correct
  • DUse the wildcard mask 0.0.252.0 with 10.18.64.0, because it isolates the four subnet bits.
  • EPlace the standard ACL closest to the source to filter the packets at the earliest possible hop.
A /22 subnet uses the wildcard 0.0.3.255, and standard ACLs belong near the destination because they match only the source address. A wildcard mask is the bitwise inverse of the subnet mask, so /22 (255.255.252.0) inverts to 0.0.3.255 and matches the contiguous host range. A standard ACL filters on source only, so placing it near the destination avoids discarding traffic from that source headed to other permitted networks; extended ACLs instead go near the source.

Why A is correct: A /22 leaves the last ten bits variable, which is 0.0.3.255 in wildcard form, so this mask matches every host in 10.18.64.0/22 and nothing outside it.

Why B is wrong: That wildcard matches a /16 range, far wider than /22, so it would also select neighbouring subnets the engineer must not include.

Why C is correct: A standard ACL matches only source addresses, so applying it near the destination prevents it from dropping flows the source needs to reach elsewhere.

Why D is wrong: This places variable bits in the wrong octet positions and leaves host bits fixed, so it fails to match the contiguous host range of the /22.

Why E is wrong: Earliest filtering is the guideline for extended ACLs; a source-only standard ACL near the source risks blocking traffic bound for other valid destinations.

See more 200-301 practice questions, answers explained.

More in this domain

Back to all Security Fundamentals objectives, or the 200-301 cert hub.

Examworthy is not affiliated with or endorsed by Cisco. Original, blueprint-aligned practice material only.