A network engineer configures the following IPv4 extended named access control list (ACL) … — Cisco CCNA

A network engineer configures the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to filter traffic between host $10.20.5.15$ and web server $192.168.100.50$ :

text
ip access-list extended SECURE_VLAN
deny icmp host 10.20.5.15 host 192.168.100.50
permit tcp host 10.20.5.15 host 192.168.100.50 eq 80
permit tcp host 10.20.5.15 host 192.168.100.50 eq 443

Which two statements accurately describe the traffic filtering behavior enforced by this ACL? (Choose two.)

ICMP packets sent from host $10.20.5.15$ targeting server $192.168.100.50$ are explicitly dropped by the first entry.Answer
B
SSH traffic (TCP port $22$ ) sent from host $10.20.5.15$ to server $192.168.100.50$ is permitted because only ICMP traffic is explicitly denied.
UDP traffic originating from host $10.20.5.15$ bound for server $192.168.100.50$ is dropped due to the implicit deny clause at the end of the ACL.Answer
D
Return HTTP traffic originating from server $192.168.100.50$ back to host $10.20.5.15$ matches and is permitted by the second ACL statement.

Answer

The statement identifying that ICMP packets are explicitly dropped by the first entry and the statement noting that UDP traffic is dropped by the implicit deny clause are both correct.

The first entry in the ACL explicitly denies ICMP packets sent from host

10.20.5.15

to host

192.168.100.50

. Additionally, because Cisco IPv4 ACLs automatically append an unwritten implicit deny clause (`deny ip any any`) at the end of the evaluation list, any protocol not explicitly permitted—such as UDP—is automatically dropped.

Step-by-Step Solution

Evaluate the first ACL statement against ICMP traffic

Statement 'deny icmp host 10.20.5.15 host 192.168.100.50' matches ICMP packets from host 10.20.5.15 to 192.168.100.50 and explicitly denies them.

Top-down ACL processing stops at the first matching rule.

Evaluate unlisted traffic types such as UDP or non-web TCP (e.g. port 22)

Unlisted traffic types do not match statements 1, 2, or 3 and hit the default 'deny ip any any' rule at the bottom.

All Cisco IOS ACLs end with an invisible implicit deny clause.

Evaluate directionality for return traffic originating from server 192.168.100.50

Return traffic has source 192.168.100.50 and destination 10.20.5.15, failing to match the source/destination fields of the permit rules.

Standard and Extended ACL statements evaluate traffic directional fields strictly as defined.

Key Concept

Top-down sequential processing and implicit deny clause evaluation in IPv4 Extended ACLs

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic