Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator needs to restrict administrative access to a managed switch located at IP address 10.20.30.210.20.30.2. Only the administrator's workstation at IP address 10.20.30.1510.20.30.15 must be allowed to establish Secure Shell (SSH) management sessions with the switch. All other SSH attempts to the switch must be blocked, while all other non-SSH IP traffic across the subnet must continue to traverse the interface uninhibited.

Which set of extended IPv4 Access Control List (ACL) statements correctly fulfills this security requirement?

  1. A
    statement 1: permit udp host 10.20.30.15 host 10.20.30.2 eq 22
    statement 2: deny udp any host 10.20.30.2 eq 22
    statement 3: permit ip any any
  2. statement 1: permit tcp host 10.20.30.15 host 10.20.30.2 eq 22
    statement 2: deny tcp any host 10.20.30.2 eq 22
    statement 3: permit ip any any    Answer
  3. C
    statement 1: permit tcp host 10.20.30.15 host 10.20.30.2 eq 23
    statement 2: deny tcp any host 10.20.30.2 eq 23
    statement 3: permit ip any any
  4. D
    statement 1: permit tcp host 10.20.30.15 host 10.20.30.2 eq 22
    statement 2: deny tcp any host 10.20.30.2 eq 22

Answer

The correct configuration permits TCP port 22 traffic from host 10.20.30.15 to host 10.20.30.2, denies TCP port 22 traffic from any host to host 10.20.30.2, and permits all remaining IP traffic using 'permit ip any any'.
The correct configuration properly identifies SSH as using TCP on port 22, creates an explicit entry granting access to the administrator's IP address (10.20.30.1510.20.30.15), denies SSH access to all other hosts, and concludes with 'permit ip any any' to allow all non-SSH traffic across the interface without triggering the default implicit deny.

Step-by-Step Solution

1
Identify the transport layer protocol and destination port required for Secure Shell (SSH).
SSH operates over TCP using port number 22.
Correct protocol matching requires specifying TCP port 22 rather than UDP or port 23 (Telnet).
2
Define specific permission and denial rules for administrative access.
Permit TCP traffic from source host 10.20.30.1510.20.30.15 to destination host 10.20.30.210.20.30.2 on port 22, followed by a rule denying TCP port 22 traffic to host 10.20.30.210.20.30.2 from any other source.
Top-to-bottom evaluation evaluates specific host exceptions before broader block rules.
3
Account for the default behavior of Access Control Lists on un-matched traffic.
Append 'permit ip any any' at the end of the rule set.
ACLs feature an unwritten implicit deny statement at the end of every list. Without an explicit permit rule, all non-SSH traffic would be silently dropped.

Key Concept

Extended Access Control List rule ordering, layer 4 port/protocol specification, and implicit deny management.
Estimated Time:1m 30s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic