Examkin

Question

Difficulty: MediumTroubleshooting Routing, Default Gateways, and ACLs

A network administrator is troubleshooting connectivity issues for a workstation that cannot access a secure web portal (10.50.20.15:44310.50.20.15:443). The workstation is assigned an IP address of 192.168.5.85/24192.168.5.85/24 with a default gateway configured as 192.168.6.1192.168.6.1. A ping test from the workstation to its configured default gateway fails. Furthermore, inspection of the interface ACL on the intermediate router shows only the following rule: `permit tcp 192.168.5.0 0.0.0.255 host 10.50.20.15 eq 80`. Which TWO of the following configurations are causing the connection to fail? (Select TWO)

  1. The host workstation's configured default gateway resides on a different IP subnet than the host address.Answer
  2. The Access Control List on the router lacks an explicit permit rule for TCP port 443 traffic, causing it to be dropped by implicit deny.Answer
  3. C
    The workstation IP address of 192.168.5.85 is a reserved broadcast address for the 192.168.5.0/24 subnet.
  4. D
    The router ACL rule fails because port 80 and port 443 use UDP instead of TCP at the transport layer.

Answer

The connectivity failures are caused by the default gateway being configured on a different IP subnet than the host (192.168.6.1 vs 192.168.5.0/24) and the router ACL lacking an explicit permit statement for HTTPS traffic on TCP port 443.
The host is unable to reach its default gateway because 192.168.6.1192.168.6.1 falls outside the host's 192.168.5.0/24192.168.5.0/24 subnet. Additionally, even if routing succeeded, the secure web traffic targeting TCP port 443 is blocked by the router's ACL, which only permits TCP port 80 traffic before falling through to the implicit deny all rule.

Step-by-Step Solution

1
Analyze the local IP address and gateway subnet configuration.
Host IP 192.168.5.85/24192.168.5.85/24 belongs to subnet 192.168.5.0/24192.168.5.0/24 (range 192.168.5.1192.168.5.1–192.168.5.254192.168.5.254). The gateway IP 192.168.6.1192.168.6.1 is in subnet 192.168.6.0/24192.168.6.0/24, creating a subnet mismatch.
A host cannot communicate off-subnet if its default gateway is configured outside its local subnet.
2
Examine the router ACL configuration against the target application requirement.
The target portal requires HTTPS (TCP 443), but the ACL only permits HTTP (TCP 80).
All traffic not explicitly allowed by ACL rules is blocked by the implicit deny rule at the end of the Access Control List.

Key Concept

Subnet alignment for default gateways and Access Control List port matching
Rate this question

Topics

Troubleshooting Routing, Default Gateways, and ACLs

More questions from this topic