Examkin

Question

Difficulty: Very hardAccess Control Lists (Standard and Extended IPv4 ACLs)

An administrator configures the following extended IPv4 access control list on a Cisco IOS router to control traffic between subnets:

ip access-list extended SECURE_ACCESS
10 deny tcp host 192.168.10.15 host 10.1.20.10 eq 22
20 permit tcp host 192.168.10.15 10.1.20.0 0.0.0.255 eq 80
30 permit tcp host 192.168.10.15 10.1.20.0 0.0.0.255 eq 443
40 permit icmp 192.168.10.0 0.0.0.255 host 10.1.20.254 echo

The access list is applied inbound on the interface facing the 192.168.10.0/24 subnet. Which TWO statements accurately describe how traffic will be processed by this access control list?

  1. SSH traffic initiated from host 192.168.10.15 destined for host 10.1.20.10 is explicitly denied by sequence 10.Answer
  2. B
    HTTP traffic initiated from host 192.168.10.20 destined for host 10.1.20.5 is permitted because sequence 20 permits web traffic for the entire source subnet.
  3. ICMP echo requests sent from host 192.168.10.50 destined for host 10.1.20.10 are dropped due to the implicit deny at the end of the access list.Answer
  4. D
    ICMP echo requests sent from host 192.168.10.50 destined for host 10.1.20.10 are permitted because Cisco access control lists default to permitting unlisted IPv4 traffic unless an explicit deny line is configured.

Answer

The correct statements are that SSH traffic from host 192.168.10.15 to host 10.1.20.10 is explicitly denied by sequence 10, and ICMP echo requests from host 192.168.10.50 to host 10.1.20.10 are dropped due to the implicit deny clause.
SSH packets from 192.168.10.15 to 10.1.20.10 hit sequence 10 directly and are denied. Meanwhile, ICMP echo requests from 192.168.10.50 to 10.1.20.10 fail to match sequence 40 (which restricts the destination to 10.1.20.254) and are consequently dropped by the implicit deny at the end of the ACL.

Step-by-Step Solution

1
Analyze sequence 10: 'deny tcp host 192.168.10.15 host 10.1.20.10 eq 22'
Matches TCP traffic originating from IP 192.168.10.15 destined for IP 10.1.20.10 on port 22 (SSH). This packet matches the first statement and is immediately denied.
Cisco ACLs process statements sequentially from top to bottom and stop at the first matching entry.
2
Analyze HTTP traffic from host 192.168.10.20 to 10.1.20.5 against sequence 20: 'permit tcp host 192.168.10.15 10.1.20.0 0.0.0.255 eq 80'
The source address is constrained by the 'host' keyword to 192.168.10.15 only. Host 192.168.10.20 does not match.
The 'host' modifier specifies a single IP address (/32 equivalent), not an entire subnet.
3
Analyze ICMP traffic from host 192.168.10.50 to 10.1.20.10 against sequence 40: 'permit icmp 192.168.10.0 0.0.0.255 host 10.1.20.254 echo'
Although the source subnet matches, the destination host is explicitly set to host 10.1.20.254. Traffic directed to 10.1.20.10 fails sequence 40.
Both source and destination criteria in an extended ACL statement must match for the rule to take effect.
4
Determine final ACL evaluation outcome for unmatched traffic
All packets that pass through sequence lines 10–40 without a match hit the default implicit 'deny ip any any' at the end of the ACL and are dropped.
Every IPv4 ACL in Cisco IOS has an unwritten implicit deny entry at the end of its structure.

Key Concept

Extended Access Control List Sequential Processing and Implicit Deny Mechanics
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic