What is the difference between a standard ACL and an extended ACL?

What is the difference between a standard ACL and an extended ACL?

• A. A standard ACL filters by source IP address only; an extended ACL filters by source and destination IPs, protocols, and ports.
• B. A standard ACL filters by destination IP; an extended ACL filters by MAC addresses.
• C. A standard ACL filters by protocol; an extended ACL filters by port numbers only.
• D. A standard ACL filters by port numbers; an extended ACL filters by source IP only.

Answer: (A)

Standard ACLs filter traffic based only on where it comes from—the source IP address. They don’t consider where it’s going, what protocol is used, or what service is requested. Extended ACLs add granularity by allowing filtering on both source and destination IP addresses, the transport protocol (such as TCP, UDP, or ICMP), and even specific port numbers. This lets you permit or deny particular services between particular hosts or subnets, not just general access from a network. For example, you can allow HTTP from one subnet to another while denying other protocols, something a standard ACL can’t express. In practice, use standard ACLs when you only need to restrict by who can access resources, and use extended ACLs when you need to control access by both endpoints and the specific services.

Standard ACLs filter traffic based only on where it comes from—the source IP address. They don’t consider where it’s going, what protocol is used, or what service is requested. Extended ACLs add granularity by allowing filtering on both source and destination IP addresses, the transport protocol (such as TCP, UDP, or ICMP), and even specific port numbers. This lets you permit or deny particular services between particular hosts or subnets, not just general access from a network. For example, you can allow HTTP from one subnet to another while denying other protocols, something a standard ACL can’t express. In practice, use standard ACLs when you only need to restrict by who can access resources, and use extended ACLs when you need to control access by both endpoints and the specific services.