A network administrator is deploying an extended IPv4 Access Control List (ACL) on a route… — CompTIA Network+

A network administrator is deploying an extended IPv4 Access Control List (ACL) on a router interface connecting an internal client subnet ( $10.50.100.0/24$ ) to an external management network ( $192.168.200.0/24$ ). The filtering device operates as a stateless packet filter. Which of the following configuration requirements and operational behaviors apply to this scenario? (Select TWO.)

An explicit rule must be created to permit outbound TCP traffic with a destination IP of $192.168.200.0/24$ and a destination port of 22 to allow Secure Shell (SSH) request packets.Answer
A separate return rule must be configured to permit inbound TCP traffic originating from source port 22 on $192.168.200.0/24$ destined for ephemeral ports on $10.50.100.0/24$ .Answer
C
The ACL rule for SSH session traffic must specify destination port 23 using the UDP transport protocol.
D
Return response packets from remote SSH servers are automatically permitted through the router interface without requiring an explicit return rule.

Answer

The correct selections are the requirement to explicitly permit outbound TCP traffic destined for port 22 and the requirement to configure a return rule permitting traffic originating from source port 22 back to ephemeral ports on the internal subnet.

The correct choices recognize that Secure Shell (SSH) requires TCP port 22 and that stateless ACLs lack session state tracking. Because stateless filtering evaluates packets individually in isolation, an outbound rule permitting TCP destination port 22 handles initial request packets, while a distinct inbound rule permitting TCP source port 22 returning to ephemeral client ports is mandatory to allow response traffic back through the interface.

Step-by-Step Solution

Identify the protocol and port number for the requested service (Secure Shell).

SSH relies on TCP as its transport protocol and listens on destination port 22.

Correctly identifying Layer 4 transport protocols and port numbers is essential for constructing extended ACL rules.

Analyze the filtering behavior of a stateless packet filter.

Stateless filters inspect each packet independently without maintaining a dynamic state table of active sessions.

Unlike stateful firewalls, stateless ACLs require explicit rules for both outbound request flows and inbound response flows.

Evaluate the default behavior at the end of an Access Control List.

Unmatched return traffic hits the implicit deny rule and is dropped.

All standard and extended ACLs enforce an invisible 'deny ip any any' rule at the bottom of the list.

Key Concept

Stateless Access Control List (ACL) Rule Definition and Traffic Asymmetry

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic