Examkin

Question

Difficulty: Very hardFirewalls and Access Control Lists (ACLs)

A network engineer is configuring an extended IPv4 Access Control List (ACL) on a stateless router interface filtering outbound traffic leaving a DMZ subnet (192.168.100.0/24192.168.100.0/24) toward an internal corporate LAN (10.0.0.0/810.0.0.0/8). DMZ web servers (192.168.100.10192.168.100.10–192.168.100.20192.168.100.20) must respond to HTTPS client requests initiated from the internal LAN and send syslog telemetry to an internal monitoring server (10.2.2.50/3210.2.2.50/32) over UDP port 514. Which of the following ACL configuration entries are required on this interface to satisfy these requirements while accounting for stateless filtering mechanics? (Select TWO.)

  1. An entry permitting TCP traffic from source network 192.168.100.0/24 with source port 443 to destination network 10.0.0.0/8 on ports greater than 1023Answer
  2. An entry permitting UDP traffic from source network 192.168.100.0/24 to destination IP 10.2.2.50/32 with destination port 514Answer
  3. C
    An entry permitting UDP traffic from source network 192.168.100.0/24 with source port 443 to destination network 10.0.0.0/8
  4. D
    An explicit deny ip any any statement placed as the first entry in the access list to ensure unpermitted traffic is blocked before evaluation

Answer

The required entries are the rule permitting TCP traffic from source network 192.168.100.0/24 with source port 443 back to destination network 10.0.0.0/8 on ports greater than 1023, and the rule permitting UDP traffic from source network 192.168.100.0/24 to destination host 10.2.2.50/32 on destination port 514.
In a stateless firewall or router extended ACL configuration, return traffic for established sessions is not tracked automatically. HTTPS uses TCP (port 443), so allowing response packets from DMZ servers back to client dynamic ports (> 1023) on the 10.0.0.0/8 network requires an explicit TCP permit entry. Additionally, syslog sends log data over UDP port 514, requiring a targeted UDP permit entry to the monitoring server at 10.2.2.50.

Step-by-Step Solution

1
Analyze the stateless nature of the router ACL filter
Unlike stateful firewalls, stateless extended ACLs evaluate packets individually and do not automatically allow return traffic for established sessions.
Because internal users initiate HTTPS connections to DMZ web servers, return traffic from DMZ servers back to clients must be explicitly permitted outbound from the DMZ interface.
2
Determine protocol and port parameters for HTTPS return traffic
HTTPS uses TCP. Return traffic originates from the DMZ server IP block (192.168.100.0/24192.168.100.0/24) on source port TCP 443 and targets internal client IP space (10.0.0.0/810.0.0.0/8) on dynamic/ephemeral destination ports (>1023> 1023).
Correctly matching transport layer protocols and directional port assignments is essential for valid stateless ACL filtering.
3
Determine protocol and port parameters for outbound syslog telemetry
Syslog uses UDP port 514. Outbound telemetry originates from DMZ hosts (192.168.100.0/24192.168.100.0/24) targeting the specific log server (10.2.2.50/3210.2.2.50/32) on destination port UDP 514.
Syslog is a connectionless service utilizing UDP port 514.

Key Concept

Stateless Access Control List (ACL) Traffic Directionality and Port Selection
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic