Which three statements are true when comparing a simple access control list (ACL) to an extended ACL? (Choose three.)

Question

Options

• ASimple ACLs can be based on the Source and Destination IP address.
• BSimple ACLs can be modified.
• CExtended ACLs have priorities.
• DExtended ACLs apply first.
• ESimple ACLs can bridge traffic.
• FSimple ACLs apply first.
• GSimple ACLs can be based on the Source IP and Destination port.

• A
  3% (1)
• B
  88% (35)
• E
  8% (3)
• G
  3% (1)

Explanation

B is correct because both simple and extended ACLs support modification - this is a shared capability that distinguishes them from static, immutable filter lists.

C is correct because extended ACLs support priority-based ordering within their rule sets, allowing administrators to assign sequence numbers or weights to control which rules take precedence - a feature not present in simple ACLs.

F is correct because when both ACL types are configured, simple ACLs are evaluated first in the processing pipeline before extended ACLs are checked.

Why the distractors are wrong:

• A is wrong - simple ACLs match on source IP only; matching on destination IP is an extended ACL feature.
• D is wrong - it directly contradicts F; extended ACLs apply after simple ACLs, not before.
• E is wrong - ACLs are Layer 3 filtering mechanisms; bridging is a Layer 2 function outside the scope of ACLs entirely.
• G is wrong - filtering on destination ports requires an extended ACL; simple ACLs are limited to source IP address matching only.

Memory tip: Think "Simple = Source only, Extended = Everything else." Simple ACLs are limited in scope, so they run first (F) and finish fast; extended ACLs are richer and support priorities (C) to manage their complexity. If a choice claims simple ACLs can do anything beyond source IP, it's a trap.

No community discussion yet for this question.