Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator configures a stateless extended IPv4 Access Control List (ACL) on a router interface to allow workstations on the internal subnet 172.20.5.0/24172.20.5.0/24 to issue domain name queries to an external DNS server at 8.8.8.88.8.8.8. The administrator applies the following rule inbound on the LAN-facing interface:

`permit udp 172.20.5.0 0.0.0.255 host 8.8.8.8 eq 53`

Host 172.20.5.50172.20.5.50 sends DNS queries to 8.8.8.88.8.8.8, but all lookups time out. Packet captures show that outgoing requests reach the DNS server, but the responses never arrive back at the workstation. Which of the following best explains why the return traffic is failing?

  1. A
    The ACL rule incorrectly uses UDP instead of TCP, as all standard DNS name resolution queries require a connection-oriented three-way handshake.
  2. B
    The rule fails because DNS response traffic uses port 5300 as its source port, causing a port mismatch against standard ACL definitions.
  3. The stateless ACL does not automatically track connection state, so returning traffic from 8.8.8.88.8.8.8 is blocked by the implicit deny rule on the WAN interface.Answer
  4. D
    The host address format in the destination field lacks an explicit wildcard mask of 0.0.0.0, causing the outbound packet to trigger an implicit deny action.

Answer

The stateless ACL does not automatically track connection state, so returning traffic from the external DNS server is blocked by the implicit deny rule on the returning interface.
Stateless Access Control Lists evaluate packets individually without recording connection states. While stateful firewalls track outbound sessions and dynamically permit return traffic, a stateless ACL requires explicit rules for both outbound request traffic and inbound response traffic. Without an explicit rule permitting return packets from 8.8.8.88.8.8.8 on UDP port 53 back to the client's high-numbered ephemeral port, return traffic is dropped by the default implicit deny at the end of the ACL.

Step-by-Step Solution

1
Analyze the ACL type and traffic direction.
The configured filter is a stateless ACL operating on inbound LAN traffic.
Stateless filtering inspects individual packet headers independently and does not maintain a state table of active connections.
2
Trace the outbound and return packet flows.
Outbound traffic (source: 172.20.5.50172.20.5.50, destination: 8.8.8.8:538.8.8.8:53) matches the permit rule. Return traffic (source: 8.8.8.8:538.8.8.8:53, destination: 172.20.5.50172.20.5.50:ephemeral_port) encounters the WAN interface on the return path.
Because stateless ACLs do not automatically allow return traffic associated with outbound sessions, an explicit inbound ACL rule on the WAN interface is necessary to permit return UDP packets from source port 53.
3
Determine the cause of packet drop.
Without an explicit return permit rule, the return packets hit the mandatory implicit deny rule at the end of the return ACL.
All standard router ACLs conclude with an implicit deny all statement.

Key Concept

Stateless vs Stateful ACL Packet Handling & Return Traffic Filtering
Estimated Time:1m 30s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic