During a network maintenance window, a network administrator configures an extended Access… — CompTIA Network+

During a network maintenance window, a network administrator configures an extended Access Control List (ACL) on a Layer 3 core switch to restrict access from the Engineering VLAN subnet ( $10.120.4.0/22$ ) to the Data Center subnet ( $10.120.32.0/24$ ). Shortly after implementation, users report that while HTTP web access to an internal application server at $10.120.32.50$ is functional, secure HTTPS sessions to the same server fail to establish.

The administrator inspects the switch configuration using `show ip access-lists ENG_TO_DC` and retrieves the following output:

text
Extended IP access list ENG_TO_DC
10 permit tcp 10.120.4.0 0.0.3.255 host 10.120.32.50 eq 80
20 deny ip 10.120.4.0 0.0.3.255 10.120.32.0 0.0.0.255
30 permit tcp 10.120.4.0 0.0.3.255 host 10.120.32.50 eq 443

Which of the following identifies the root cause of the HTTPS connectivity failure?

Rule 20 explicitly denies all IP traffic directed to the Data Center subnet before Rule 30 evaluating HTTPS traffic can be processed.Answer
B
The wildcard mask 0.0.3.255 incorrectly matches host addresses outside the 10.120.4.0/22 Engineering subnet.
C
HTTPS protocol communications utilize UDP port 443, causing Rule 30 to mismatch incoming transport layer packets.
D
The default gateway drops HTTPS packets because return traffic triggers the implicit deny rule at the end of the ACL.

Answer

Rule 20 explicitly denies all IP traffic directed to the Data Center subnet before Rule 30 evaluating HTTPS traffic can be processed.

Access Control Lists process rules sequentially in numerical order. Rule 20 contains a broad block filtering all IP traffic destined for the 10.120.32.0/24 subnet. When an HTTPS packet arrives, it fails to match Rule 10 (which requires port 80), matches Rule 20, and is immediately dropped. Rule 30 is shadowed and never evaluated.

Step-by-Step Solution

Analyze the sequential processing mechanism of Access Control Lists (ACLs).

ACLs process packets top-down, stopping at the first rule that matches packet headers.

Top-down evaluation means higher-numbered sequence rules are never evaluated if a prior rule matches.

Evaluate incoming HTTPS packets against the rules in sequence.

An HTTPS packet targeting port 443 does not match Rule 10 (port 80), but matches the broad criteria of Rule 20 (deny ip 10.120.4.0 0.0.3.255 10.120.32.0 0.0.0.255).

Since 'ip' encompasses all Layer 3 payloads (including TCP), Rule 20 matches all remaining traffic to the destination subnet.

Determine the impact on Rule 30.

Rule 30 is shadowed and will receive zero packet matches.

Placing a broad deny rule above a specific permit rule creates a logical shadowing defect.

Key Concept

ACL Rule Ordering and Rule Shadowing

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic