A network security policy requires allowing database traffic to a server while restricting other communications. An engineer applies the following named extended IPv4 Access Control List (ACL) inbound on interface GigabitEthernet0/0/1 of a Cisco router:
text
ip access-list extended RESTRICT_DB
permit tcp 10.20.10.0 0.0.0.255 host 10.20.30.50 eq 1433
deny ip 10.20.10.0 0.0.0.255 host 10.20.30.50
Users on subnet report that they cannot reach a web server located at over HTTP (TCP port 80). Which statement explains why the router drops the HTTP traffic destined for ?
- The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.Answer
- BThe second rule contains a wildcard mask of 0.0.0.255 that blocks access to the entire 10.20.30.0/24 destination subnet.
- CThe router processes the deny statement before evaluating the permit statement due to named ACL priority rules.
- DExtended ACLs applied inbound on an interface are only capable of filtering traffic destined for hosts on that local interface.
Answer
The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.
Cisco IOS IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any explicit permit or deny statement in the list, it hits the invisible implicit deny statement (`deny ip any any`) at the end of the ACL and is dropped. Since HTTP traffic to matches neither line 1 (which targets ) nor line 2 (which targets host ), it is dropped by the implicit deny.
Step-by-Step Solution
Key Concept
ACL Sequential Evaluation and Implicit Deny Any