Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

An inbound IPv4 extended Access Control List (ACL) named SECURE_IN is applied to interface GigabitEthernet0/1 on a Cisco router with the following configuration:

ip access-list extended SECURE_IN
10 permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.100 eq 80
20 permit tcp host 172.16.10.15 192.168.1.0 0.0.0.255 eq 22
30 permit ip host 172.16.10.20 192.168.1.0 0.0.0.255

A host with IPv4 address 172.16.10.15172.16.10.15 sends a packet destined for 192.168.1.100192.168.1.100 targeting TCP port 443 (HTTPS). What action will the router take when processing this packet?

  1. The router drops the packet because it fails to match any explicit permit statement and is caught by the implicit deny clause.Answer
  2. B
    The router permits the packet because line 10 matches both the source subnet 172.16.10.0/24 and the target host 192.168.1.100.
  3. C
    The router permits the packet because line 20 explicitly allows traffic originating from source host 172.16.10.15 to the destination subnet 192.168.1.0/24.
  4. D
    The router forwards the packet because Cisco IPv4 ACLs permit all unlisted IP traffic by default when no explicit deny rule is matched.

Answer

The router drops the packet because it fails to match any explicit permit statement and is caught by the implicit deny clause.
Extended ACLs are processed sequentially from top to bottom. Each rule requires matching all specified criteria, including source/destination IP parameters and protocol port numbers. Because the packet on TCP port 443 fails to match lines 10, 20, and 30, it encounters the implicit 'deny ip any any' at the end of the ACL and is dropped.

Step-by-Step Solution

1
Evaluate line 10 against the incoming packet parameters.
Line 10 permits TCP traffic from 172.16.10.0/24 to host 192.168.1.100 on port 80. The packet uses port 443, so line 10 does not match.
Extended ACLs require all specified layer 3 and layer 4 conditions to match.
2
Evaluate line 20 against the incoming packet parameters.
Line 20 permits TCP traffic from host 172.16.10.15 to subnet 192.168.1.0/24 on port 22. The packet uses port 443, so line 20 does not match.
Port 443 (HTTPS) does not match port 22 (SSH).
3
Evaluate line 30 against the incoming packet parameters.
Line 30 permits IP traffic from host 172.16.10.20 to subnet 192.168.1.0/24. The packet source is 172.16.10.15, so line 30 does not match.
The specific source host IP address specified in line 30 does not match 172.16.10.15.
4
Apply the implicit ACL processing behavior at the end of the list.
The packet is dropped.
All Cisco IPv4 ACLs conclude with an unwritten, implicit 'deny ip any any' statement.

Key Concept

Top-down sequential evaluation of Extended IPv4 ACLs and the implicit deny clause
Estimated Time:1m 30s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic