Question

A network administrator is configuring an extended IPv4 Access Control List (ACL) on a router interface to control traffic from the client workstation subnet ($172.16.10.0/24$) targeting the corporate server farm subnet ($10.5.0.0/24$). The security policy specifies the following requirements for traffic destined for the database server ($10.5.0.20$) and the rest of the server farm:

1. SSH administrative access (TCP port 22) to host $10.5.0.20$ must be permitted ONLY from the primary administrator workstation at IP address $172.16.10.5$.
2. All other SSH traffic (TCP port 22) to host $10.5.0.20$ originating from subnet $172.16.10.0/24$ must be explicitly blocked.
3. All non-SSH TCP traffic from subnet $172.16.10.0/24$ to host $10.5.0.20$ must be permitted.
4. Non-TCP IP traffic from subnet $172.16.10.0/24$ to host $10.5.0.20$ must be blocked.
5. All IP traffic from subnet $172.16.10.0/24$ to all other servers in subnet $10.5.0.0/24$ must be permitted.

In what top-to-bottom sequential order must the ACL entries be placed on the interface to enforce this security policy without rule shadowing?