Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is configuring an IPv4 extended named access control list (ACL) on a Cisco router interface to implement security controls for the host subnet 10.50.1.0/2410.50.1.0/24. The ACL must satisfy the following traffic policies:

1. Allow ICMP echo requests from 10.50.1.0/2410.50.1.0/24 strictly to the default gateway at 10.50.1.110.50.1.1.
2. Allow HTTPS access from 10.50.1.0/2410.50.1.0/24 to the internal application server at 192.168.20.45192.168.20.45.
3. Explicitly deny all other IPv4 traffic originating from 10.50.1.0/2410.50.1.0/24 destined to the internal server subnet 192.168.20.0/24192.168.20.0/24.
4. Permit all remaining outbound traffic from 10.50.1.0/2410.50.1.0/24 to any other network destination.

Which two ACL entries must be placed in the access list to achieve this exact behavior without blocking general Internet access? (Select two.)

  1. permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443Answer
  2. permit ip 10.50.1.0 0.0.0.255 anyAnswer
  3. C
    deny ip 10.50.1.0 0.0.0.255 any
  4. D
    permit ip 10.50.1.0 0.0.0.255 192.168.20.0 0.0.0.255

Answer

The correct options are 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' and 'permit ip 10.50.1.0 0.0.0.255 any'.
The correct configuration requires allowing TCP port 443 traffic to the specific host 192.168.20.45 first. Following the explicit block of all other IP traffic to 192.168.20.0/24, an explicit permit ip entry from the source network to 'any' destination is mandatory to prevent the default implicit deny clause from blocking general Internet and external traffic.

Step-by-Step Solution

1
Analyze extended ACL processing order rules.
Cisco IOS ACLs process entries sequentially from top to bottom until the first match occurs.
Specific permit rules must precede broader deny rules to ensure target traffic is allowed.
2
Construct the rule for HTTPS access to the application server.
The entry 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' correctly permits SSL/TLS traffic to port 443 of the target server.
Requirements demand permitting HTTPS specifically to 192.168.20.45.
3
Address general outbound connectivity while maintaining subnet restrictions.
After specifying 'deny ip 10.50.1.0 0.0.0.255 192.168.20.0 0.0.0.255', the rule 'permit ip 10.50.1.0 0.0.0.255 any' must be appended.
Without an explicit permit statement at the end of the ACL, the invisible default 'implicit deny ip any any' clause drops all traffic destined for other locations.

Key Concept

ACL Sequential Evaluation and Implicit Deny Handling
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic