Examkin

Question

Difficulty: HardFirewalls and Access Control Lists (ACLs)

A network administrator configures an extended IPv4 Access Control List (ACL) on a router interface filtering inbound traffic toward an internal database subnet (10.50.10.0/2410.50.10.0/24). The ACL is designed to meet three requirements:
1. Allow secure administration from a jump host at 10.50.1.1510.50.1.15 via SSH (TCP 22).
2. Allow application servers on subnet 10.50.2.0/2410.50.2.0/24 to access the database server at 10.50.10.10010.50.10.100 on TCP port 5432.
3. Block all other traffic originating from subnet 10.50.2.0/2410.50.2.0/24.

The administrator enters the following ACL entries in sequential order:
- Entry 10: `permit tcp host 10.50.1.15 10.50.10.0 0.0.0.255 eq 22`
- Entry 20: `deny ip 10.50.2.0 0.0.0.255 10.50.10.0 0.0.0.255`
- Entry 30: `permit tcp 10.50.2.0 0.0.0.255 host 10.50.10.100 eq 5432`

During testing, application servers on subnet 10.50.2.0/2410.50.2.0/24 are unable to establish database connections to 10.50.10.100:543210.50.10.100:5432. Which of the following best explains why this configuration fails?

  1. The sequential top-down evaluation matches application server traffic against Entry 20 first, resulting in an explicit deny before Entry 30 is evaluated.Answer
  2. B
    The router drops the database traffic because extended ACLs automatically discard return packets unless an explicit return permit rule is added.
  3. C
    The rule fails because PostgreSQL database services communicate exclusively over UDP port 5432, creating a protocol layer mismatch.
  4. D
    Extended ACLs function only at Layer 2 and cannot filter traffic using Layer 3 IP subnets or Layer 4 TCP port specifications.

Answer

The configuration fails because ACL rules are evaluated sequentially from top to bottom, causing traffic from 10.50.2.0/24 to match the broad deny rule in Entry 20 before reaching the specific permit rule in Entry 30.
Router access control lists utilize a first-match rule processing mechanism. Because Entry 20 specifies a broad deny for all IP traffic from subnet 10.50.2.0/24 to 10.50.10.0/24, packets intended for port 5432 match Entry 20 immediately and are discarded. Entry 30 is never evaluated for this traffic. To resolve this, specific permit rules must always precede broader deny statements.

Step-by-Step Solution

1
Analyze how Access Control Lists evaluate incoming packets.
Network devices evaluate ACL entries sequentially starting from the lowest line number (top-down) and apply the action of the first matching rule, terminating further rule checks for that packet.
Understanding first-match execution logic is essential for placing ACL entries correctly.
2
Trace a packet sent from an application server (e.g., 10.50.2.50) to the database server (10.50.10.100:5432) through the ACL entries.
Entry 10 does not match (source host differs). Entry 20 matches because the source 10.50.2.50 is within 10.50.2.0/24 and destination 10.50.10.100 is within 10.50.10.0/24.
Determining which entry matches first identifies why the traffic is dropped.
3
Determine the necessary structural fix for the ACL sequence.
Entry 30 (the specific permit rule for port 5432) must be placed above Entry 20 (the broad deny rule for the subnet).
Specific permit rules must precede broader deny statements to prevent premature packet drops.

Key Concept

ACL Sequential Logic and Rule Ordering
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic