Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures an extended IPv4 access control list (ACL 102) on a Cisco IOS router to restrict traffic from the internal LAN subnet 172.16.10.0/24172.16.10.0/24 to an external server at IP address 192.168.50.10192.168.50.10. The administrator enters the following CLI commands:

`access-list 102 permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 80`
`access-list 102 permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 443`

After applying ACL 102 inbound on interface GigabitEthernet0/0, users report that HTTP and HTTPS access to 192.168.50.10192.168.50.10 works properly, but all DNS resolution queries to an internal server at 172.16.10.2172.16.10.2 and internet browsing to other hosts are failing. Which statement correctly explains why all other traffic originating from the internal subnet is being blocked?

  1. The router processes traffic sequentially and drops all unlisted traffic due to the implicit deny clause located at the end of the access control list.Answer
  2. B
    Unlisted traffic is dropped because an extended ACL requires an explicit 'deny ip any any' line to be configured before any non-matching packets can be evaluated.
  3. C
    The wildcard mask 0.0.0.255 restricts access strictly to host 172.16.10.0, causing packets from all other hosts in the subnet to be dropped by the permit statements.
  4. D
    Applying an extended ACL inbound on a LAN interface automatically blocks local intra-subnet communications between hosts on the same physical switch.

Answer

The router evaluates traffic against ACL 102 sequentially from top to bottom and drops all unlisted packets because of the invisible implicit deny clause ('deny ip any any') appended at the end of every IPv4 ACL.
In Cisco IOS networking, all standard and extended IPv4 Access Control Lists end with an invisible 'implicit deny' statement (conceptually `deny ip any any`). Packets entering an interface with an applied ACL are compared against statements top-down. Because ACL 102 only explicitly permits TCP ports 80 and 443 to host 192.168.50.10192.168.50.10, all other traffic—including DNS (UDP port 53) and traffic destined for other IP addresses—reaches the end of the ACL and is dropped by the implicit deny rule.

Step-by-Step Solution

1
Analyze the configured access list statements
ACL 102 explicitly permits only TCP destination port 80 (HTTP) and TCP destination port 443 (HTTPS) traffic from source 172.16.10.0/24172.16.10.0/24 to destination 192.168.50.10192.168.50.10.
Top-down ACL evaluation checks each incoming packet against these two rules first.
2
Evaluate how non-HTTP/HTTPS traffic is handled
DNS queries (UDP/TCP port 53) and general IP traffic destined for other IP addresses do not match either of the explicit permit statements.
When no explicit permit statement matches a packet, processing reaches the end of the access list.
3
Apply Cisco IOS default ACL behavior
All non-matching traffic is dropped by the unwritten implicit deny clause ('deny ip any any').
To allow other traffic, explicit permit statements (such as 'permit ip any any' or specific service permits) must be configured.

Key Concept

Implicit Deny Clause in IPv4 ACLs
Estimated Time:1m 30s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic