Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures an IPv4 extended named Access Control List (ACL) on a Cisco router interface to restrict incoming traffic as follows:

text
ip access-list extended FILTER_MGMT
permit tcp 10.2.20.0 0.0.0.255 host 172.16.100.5 eq 443
permit tcp host 10.2.20.12 host 172.16.100.5 eq 22

A technician attempts to troubleshoot network connectivity by issuing a `ping` command from host 10.2.20.2510.2.20.25 to server 172.16.100.5172.16.100.5, but all ICMP echo request packets are dropped. Which statement correctly explains why the ping traffic fails?

  1. The ACL ends with an invisible implicit deny statement that drops any traffic that does not match an explicit permit entry.Answer
  2. B
    Cisco extended ACLs process only TCP and UDP protocols, causing ICMP packets to be dropped due to an unhandled protocol type.
  3. C
    ICMP traffic is permitted by default across Cisco router interfaces unless an explicit `deny icmp any any` entry is present.
  4. D
    The wildcard mask 0.0.0.2550.0.0.255 restricts network communication strictly to port 443443, automatically blocking ICMP packets on host 10.2.20.2510.2.20.25.

Answer

The ping traffic fails because all IPv4 ACLs end with an implicit deny statement that drops any traffic not matching an explicit permit rule.
In Cisco IOS IPv4 Access Control Lists (both Standard and Extended), processing occurs sequentially from top to bottom. If a packet does not match any explicit permit statement, it hits the unwritten implicit deny clause (`deny ip any any`) at the end of the ACL. Since the ACL only contains explicit permits for TCP HTTPS and SSH traffic, ICMP echo requests from host 10.2.20.2510.2.20.25 fall through to the implicit deny and are dropped.

Step-by-Step Solution

1
Analyze the configured ACL entries sequentially.
Line 1 permits TCP port 443 traffic from subnet 10.2.20.0/24. Line 2 permits TCP port 22 traffic from host 10.2.20.12.
Sequential top-down matching occurs for incoming packets.
2
Evaluate ICMP traffic from host 10.2.20.25 against the ACL lines.
ICMP packets do not match TCP port 443 or TCP port 22.
ICMP is a Layer 3 protocol distinct from TCP.
3
Apply final ACL processing logic.
The packet falls through to the unwritten `deny ip any any` rule at the bottom of the list and is dropped.
Every Cisco IOS IPv4 access control list concludes with an implicit deny all clause.

Key Concept

ACL Sequential Processing and Implicit Deny Clause
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic