A network security administrator must construct an extended IPv4 Access Control List (ACL)… — CompTIA Network+

A network security administrator must construct an extended IPv4 Access Control List (ACL) on an ingress router interface serving the internal subnet $10.50.10.0/24$ . The ACL must enforce five security requirements using first-match evaluation logic without rule shadowing:

1. Quarantine host $10.50.10.45$ by blocking all of its outbound traffic.
2. Allow database administrative hosts in the $10.50.10.0/26$ subnet to access a central database server at $192.168.100.50$ on TCP port $3306$ .
3. Deny all other hosts in $10.50.10.0/24$ access to any server in the $192.168.100.0/24$ network.
4. Permit all remaining hosts in $10.50.10.0/24$ to access external web servers on TCP port $443$ .
5. Explicitly deny and log all unapproved IPv4 traffic originating from $10.50.10.0/24$ .

Arrange the given ACL statements in the correct top-to-bottom sequential order (from index $10$ to $50$ ) to fulfill these security requirements accurately.

1`access-list 105 deny ip host 10.50.10.45 any`
2`access-list 105 permit tcp 10.50.10.0 0.0.0.63 host 192.168.100.50 eq 3306`
3`access-list 105 deny ip 10.50.10.0 0.0.0.255 192.168.100.0 0.0.0.255`
4`access-list 105 permit tcp 10.50.10.0 0.0.0.255 any eq 443`
5`access-list 105 deny ip 10.50.10.0 0.0.0.255 any log`

Answer

The correct top-to-bottom sequence of ACL rules is: 1) deny ip host 10.50.10.45 any, 2) permit tcp 10.50.10.0 0.0.0.63 host 192.168.100.50 eq 3306, 3) deny ip 10.50.10.0 0.0.0.255 192.168.100.0 0.0.0.255, 4) permit tcp 10.50.10.0 0.0.0.255 any eq 443, 5) deny ip 10.50.10.0 0.0.0.255 any log.

Access Control Lists process packets in strict top-to-bottom order until a matching entry is found. To achieve the required policy: 1) The compromised host block `deny ip host 10.50.10.45 any` must be top-ranked to override all permits. 2) The specific database permission `permit tcp 10.50.10.0 0.0.0.63 host 192.168.100.50 eq 3306` must precede the subnet deny rule to avoid being shadowed. 3) The general server network block `deny ip 10.50.10.0 0.0.0.255 192.168.100.0 0.0.0.255` must precede broad web permits. 4) The outbound web rule `permit tcp 10.50.10.0 0.0.0.255 any eq 443` allows remaining internet access. 5) The explicit logging rule `deny ip 10.50.10.0 0.0.0.255 any log` records unauthorized attempts before the default implicit deny.

Step-by-Step Solution

Identify host-specific override rules.

Host

10.50.10.45

is contained within subnet

10.50.10.0/26

. To prevent any traffic from this host from hitting broader permit rules, the explicit host deny statement `deny ip host 10.50.10.45 any` must be placed at the top (Line 10).

Sequential ACL evaluation stops at the first matching rule. Broader permit rules positioned above host blocks cause security bypasses.

Place specific subset permissions above broader network blocks.

The rule `permit tcp 10.50.10.0 0.0.0.63 host 192.168.100.50 eq 3306` permits TCP

3306

from the

/26

subnet to the database server. This must be evaluated before blocking the entire

192.168.100.0/24

destination subnet.

If a general deny for

192.168.100.0/24

is placed above this permit statement, database management traffic will be shadowed and blocked.

Place general network blocks before general outbound permissions.

Position `deny ip 10.50.10.0 0.0.0.255 192.168.100.0 0.0.0.255` third to prevent all other host communication between

10.50.10.0/24

and

192.168.100.0/24

Ensures no unapproved destination IP within

192.168.100.0/24

receives traffic from

10.50.10.0/24

, even on port

443

Position broad service permits after security restriction blocks.

Place `permit tcp 10.50.10.0 0.0.0.255 any eq 443` fourth to allow secure web traffic outbound.

Allows outbound web traffic to external destinations while preserving the internal subnet restriction configured in Step 3.

Place explicit logging deny statements at the end.

Place `deny ip 10.50.10.0 0.0.0.255 any log` fifth.

Captures and logs all unapproved packets from

10.50.10.0/24

before hitting the implicit deny all entry at the end of the ACL.

Key Concept

First-Match Rule Processing and Shadowing Prevention in Extended IPv4 ACLs

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic