Examkin

Question

Difficulty: EasyAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator applies a standard IPv4 access control list containing a single line, `access-list 10 permit 192.168.1.0 0.0.0.255`, to a router interface. What happens to incoming packets originating from host 10.0.0.5?

  1. The packets are dropped due to the implicit deny statement at the end of the access list.Answer
  2. B
    The packets are permitted because access lists permit all unlisted traffic by default.
  3. C
    The packets are permitted because there is no explicit deny statement configured in the list.
  4. D
    The packets are forwarded to the default gateway interface for further ACL evaluation.

Answer

The packets are dropped due to the implicit deny statement at the end of the access list.
In Cisco IOS IPv4 Access Control Lists, an unwritten 'implicit deny' statement exists at the end of every list. Any traffic that does not match one of the explicit permit statements will be dropped by default when it reaches the end of the ACL.

Step-by-Step Solution

1
Evaluate the incoming packet source address against the ACL statements.
The packet source IP 10.0.0.5 is compared against the first entry: `permit 192.168.1.0 0.0.0.255`.
ACL entries are processed sequentially from top to bottom.
2
Determine if the packet matches the explicit entry.
Host 10.0.0.5 does not belong to the 192.168.1.0/24 network, so it does not match.
The wildcard mask 0.0.0.255 restricts matching strictly to the 192.168.1.0/24 subnet.
3
Apply the default action at the end of the list.
The packet hits the invisible `deny ip any any` (or `deny any`) statement at the bottom of the ACL and is dropped.
Every Cisco IPv4 ACL automatically ends with an implicit deny all clause.

Key Concept

Implicit Deny Clause in Cisco IPv4 ACLs
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic