Which statement is true about ACLs when comparing Extended ACLs to Simple ACLs?

• A. Extended ACLs have priorities.
• B. Simple ACLs can be modified.
• C. Extended ACLs apply first.
• D. Simple ACLs can be based on the Source IP address.

Answer: (A)

The main idea here is how ACL evaluation works and how extended ACLs give you finer control by arranging rules in a priority order. ACLs are processed from top to bottom, and the first rule that matches the traffic determines whether it’s permitted or denied. With extended ACLs, you can specify many fields (source and destination IP, protocol, ports, etc.), so you can create a set of rules that reflect a desired order of importance. By placing the most important or specific matches at the top, you effectively assign priority to those rules. If traffic hits one of these top rules, processing stops and the corresponding action is taken, even before the broader rules below it are considered.

That’s why this statement fits best: extended ACLs allow you to establish a priority through the ordering of their entries, giving you precise control over which traffic is acted on first. In contrast, simple (standard) ACLs are limited to matching on the source IP and don’t provide the same expressive ability to order and differentiate traffic through multiple criteria.

Note that simple ACLs can filter by source IP, which is true but less about how you control which traffic gets priority. The idea that extended ACLs apply first or that simple ACLs can’t be modified isn’t the distinguishing point; the key difference is the richer criteria and the resulting ability to prioritize rules by their position in the extended ACL.