An organization is concerned that too many employees are wasting company time accessing the Internet. Which access list statement would stop World Wide Web access for employees on the range of…

The wildcard 0.0.0.3 only spans four host addresses within 172.16.8.0/24 (172.16.8.0-172.16.8.3), far too narrow to cover the required four full subnets.

The wildcard mask 0.0.3.255 applied to base address 172.16.8.0 covers 172.16.8.0 through 172.16.11.255, matching all four /24 subnets in the range. The statement correctly uses 'tcp' as the protocol and 'eq 80' to match HTTP traffic, and specifies 'any' as the destination so all WWW access is blocked regardless of the server address.

'http' is not a valid Cisco IOS ACL protocol keyword - the correct syntax requires 'tcp' with 'eq 80' to match HTTP traffic.

The source and destination are reversed; this statement would deny TCP port 80 traffic sent TO the subnet range rather than FROM it, blocking inbound web server responses instead of outbound employee requests.

The wildcard 0.0.11.255 applied to 172.16.8.0 covers 172.16.8.0 through 172.16.19.255, which includes subnets beyond 172.16.11.0 and is broader than required.