Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator is deploying security controls on a Layer 3 switch interface connecting a workstation VLAN (172.20.10.0/24172.20.10.0/24) to an internal Voice over IP (VoIP) server (172.20.90.25172.20.90.25). The policy requires allowing standard SIP call signaling and RTP media streams while restricting all other communication from the workstation subnet to the VoIP server. Which of the following statements correctly describe the requirements for this Access Control List (ACL) deployment? (Select TWO.)

  1. Permit statements for SIP signaling (TCP/UDP port 5060) and RTP media traffic (UDP ports) must be evaluated before the ACL's final implicit deny statement.Answer
  2. B
    An explicit 'deny all' statement must be manually inserted as the first line of the ACL to initiate interface packet inspection.
  3. Because stateless ACLs do not track session state, return traffic for dynamically assigned RTP media stream UDP ports must be explicitly permitted or handled by stateful firewall inspection.Answer
  4. D
    Standard IPv4 ACLs placed inbound on the workstation VLAN interface should be used to filter traffic based on Layer 4 transport protocols and destination UDP port ranges.

Answer

The correct requirements are that explicit permit statements for SIP signaling and RTP media traffic must precede the implicit deny rule, and that return traffic for stateless UDP connections must be explicitly permitted or managed by a stateful inspection engine.
Extended ACLs evaluate rules in sequential top-down order until a match is found. Specific permit rules for SIP signaling and RTP media streams must be listed above the implicit deny all statement to allow traffic to pass. Furthermore, because UDP protocols like RTP do not establish TCP connection states, a stateless router ACL requires explicit return rules or a stateful firewall to allow return media traffic.

Step-by-Step Solution

1
Analyze ACL execution sequence and placement of permit/deny entries.
Recognize that ACLs execute top-down and terminate evaluation upon the first match. Permitting specific ports (SIP port 5060 and RTP UDP port ranges) must occur prior to the default implicit deny at the end of the access list.
Top-down processing means any traffic hitting a deny rule first will be dropped regardless of rules listed below it.
2
Evaluate stateless vs. stateful behavior for UDP traffic flows (SIP and RTP).
Identify that UDP is connectionless and stateless ACLs do not automatically track ephemeral port return paths.
Without stateful inspection or explicit return traffic ACL rules, two-way audio streams will fail due to blocked return packets.
3
Determine the appropriate ACL type (Standard vs. Extended) for Layer 4 port filtering.
Confirm that Standard ACLs inspect only source IP addresses and cannot perform protocol or port-based filtering.
Extended ACLs are required whenever filtering involves destination IP, protocol type (TCP/UDP), or port numbers.

Key Concept

Extended ACL Rule Processing and Stateful vs Stateless Traffic Filtering
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic