Examkin

Question

Difficulty: HardFirewalls and Access Control Lists (ACLs)

A security analyst is auditing an edge router configured with stateless Access Control Lists (ACLs) to filter traffic between an internal management subnet (10.200.5.0/2410.200.5.0/24) and a cloud monitoring cluster (172.31.40.0/24172.31.40.0/24). The analyst notes that SNMP monitoring requests sent over UDP port 161 from the cloud cluster to internal endpoints pass successfully, but the response packets generated by the internal endpoints fail to reach the monitoring cluster.

Which TWO of the following statements correctly explain why this issue occurs and identify an appropriate resolution?

  1. Stateless ACLs evaluate packets individually without tracking connection state, requiring an explicit reverse ACL rule to permit return UDP traffic from source port 161 back to the monitoring cluster.Answer
  2. Migrating the filtering mechanism to a stateful firewall would resolve the issue because stateful inspection dynamically allows return traffic by referencing an entry created in its state table during outbound transmission.Answer
  3. C
    Deleting the implicit deny statement at the end of the stateless ACL automatically allows returning response packets to pass without adding specific permit statements.
  4. D
    Implementing Layer 2 MAC address filtering on the router interface enables automatic deep packet inspection to track UDP payload sessions across subnets.

Answer

The issue occurs because stateless ACLs inspect packets individually without maintaining connection tables, requiring an explicit reverse permit rule for returning traffic. Alternatively, replacing the stateless ACL with a stateful firewall resolves the issue by dynamically tracking sessions and automatically permitting return packets matching an active state table entry.
Stateless ACLs evaluate every packet independently without storing state history. Consequently, permitting outbound queries from a monitoring cluster does not automatically permit the response packets returning from internal hosts; an explicit reverse ACL entry is required to allow traffic flowing back. Alternatively, deploying a stateful firewall resolves this limitation because stateful devices monitor communication flows and dynamically permit return packets corresponding to active session entries.

Step-by-Step Solution

1
Analyze the filtering architecture
Identified that the edge router uses stateless Access Control Lists (ACLs).
Stateless devices treat every packet as an independent event and do not keep memory of previous packets or established connections.
2
Evaluate why return packets are dropped
Outbound SNMP queries from 172.31.40.0/24172.31.40.0/24 to 10.200.5.0/2410.200.5.0/24 match an outbound permit rule, but returning response traffic moving in the opposite direction hits the implicit deny rule because no matching inbound rule exists.
Stateless ACLs require symmetric, bidirectional rule definitions for bidirectional communication.
3
Determine valid remediation approaches
Two solutions exist: (1) Add an explicit reverse ACL rule for return traffic, or (2) replace the stateless ACL with a stateful firewall.
Stateful firewalls maintain connection tables (even creating pseudo-state entries for UDP flows) to dynamically permit returning response packets.

Key Concept

Stateless vs. Stateful Packet Filtering and ACL Directionality
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic