Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

An administrator configures the following IPv4 extended named access control list on a Cisco IOS router and applies it inbound on interface GigabitEthernet0/0/1:

text
ip access-list extended CORP_SEC
permit tcp 10.1.10.0 0.0.0.255 host 192.168.1.50 eq 22
permit tcp 10.1.10.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit tcp 10.1.10.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 443

Which two statements accurately describe how network traffic arriving on GigabitEthernet0/0/1 will be filtered by this access control list? (Select two options.)

  1. ICMP echo requests from host 10.1.10.5 to host 192.168.1.50 are dropped due to the implicit deny at the end of the access list.Answer
  2. TCP traffic originating from host 10.1.10.20 destined to host 192.168.2.100 on port 443 is permitted through the interface.Answer
  3. C
    ICMP echo requests from host 10.1.10.5 to host 192.168.1.50 are permitted because explicit TCP permit rules automatically pass diagnostic ICMP messages.
  4. D
    SSH traffic from host 10.1.10.5 to host 192.168.2.100 is permitted because the SSH rule applies to all destinations within the enterprise network.

Answer

ICMP echo requests from host 10.1.10.5 to host 192.168.1.50 are dropped due to the implicit deny at the end of the access list, and TCP traffic originating from host 10.1.10.20 destined to host 192.168.2.100 on port 443 is permitted through the interface.
The correct statements recognize both explicit matching criteria and the role of the implicit deny clause. First, ICMP packets from host 10.1.10.5 to host 192.168.1.50 are dropped because the ACL only permits TCP port 22 to that destination; unmatched ICMP packets trigger the invisible implicit deny at the end of the list. Second, TCP traffic from host 10.1.10.20 to host 192.168.2.100 on port 443 explicitly matches the third entry permitting 10.1.10.0/24 to 192.168.2.0/24 eq 443.

Step-by-Step Solution

1
Analyze line 1 of the ACL for SSH traffic to host 192.168.1.50
Line 1 permits TCP traffic from 10.1.10.0/24 to host 192.168.1.50 on port 22 (SSH). It does not permit ICMP traffic or SSH traffic to other subnets.
Extended ACL match criteria examine protocol type (TCP), source network (10.1.10.0/24), destination address (host 192.168.1.50), and destination port (22).
2
Analyze lines 2 and 3 of the ACL for HTTP/HTTPS traffic to subnet 192.168.2.0/24
Lines 2 and 3 permit TCP traffic from 10.1.10.0/24 to any host in 192.168.2.0/24 on ports 80 (HTTP) and 443 (HTTPS). Host 192.168.2.100 falls into 192.168.2.0/24, so HTTPS traffic to this host matches line 3 and is permitted.
The wildcard mask 0.0.0.255 on destination 192.168.2.0 specifies the entire /24 network range.
3
Evaluate unlisted traffic types against the end of the ACL
ICMP echo requests from 10.1.10.5 to 192.168.1.50 do not match TCP port 22, 80, or 443 rules. Unmatched traffic hits the unwritten 'deny ip any any' at the end of the ACL and is dropped.
Cisco IOS automatically appends an invisible implicit deny statement at the end of every access control list.

Key Concept

Extended IPv4 ACL sequential matching and implicit deny processing
Estimated Time:1m 30s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic