Examkin

Question

Difficulty: HardFirewalls and Access Control Lists (ACLs)

A network security administrator applies a new stateless extended IPv4 Access Control List (ACL) to interface GigabitEthernet0/0GigabitEthernet0/0 in the inbound direction on a perimeter router. The interface serves an internal management VLAN on subnet 192.168.4.0/24192.168.4.0/24. The objective of the configuration is to permit local network devices to send SNMP trap notifications to an off-site monitoring server at IP address 198.51.100.45198.51.100.45 listening on UDP port 162.

The technician configures a single rule entry:
`access-list 102 permit udp 192.168.4.0 0.0.0.255 host 198.51.100.45 eq 162`

Immediately after applying the ACL with `ip access-group 102 in`, users on the 192.168.4.0/24192.168.4.0/24 subnet report a complete loss of web access (TCP ports 80/443) and DNS name resolution (UDP port 53) to all external destinations.

Which of the following identifies the root cause of this network outage?

  1. The ACL lacks explicit permit statements for HTTP, HTTPS, and DNS traffic, causing all unlisted traffic to be blocked by the unwritten implicit deny rule at the end of the access list.Answer
  2. B
    SNMP traps operate over TCP rather than UDP, causing the router to misclassify web packets and reject the connection attempts.
  3. C
    Extended ACLs operate exclusively at Layer 2, so evaluating Layer 4 port numbers causes the router interface to drop all Layer 3 IP packets.
  4. D
    The router requires Port Address Translation (PAT) overloading to be enabled directly inside the ACL statement to map internal hosts to port 162.

Answer

The network outage occurred because Access Control Lists end with an implicit deny statement that automatically drops any packet not explicitly permitted by an earlier rule.
The correct answer highlights that all network Access Control Lists feature an unwritten implicit deny rule at the end of the rule chain ('deny ip any any'). When an ACL contains only one permit entry (such as UDP port 162 for SNMP traps), all other protocols—including DNS (UDP port 53), HTTP (TCP port 80), and HTTPS (TCP port 443)—fail to match the single permit rule and are automatically dropped by the implicit deny.

Step-by-Step Solution

1
Analyze the configured ACL entry and interface placement.
The ACL entry permits only UDP traffic originating from subnet 192.168.4.0/24192.168.4.0/24 destined to 198.51.100.45198.51.100.45 on port 162.
Understanding the explicit scope of the rule isolates what traffic is matching the permit rule.
2
Evaluate the default behavior of IPv4 ACL rule processing.
All standard Cisco and industry-standard IPv4 ACLs append an invisible, default 'deny ip any any' rule at the bottom of the access list.
Any packet that does not match an explicit permit statement falls through to the implicit deny rule.
3
Determine the packet disposition for HTTP, HTTPS, and DNS traffic.
Traffic directed to TCP ports 80/443 and UDP port 53 fails to match the SNMP trap rule and is dropped by the implicit deny.
Without explicit permit statements for general web browsing and DNS resolution, those protocols are blocked completely.

Key Concept

ACL Implicit Deny Evaluation
Estimated Time:2m 0s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic