Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network security administrator must configure an IPv4 Access Control List (ACL) on a router to enforce network security policies for the internal subnet 172.16.10.0/24172.16.10.0/24. Place the following ACL rules in the correct top-to-bottom sequence so that host-specific restrictions are properly enforced without being shadowed by broader subnet rules.

  1. 1deny tcp host 172.16.10.5 host 192.168.1.50 eq 443
  2. 2permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 443
  3. 3permit icmp 172.16.10.0 0.0.0.255 192.168.1.0 0.0.0.255 echo
  4. 4deny ip any any

Answer

The correct top-to-bottom sequence is: 1) deny tcp host 172.16.10.5 host 192.168.1.50 eq 443, 2) permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 443, 3) permit icmp 172.16.10.0 0.0.0.255 192.168.1.0 0.0.0.255 echo, 4) deny ip any any.
Access Control Lists operate sequentially using first-match logic. Specific rules (such as blocking host 172.16.10.5) must be placed at the top of the list. Placing a general subnet permit rule above a specific host deny rule causes rule shadowing, where traffic matches the subnet permit first and the host block is never evaluated. Finally, general protocol permissions follow, and the catch-all deny rule resides at the very end.

Step-by-Step Solution

1
Identify specific host exceptions requiring explicit denial.
Position host-specific deny rule (deny tcp host 172.16.10.5 host 192.168.1.50 eq 443) at the very top of the list.
ACLs perform top-down evaluation and stop checking rules on the first match. Placed lower, a broader permit statement would grant access unintentionally (rule shadowing).
2
Place general application traffic permits for the wider subnet.
Position the subnet permit rule (permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 443) immediately below the specific host deny.
This allows all authorized hosts in the 172.16.10.0/24 subnet to reach the HTTPS server while still enforcing the preceding host block.
3
Add auxiliary protocol permit rules.
Position ICMP Echo permit rules (permit icmp 172.16.10.0 0.0.0.255 192.168.1.0 0.0.0.255 echo) below key application permissions.
This enables diagnostic traffic across subnets without overriding specific application access controls.
4
Ensure global catch-all drop functionality.
Place explicit or implicit default deny (deny ip any any) at the bottom.
All unallowed traffic must be systematically dropped at the end of the ACL processing chain.

Key Concept

ACL First-Match Processing and Rule Shadowing
Estimated Time:1m 30s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic