A network security administrator needs to restrict hosts in the Finance VLAN () from accessing an internal accounting web server () over port 80 (HTTP), while allowing all other network traffic between the subnets. The administrator configures a standard IPv4 Access Control List (`access-list 10 deny 10.50.10.0 0.0.0.255`) and applies it inbound on the router interface servicing the Finance VLAN.
Which statement best describes the outcome of this deployment?
- Standard Access Control Lists filter traffic based solely on source IP address, resulting in all IP traffic from the Finance VLAN being blocked rather than only HTTP access to the target server.Answer
- BThe rule successfully permits all non-HTTP traffic because standard ACLs automatically append an implicit permit statement for unlisted destination ports.
- CThe filter fails because standard ACLs operate strictly at OSI Layer 2 and cannot inspect Layer 3 IP address headers on router interfaces.
- DThe configuration fails because restricting specific host access requires static NAT overload to map the HTTP port to an external address before ACL processing.
Answer
Standard Access Control Lists filter traffic based solely on source IP address, resulting in all IP traffic from the Finance VLAN being blocked rather than only HTTP access to the target server.
Standard Access Control Lists only inspect the source IPv4 address in the packet header. Consequently, they cannot differentiate between traffic types (such as HTTP port 80 vs HTTPS port 443) or target destination IP addresses. Denying the source subnet in a standard ACL blocks all outbound IP communications from that subnet.
Step-by-Step Solution
Key Concept
Standard vs. Extended Access Control Lists (ACLs)