Examkin

Question

Difficulty: Very hardFirewalls and Access Control Lists (ACLs)

A network security team is deploying an extended stateless IPv4 Access Control List (ACL) on an egress router interface filtering traffic between an internal database server (10.50.10.25/2410.50.10.25/24) and external application servers (172.16.100.0/24172.16.100.0/24). The application servers initiate database connections to TCP port 54325432 (PostgreSQL), and the database server is configured to send automated diagnostic alerts to an external syslog server at 172.16.100.50172.16.100.50 listening on UDP port 514514. Which TWO configuration entries or operational requirements must be implemented on the stateless egress ACL to guarantee bidirectional application communication and outbound alerting? (Select TWO.)

  1. Permit outbound TCP traffic from host 10.50.10.25 source port 5432 to 172.16.100.0/24 with TCP control flags set to permit return query responses.Answer
  2. Permit outbound UDP traffic from host 10.50.10.25 to destination host 172.16.100.50 on destination port 514.Answer
  3. C
    Omit an explicit outbound rule for UDP syslog traffic, relying on the default ACL implicit permit statement at the end of the access list.
  4. D
    Configure the outbound syslog permit entry to match TCP destination port 514 to allow the stateless router to establish connection state.

Answer

To allow communication through a stateless router ACL, explicit outbound rules must be created: one allowing return TCP responses from source port 5432 with TCP control flags (ACK/established) set, and one allowing outbound UDP syslog traffic from the database server to destination IP 172.16.100.50 on destination UDP port 514.
Because stateless ACLs do not automatically track session state, return traffic from TCP port 5432 must be explicitly permitted using TCP flag matching (ACK/established). Additionally, UDP syslog traffic originating from the server targeting destination port 514 requires an explicit permit statement due to the implicit deny at the end of the ACL.

Step-by-Step Solution

1
Analyze the stateless filtering behavior for connection-oriented TCP traffic.
Unlike stateful firewalls, stateless router ACLs do not maintain a connection table. When an external host connects to TCP port 5432, return packets originating from the database server (source port 5432) require an explicit outbound ACL rule matching the TCP ACK or established flag.
Without an explicit return rule for source port 5432 with TCP control flags, return database traffic will be dropped by the ACL.
2
Analyze the stateless filtering behavior for connectionless UDP traffic.
Syslog traffic transmitted from the database server to the logging server at 172.16.100.50 uses connectionless UDP port 514. An explicit permit rule matching destination UDP port 514 is necessary.
Because UDP has no handshakes or connection states, stateless devices require a simple direction-specific match rule for destination UDP port 514.
3
Evaluate default ACL behavior and protocol definitions.
Standard ACLs end with an implicit deny all statement (`deny ip any any`), so unpermitted traffic is blocked. Standard Syslog uses UDP rather than TCP.
Confusing implicit deny rules or protocol types (TCP vs UDP) causes security rule misconfigurations.

Key Concept

Stateless ACL rules require bidirectional explicit definitions, using TCP control flag matching for TCP return flows and specific UDP port permitting for connectionless logging.
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic