Examkin

Question

Difficulty: EasyAccess Control Lists (Standard and Extended IPv4 ACLs)

An administrator configures an IPv4 access control list on a router interface containing only the single entry `access-list 15 permit host 172.16.10.5`. What action will the router take when a packet originating from host 172.16.10.20 arrives on this interface?

  1. The packet is dropped because of the unwritten implicit deny statement at the end of the ACL.Answer
  2. B
    The packet is permitted because standard ACLs only drop traffic that matches an explicit deny statement.
  3. C
    The packet is forwarded to the logging buffer for administrator review before being permitted.
  4. D
    The packet is returned to the source host with an administrative block ICMP message.

Answer

The packet is dropped because of the unwritten implicit deny statement at the end of the ACL.
Every Cisco IPv4 ACL ends with an invisible implicit deny statement (`deny any`). Because the packet from host 172.16.10.20 does not match the single permit rule for host 172.16.10.5, it reaches the end of the list and is dropped.

Step-by-Step Solution

1
Evaluate the packet against the ACL entries in sequential top-down order.
The packet source IP (172.16.10.20) is compared to line 1 (permit host 172.16.10.5), resulting in no match.
Host 172.16.10.20 is not equal to 172.16.10.5.
2
Proceed to the end of the access control list when no explicit match occurs.
The packet encounters the default invisible implicit deny clause (`deny any`).
Every Cisco IOS IPv4 ACL automatically terminates with an implicit deny all traffic statement.
3
Determine final packet disposition.
The router drops the packet.
Traffic failing to match any permit statement is dropped by the implicit deny.

Key Concept

Implicit Deny Any in IPv4 Access Control Lists
Estimated Time:45s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic