Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

An administrator applies the following IPv4 extended named access control list (ACL) inbound on interface GigabitEthernet0/0/1 of a Cisco IOS router:

ip access-list extended FILTER_WEB
permit tcp 10.10.1.0 0.0.0.255 host 172.16.10.50 eq 80
permit tcp 10.10.1.0 0.0.0.255 host 172.16.10.50 eq 443

Which two statements accurately describe how traffic arriving on interface GigabitEthernet0/0/1 is evaluated by this ACL?

  1. HTTP traffic originating from host 10.10.1.25 and destined for server 172.16.10.50 on port 80 is permitted.Answer
  2. ICMP echo requests sent from host 10.10.1.25 to destination server 172.16.10.50 are dropped by the router.Answer
  3. C
    ICMP traffic from host 10.10.1.25 to server 172.16.10.50 is permitted because no explicit deny rule is defined in the configuration.
  4. D
    UDP DNS traffic from host 10.10.1.25 to 172.16.10.50 is forwarded because the list only restricts TCP traffic.

Answer

HTTP traffic on port 80 from subnet 10.10.1.0/24 to 172.16.10.50 is permitted by the first ACL entry, while ICMP traffic is dropped due to the implicit deny at the end of the access list.
The extended ACL explicitly allows TCP traffic on port 80 from the 10.10.1.0/24 network to destination host 172.16.10.50. Any protocol or traffic type not explicitly permitted—such as ICMP or UDP traffic—matches the implicit deny clause at the end of the ACL and is dropped by the router.

Step-by-Step Solution

1
Evaluate the explicit permit statements in the ACL configuration sequentially from top to bottom.
Rule 1 permits TCP traffic from 10.10.1.0/24 to host 172.16.10.50 on port 80. Rule 2 permits TCP traffic from 10.10.1.0/24 to host 172.16.10.50 on port 443.
Top-down sequential matching permits HTTP and HTTPS traffic matching the specified source subnet and destination host IP.
2
Evaluate non-matching traffic types (such as ICMP and UDP) against the ACL end condition.
Traffic types not matched by explicit permit statements fall through to the default implicit deny clause (deny ip any any).
All Cisco IOS ACLs end with an implicit deny all statement that drops any packet not explicitly permitted.

Key Concept

Extended IPv4 Access Control List Sequential Processing and Implicit Deny Behavior
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic