Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is designing an IPv4 security policy and placing Access Control Lists (ACLs) across a corporate router topology. Which two statements accurately describe the operational characteristics and default behaviors of Cisco IPv4 ACLs? (Select two.)

  1. Standard IPv4 ACLs inspect only the source IPv4 address of packets and should generally be applied as close to the destination as possible.Answer
  2. Traffic that does not match any explicit permit or deny entry in an ACL is dropped by an invisible implicit deny statement at the end of the list.Answer
  3. C
    If a packet matches an explicit permit rule near the top of an ACL, the router continues evaluating subsequent rules to ensure there are no conflicting deny statements.
  4. D
    Applying an ACL with only explicit permit statements to an interface allows all unlisted traffic to pass through uninspected.
  5. E
    Extended IPv4 ACLs use the standard numbered range of 1–99 and evaluate source IP, destination IP, and Layer 4 port numbers.

Answer

The correct statements are that standard IPv4 ACLs inspect only the source IPv4 address and should be placed close to the destination, and that unlisted traffic is dropped by the implicit deny statement at the end of the ACL.
Standard IPv4 ACLs evaluate only source IPv4 addresses, making destination-adjacent placement critical to prevent dropping traffic meant for other subnets. Furthermore, every Cisco IPv4 ACL features an unwritten implicit deny clause at the end of its list, which drops any packet that fails to match an explicit entry.

Step-by-Step Solution

1
Analyze standard IPv4 ACL filtering capabilities and placement guidelines.
Standard IPv4 ACLs filter strictly on source IPv4 addresses. Because they cannot filter on destination IP or ports, placing them close to the destination avoids prematurely dropping traffic intended for other routes.
Correct placement prevents unintended traffic filtering across the network topology.
2
Analyze ACL rule evaluation logic and final default action.
ACL statements are processed sequentially from top to bottom. If no explicit permit or deny rule matches a packet, it hits the implicit deny statement ('deny ip any any') at the end of the ACL and is dropped.
Understanding the implicit deny prevents accidental blocking of legitimate network traffic.

Key Concept

Standard IPv4 ACL Characteristics and Implicit Deny Behavior
Estimated Time:1m 30s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic