Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator applies the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to regulate access from the Sales department (192.168.30.0/24192.168.30.0/24) to the Finance server (10.2.2.5010.2.2.50):

text
ip access-list extended FILTER_SALES
permit tcp host 192.168.30.15 host 10.2.2.50 eq 443
deny ip 192.168.30.0 0.0.0.255 host 10.2.2.50
permit ip 192.168.30.0 0.0.0.255 any

Which two statements correctly describe the operational evaluation and deployment best practices for this ACL configuration? (Select two.)

  1. Applying FILTER_SALES inbound on the router interface closest to the 192.168.30.0/24 network minimizes unnecessary traffic processing across the router backplane.Answer
  2. Traffic sent from host 192.168.30.15 to a web server at 10.4.4.100 on TCP port 80 will be permitted by the third ACL rule.Answer
  3. C
    Telnet traffic from host 192.168.30.20 destined to the Finance server at 10.2.2.50 is permitted because the final entry allows all IP traffic from that subnet.
  4. D
    Unmatched packets originating from the 192.168.30.0/24 subnet will bypass the ACL and be forwarded normally because an explicit permit line exists.

Answer

The correct statements are that applying the extended ACL inbound on the interface closest to the source subnet optimizes network performance by dropping blocked packets early, and that HTTP traffic from 192.168.30.15 destined to 10.4.4.100 is allowed by the third ACL rule.
Applying Extended IPv4 ACLs inbound on the interface closest to the traffic source adheres to Cisco best practices by dropping unauthorized packets at the edge. Additionally, traffic from host 192.168.30.15 destined to 10.4.4.100 bypasses the first two specific rules (which strictly filter traffic destined to 10.2.2.50) and matches the third rule permitting general egress traffic from the 192.168.30.0/24 subnet.

Step-by-Step Solution

1
Analyze extended ACL placement guidelines.
Extended ACLs filter based on source/destination IP addresses and layer 4 protocol/port information. Cisco design guidelines state extended ACLs should be applied as close to the traffic source as possible to eliminate prohibited traffic before it traverses the network core.
Applying FILTER_SALES inbound on the ingress interface facing 192.168.30.0/24 complies with standard Cisco architectural recommendations.
2
Evaluate packet matching logic for traffic sent to destination 10.4.4.100.
Line 1 checks for destination host 10.2.2.50 (no match). Line 2 checks for destination host 10.2.2.50 (no match). Line 3 permits any IP traffic from source 192.168.30.0/24 to any destination (MATCH).
Because lines 1 and 2 specify destination host 10.2.2.50, web traffic destined to 10.4.4.100 falls through to line 3 and is explicitly permitted.
3
Evaluate top-down matching for Telnet traffic from 192.168.30.20 to 10.2.2.50.
Line 1 matches only TCP port 443 from host 192.168.30.15 (no match). Line 2 matches all IP traffic from subnet 192.168.30.0/24 to destination host 10.2.2.50 (MATCH -> DENY).
Once a match occurs on line 2, evaluation stops immediately and the packet is dropped. Line 3 is never evaluated for this traffic.

Key Concept

Extended ACL sequential top-down rule evaluation and optimal interface placement
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic