Examkin

Question

Difficulty: EasyFirewalls and Access Control Lists (ACLs)

A network administrator needs to construct an IPv4 extended Access Control List (ACL) to filter traffic originating from the internal subnet 192.168.1.0/24192.168.1.0/24. The security policy requires the following requirements in order of processing:
1. Allow host 192.168.1.25192.168.1.25 to access web server 10.10.10.510.10.10.5 using secure HTTPS (port 443).
2. Block all other hosts on the 192.168.1.0/24192.168.1.0/24 subnet from reaching server 10.10.10.510.10.10.5.
3. Permit all remaining outbound traffic from subnet 192.168.1.0/24192.168.1.0/24 to any other destination.
4. Catch and drop all remaining unspecified IP traffic.

In what order should these ACL statements be evaluated from top to bottom to satisfy the security policy without shadowing any rules?

  1. 1access-list 100 permit tcp host 192.168.1.25 host 10.10.10.5 eq 443
  2. 2access-list 100 deny ip 192.168.1.0 0.0.0.255 host 10.10.10.5
  3. 3access-list 100 permit ip 192.168.1.0 0.0.0.255 any
  4. 4access-list 100 deny ip any any

Answer

The correct order of ACL statements from top to bottom is: (1) permit tcp host 192.168.1.25 host 10.10.10.5 eq 443, (2) deny ip 192.168.1.0 0.0.0.255 host 10.10.10.5, (3) permit ip 192.168.1.0 0.0.0.255 any, and (4) deny ip any any.
Router Access Control Lists process entries sequentially from top to bottom and stop at the first matching rule. To ensure correct policy enforcement, rules must be arranged from most specific (individual host and port permissions) to most general (subnet permits and implicit deny statements). Placing the host-specific permit for TCP port 443 first allows host 192.168.1.25 to reach server 10.10.10.5. Placing the subnet deny rule second blocks all other hosts in 192.168.1.0/24 from reaching server 10.10.10.5. Placing the subnet permit rule third allows subnet 192.168.1.0/24 to reach all other destinations. Placing the deny-all rule last catches all non-matching traffic.

Step-by-Step Solution

1
Place the most specific host exception rule at the top of the list.
traffic matching host 192.168.1.25 destined for 10.10.10.5 on TCP port 443 is matched immediately and permitted.
ACLs process rules sequentially using a first-match mechanism. Host-specific rules must precede subnet-level rules to avoid being shadowed.
2
Place the specific subnet-to-server deny rule immediately after the host permit exception.
Any other packet originating from 192.168.1.0/24 heading to 10.10.10.5 is matched and denied.
This enforces the requirement to block the rest of the 192.168.1.0/24 subnet from reaching the server.
3
Place the general permit rule for subnet 192.168.1.0/24 after the server restriction.
Traffic from 192.168.1.0/24 aimed at destinations other than 10.10.10.5 is permitted.
Packets reaching this rule have already been checked against the server restriction rules, allowing normal outgoing network communication for the subnet.
4
Place the default deny statement at the bottom of the ACL.
Any packet not matching the 192.168.1.0/24 source criteria is explicitly dropped.
Ensures zero-trust security by dropping all unhandled packets at the end of the ACL processing sequence.

Key Concept

First-match sequential rule evaluation and rule shadowing prevention in Access Control Lists (ACLs)
Estimated Time:1m 0s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic