Which ACL implements: allow TCP ports 20–110 but drop telnet (port 23)?

The correct answer uses a specific deny statement for Telnet (port 23) followed by a more general permit statement for the desired range (ports 20-110). ACLs are processed sequentially, so the deny for port 23 takes precedence. The permit statement then allows all other TCP traffic within the specified range, effectively allowing ports 20-22 and 24-110. Incorrect options: deny tcp any any eq 22 permit tcp any any gt 20 lt 110: This denies SSH (port 22) instead of Telnet (port 23). permit tcp any any range 22 443 deny tcp any any eq 23: The permit statement comes first, allowing Telnet before the deny statement can block it. deny tcp any any eq 23 permit tcp any any: This would deny Telnet but then permit all other TCP traffic, not just the specified range.