Standard and extended ACLs
Standard ACLs filter traffic based only on the source IP address. They are numbered 1 to 99 and 1300 to 1999. Because they only look at the source, they cannot distinguish between a web request and an FTP request from the same host. Standard ACLs should be placed close to the destination to avoid blocking traffic too broadly.
Extended ACLs filter on source IP, destination IP, protocol (TCP, UDP, ICMP), and source and destination port numbers. This granularity lets you allow SSH from one specific host to one specific server while blocking everything else. Extended ACLs are numbered 100 to 199 and 2000 to 2699. Place extended ACLs close to the source so that unwanted traffic is dropped before it uses bandwidth on the network.
Named ACLs use descriptive names instead of numbers and are otherwise functionally equivalent. Names make intent clear: PERMIT_WEB_SERVERS tells you what the list does. Named ACLs also allow you to delete individual entries without removing the whole list, which numbered ACLs do not support.
How ACLs process packets
ACLs process rules in order from top to bottom. The moment a packet matches a rule, the action (permit or deny) is taken and processing stops. No further rules are checked. This means rule order is critical: a broad permit rule early in the list will match packets you intended to catch with a deny rule later.
Every ACL ends with an implicit deny all. This is not a rule you can see in the configuration, but it is always there. If a packet does not match any rule in the ACL, it is dropped. This is why permit rules matter: if you forget to permit legitimate traffic, the implicit deny drops it silently.
ACLs are applied to interfaces in a direction: inbound (applied to packets entering the interface) or outbound (applied to packets leaving the interface). An interface can have one ACL in each direction. The direction matters for filtering logic because inbound ACLs check traffic before the router makes a routing decision, while outbound ACLs check after.
How to choose the correct answer
Standard ACL placement: close to the destination (since it only matches source IP, placing it near the source risks blocking all traffic from that source, not just what you intended).
Extended ACL placement: close to the source (stop unwanted traffic early, save bandwidth).
Rule order: more specific rules must come before more general ones. A deny for a single host must appear before a permit for the whole subnet that host belongs to.
Wildcard masks: the inverse of a subnet mask. 0 bits mean the IP bit must match; 1 bits mean the bit is ignored. A wildcard of 0.0.0.255 matches any host in the /24 network. The keyword host is shorthand for 0.0.0.0 wildcard (match exactly this address).
Implicit deny: if no rule matches, the packet is dropped. Always end with an explicit permit if you want to allow anything not covered by your deny rules.