Examkin

Question

Difficulty: EasyAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer is configuring IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which of the following statements regarding the operation and behavior of IPv4 ACLs are correct? (Select TWO.)

  1. Standard IPv4 ACLs filter network traffic based solely on the packet source IPv4 address.Answer
  2. An implicit deny statement at the end of an IPv4 ACL automatically drops any packet that does not match an explicit permit statement.Answer
  3. C
    If a packet does not match any explicit permit line in an ACL, the router automatically permits the packet through the interface.
  4. D
    Extended IPv4 ACLs should be applied as close to the destination device as possible to preserve network bandwidth.

Answer

Standard IPv4 ACLs filter traffic based solely on the source IP address, and an implicit deny statement drops any packet that does not match an explicit permit entry.
Standard IPv4 ACLs examine only packet source IP addresses. Additionally, every IPv4 ACL includes an unwritten implicit deny clause at the end of the rule list that drops any traffic not matched by explicit permit rules.

Step-by-Step Solution

1
Analyze standard IPv4 ACL criteria
Standard IPv4 ACLs only evaluate the source IP address.
Standard ACLs (numbered 1-99 and 1300-1999) cannot inspect destination addresses or layer 4 ports.
2
Evaluate default termination behavior of IPv4 ACLs
Unmatched packets encounter an implicit deny and are dropped.
Cisco IOS enforces security by defaulting to deny all traffic that is not explicitly permitted.

Key Concept

Standard vs Extended IPv4 ACL capabilities and the implicit deny feature
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic