What is true of standard access control lists when applied to an interface to control inbound or outbound traffic?