Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is configuring an extended IPv4 access control list (ACL) named `FILTER_INTERNAL` on GigabitEthernet0/0/0 (inbound) on a Cisco IOS router. The objective is to enforce the following security policy for internal users on network 10.50.10.0/2410.50.10.0/24:

1. Allow HTTPS traffic (TCP port 443) to the DMZ web server at 172.16.100.50172.16.100.50.
2. Allow DNS domain queries (UDP port 53) to the DMZ DNS server at 172.16.100.53172.16.100.53.
3. Explicitly drop and log all other traffic from 10.50.10.0/2410.50.10.0/24 directed to any host in the DMZ subnet (172.16.100.0/24172.16.100.0/24).
4. Permit all remaining traffic originating from 10.50.10.0/2410.50.10.0/24 destined to other corporate subnets or the Internet.

Which two configuration statements or operational logic requirements must be included in the ACL design to satisfy these requirements without blocking non-DMZ traffic?

  1. An explicit statement `permit ip 10.50.10.0 0.0.0.255 any` must be placed at the end of the ACL to override the implicit deny any clause.Answer
  2. The rule `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` must be sequenced immediately after the specific HTTPS and DNS permit rules.Answer
  3. C
    The rule `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` must be placed at line 10 (top of the ACL) to ensure security policy enforcement before processing permits.
  4. D
    The explicit permit statement for remaining traffic can be omitted because IPv4 ACLs automatically permit non-matching packets if at least one deny line exists.

Answer

The correct configuration requires placing the subnet deny statement (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`) after the specific HTTPS and DNS permit entries, as well as appending an explicit `permit ip 10.50.10.0 0.0.0.255 any` at the end of the ACL.
Cisco IOS IPv4 Access Control Lists evaluate entries sequentially from top to bottom. Specific permit rules for host-level services (HTTPS and DNS) must be evaluated before broader subnet restrictions (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`). Furthermore, because every ACL terminates with an implicit `deny ip any any` rule, an explicit `permit ip 10.50.10.0 0.0.0.255 any` statement must be placed at the end of the ACL structure to allow non-DMZ traffic to pass.

Step-by-Step Solution

1
Analyze top-down sequential processing of Cisco IOS ACLs.
Specific permit lines for HTTPS (TCP 443 to 172.16.100.50172.16.100.50) and DNS (UDP 53 to 172.16.100.53172.16.100.53) must precede broad deny statements for the 172.16.100.0/24172.16.100.0/24 subnet.
If a broad subnet deny rule appears higher in the ACL sequence, matching packets are dropped before reaching lower permit statements.
2
Evaluate subnet isolation and logging requirement.
Adding `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` directly after the permit rules catches and logs any other attempt to access the DMZ network.
This explicitly satisfies requirement 3 without interfering with legitimate HTTPS/DNS flows.
3
Account for the default implicit deny behavior.
Adding `permit ip 10.50.10.0 0.0.0.255 any` at the end prevents non-DMZ traffic from being dropped.
All IPv4 Cisco ACLs end with an unwritten `deny ip any any` entry. Without an explicit permit rule at the end, all traffic to external networks or other subnets would be discarded.

Key Concept

Top-down ACL rule evaluation sequence and handling of the implicit deny any clause
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic