Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator is creating an inbound IPv4 extended Access Control List (ACL) on a router interface to filter traffic from the internal management subnet (192.168.10.0/24192.168.10.0/24) heading toward a DMZ web server (172.16.50.10172.16.50.10). The policy requires allowing secure HTTPS access specifically for management workstation 192.168.10.45192.168.10.45, allowing general HTTP traffic from the entire internal subnet to the web server, logging any other blocked attempts from the internal subnet to the DMZ subnet (172.16.50.0/24172.16.50.0/24), and relying on standard firewall drop behavior for remaining traffic. Arrange the following ACL entries in the correct top-to-bottom sequence to ensure proper evaluation without rule shadowing.

  1. 1access-list 105 permit tcp host 192.168.10.45 host 172.16.50.10 eq 443
  2. 2access-list 105 permit tcp 192.168.10.0 0.0.0.255 host 172.16.50.10 eq 80
  3. 3access-list 105 deny ip 192.168.10.0 0.0.0.255 172.16.50.0 0.0.0.255 log
  4. 4access-list 105 deny ip any any

Answer

The correct sequence places the specific host HTTPS permit rule first, followed by the subnet HTTP permit rule, then the logged subnet-to-DMZ deny rule, and finally the catch-all deny rule.
Access Control Lists evaluate rules sequentially from top to bottom until the first matching rule is found. To function correctly, rules must be organized from most specific to most general: first the host-specific permit rule, then the subnet-wide permit rule for specific ports, followed by an explicit subnet deny with logging, and ending with the default catch-all deny rule.

Step-by-Step Solution

1
Identify the most specific matching criteria requiring priority.
The rule for host 192.168.10.45192.168.10.45 requesting HTTPS (TCP port 443) access must come first to prevent broader subnet rules from matching it prematurely.
Sequential top-down processing in ACLs means broader subnet rules placed above specific host rules will shadow the host-specific policy.
2
Place broader subnet permit rules for specific protocols.
The rule allowing HTTP (TCP port 80) from subnet 192.168.10.0/24192.168.10.0/24 to web server 172.16.50.10172.16.50.10 comes second.
This allows general HTTP traffic while remaining below host-level entries.
3
Position explicit subnet-level deny and logging rules.
The explicit deny rule for all remaining IP traffic from 192.168.10.0/24192.168.10.0/24 to 172.16.50.0/24172.16.50.0/24 with logging is placed third.
Explicit deny statements with the 'log' keyword must follow permitted traffic so legitimate access is not dropped, while capturing unauthorized attempts between these subnets.
4
Place the final default implicit deny rule at the bottom.
The statement denying any remaining IP traffic completes the list.
Standard ACL best practices mandate ending the evaluation chain with a default deny statement.

Key Concept

Access Control List (ACL) sequential rule order and rule shadowing prevention
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic