Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network security administrator is constructing a top-to-bottom Cisco IPv4 extended Access Control List (ACL) on a router interface to filter traffic moving from an internal administration subnet toward a datacenter network. Arrange the following ACL statements in the correct evaluation order from top (first statement) to bottom (last statement) so that specific security exceptions are honored without rule shadowing or unintended traffic blockage.

  1. 1permit tcp host 10.20.1.5 host 172.16.10.50 eq 443
  2. 2deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255
  3. 3permit ip 10.20.0.0 0.0.255.255 172.16.0.0 0.0.255.255
  4. 4deny ip any any

Answer

The correct sequential order of ACL statements from top to bottom is: 1) `permit tcp host 10.20.1.5 host 172.16.10.50 eq 443`, 2) `deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255`, 3) `permit ip 10.20.0.0 0.0.255.255 172.16.0.0 0.0.255.255`, and 4) `deny ip any any`.
Router Access Control Lists evaluate traffic sequentially from top to bottom based on a first-match policy. To enforce security policies correctly, specific rules (such as explicit host-to-host allowances) must be listed first, followed by specific subnet restrictions, then broad network permissions, and finally the catch-all implicit deny statement.

Step-by-Step Solution

1
Place specific host-to-host permit rules at position 1.
`permit tcp host 10.20.1.5 host 172.16.10.50 eq 443` is positioned first.
ACLs process packets sequentially using first-match logic. Specific exceptions must precede broader subnet denies to prevent rule shadowing.
2
Place specific subnet deny statements at position 2.
`deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255` is positioned second.
This restricts general access from the 10.20.1.0/2410.20.1.0/24 subnet while still allowing host 10.20.1.510.20.1.5 access due to its preceding match.
3
Place broad network permit statements at position 3.
`permit ip 10.20.0.0 0.0.255.255 172.16.0.0 0.0.255.255` is positioned third.
This allows other subnets within the 10.20.0.0/1610.20.0.0/16 range to access 172.16.0.0/16172.16.0.0/16 after specific subnet denies have been evaluated.
4
Position the implicit deny statement at position 4.
`deny ip any any` is positioned last.
Unmatched packets drop down to the final implicit deny rule.

Key Concept

ACL First-Match Processing and Rule Shadowing Prevention
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic