A network administrator is troubleshooting connectivity between a corporate client worksta… — CompTIA Network+

A network administrator is troubleshooting connectivity between a corporate client workstation ( $172.16.40.25/24$ ) and an off-site secure web server ( $192.168.200.10/24$ ). The client can successfully ping its default gateway ( $172.16.40.1$ ), but connection requests to the web server over HTTPS time out.

The administrator reviews the inbound Access Control List (ACL) applied to the client's router interface:

text
Extended IP access list 101_INBOUND
10 permit tcp 172.16.40.0 0.0.0.255 host 192.168.200.10 eq 80
20 deny ip 172.16.40.0 0.0.0.255 any
30 permit tcp 172.16.40.0 0.0.0.255 host 192.168.200.10 eq 443

Which of the following identifies the root cause of this connection failure?

Rule 20 shadows Rule 30, causing all HTTPS traffic from the subnet to be dropped before reaching the permit rule for port 443.Answer
B
The ACL lacks an explicit permit rule at line 40, causing the implicit deny all statement to block return traffic from the web server.
C
The workstation default gateway (172.16.40.1) resides on a different logical subnet than the workstation (172.16.40.25/24).
D
HTTPS traffic relies on UDP port 443 rather than TCP port 443, rendering Rule 30 ineffective for web traffic.

Answer

Rule 20 shadows Rule 30, causing HTTPS traffic to be denied by Rule 20 before reaching the permit rule for port 443.

Router Access Control Lists use top-down evaluation logic and terminate processing upon finding the first matching rule. In this configuration, Rule 20 (`deny ip 172.16.40.0 0.0.0.255 any`) matches all IP traffic originating from the client's subnet. Consequently, HTTPS packets matching port 443 are denied at Rule 20 and never reach Rule 30. This phenomenon is known as ACL rule shadowing.

Step-by-Step Solution

Analyze the sequential evaluation of the Access Control List entries.

Network ACLs execute line-by-line in top-down numerical order, stopping evaluation at the first matching rule.

Top-down execution dictates that broader match rules placed above more specific rules will intercept matching packets first.

Trace an outbound packet destined for 192.168.200.10 on TCP port 443 through the ACL.

The packet source (172.16.40.25) does not match Rule 10 (port 80). It then matches Rule 20 (`deny ip 172.16.40.0 0.0.0.255 any`) and is dropped immediately.

Because Rule 20 matches all IP traffic from the 172.16.40.0/24 network, Rule 30 is shadowed and will never process any packets.

Determine the necessary remediation.

Move Rule 30 above Rule 20 (e.g., to sequence line 15) so specific HTTPS traffic is permitted before general IP traffic from the subnet is denied.

ACL design best practices require placing specific permit rules prior to general deny statements.

Key Concept

ACL Rule Shadowing and Top-Down Execution Sequence

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic