Which outbound access list, applied to the WAN interface of a router, permits all traffic except for http traffic sourced from the workstation with IP address 10.10.10.1?

Question

Options

• Aip access-list extended 200
• Bip access-list extended 10
• Cip access-list extended NO_HTTP
• Dip access-list extended 100

• A
  11% (2)
• B
  6% (1)
• C
  6% (1)
• D
  78% (14)

Explanation

Extended ACL Numbering Explained

Option D is correct because extended ACLs must use the numbered range of 100–199, and 100 is the only choice that falls within this valid range. Extended ACLs (which can filter based on both source/destination IP addresses and protocol/port - as required here to block HTTP from a specific host) require numbers in the 100–199 range.

Why the distractors are wrong:

• Option A (200): Falls in the 200–299 range, which is reserved for extended named or invalid numbered ACLs - not valid for numbered extended ACLs
• Option B (10): Numbers 1–99 are reserved for standard ACLs, which can only filter by source IP and cannot specify HTTP traffic
• Option C (NO_HTTP): While named extended ACLs are valid in real Cisco IOS (using ip access-list extended NAME), the syntax shown is identical to Option A/D format, making it a distractor - the question implies numbered ACL context

Memory Tip: Think "1-99 = Standard, 100-199 = Extended" - standard ACLs are simple (low numbers), extended ACLs are more complex (higher numbers). If a question involves filtering by port or protocol, you need extended (100–199).

No community discussion yet for this question.