Question 110
An access engineer must block one legacy workstation's IPv4 source address 10.10.7.44 from reaching a small subnet behind the distribution router, while allowing its other destinations. Only a standard ACL is available. Where should it generally be placed?
Explanation
Correct Answer
A standard ACL matches the source but not the destination. Placing it near the affected destination avoids denying that source's legitimate traffic to unrelated networks.
Incorrect Answers
ACL processing stops at the first match; permit any above the specific deny would shadow it.
Applying a source-only deny near the workstation would drop its traffic before any destination distinction is possible, exceeding the narrow requested access restriction.
A valid ACL rule cannot enforce a policy if it is not attached to the relevant path and direction.





Cisco Certified Network Associate (CCNA) (200-301) Practice Tests