Examkin

Question

Difficulty: EasyAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator applies an extended IPv4 Access Control List (ACL) containing only a single rule to an interface: `access-list 100 permit tcp host 192.168.1.10 host 10.0.0.5 eq 80`. What happens when a host with IP address 192.168.1.11 attempts to send HTTP traffic to 10.0.0.5?

  1. The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.Answer
  2. B
    The traffic is permitted because there is no explicit deny statement configured in the ACL.
  3. C
    The traffic is forwarded by default because ACLs only inspect source IP address 192.168.1.10.
  4. D
    The traffic triggers a logging notification on the router before being allowed through the interface.

Answer

The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.
Every Cisco IPv4 Access Control List ends with an invisible implicit deny statement (implicit deny ip any any). Because the single configured line only permits traffic from 192.168.1.10, any packet coming from 192.168.1.11 fails to match rule 1 and is dropped by the implicit deny clause.

Step-by-Step Solution

1
Evaluate the incoming packet details against the ACL rule.
Host 192.168.1.11 does not match source IP host 192.168.1.10 in line 1.
The configured line specifically permits traffic only from host 192.168.1.10.
2
Proceed to subsequent lines in the ACL.
The packet hits the unwritten implicit deny statement at the end of the list.
All Cisco IOS IPv4 ACLs end with an implicit 'deny ip any any' rule.
3
Determine the forwarding decision.
The router drops the packet from host 192.168.1.11.
Traffic that fails to match any explicit permit line is denied.

Key Concept

Implicit Deny in IPv4 Access Control Lists
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic