Examkin

Question

Difficulty: MediumTroubleshooting Routing, Default Gateways, and ACLs

A network administrator is troubleshooting connectivity issues for a workstation assigned the static IPv4 address 192.168.50.140/26192.168.50.140/26. The workstation can communicate with local hosts on its subnet (192.168.50.128/26192.168.50.128/26), but cannot connect to a secure web portal hosted externally at 203.0.113.50:443203.0.113.50:443.

During diagnostic collection, the administrator notes the following settings:
- Workstation IPv4 Address: 192.168.50.140192.168.50.140
- Subnet Mask: 255.255.255.192255.255.255.192
- Configured Default Gateway: 192.168.50.1192.168.50.1
- Router Interface Inbound ACL Rule:
`permit tcp 192.168.50.128 0.0.0.63 host 203.0.113.50 eq 80`

Which TWO configuration issues are preventing the workstation from establishing a connection to the external web portal?

  1. The default gateway address is assigned outside the workstation's local IP subnet range.Answer
  2. The router interface ACL lacks an explicit permit rule for TCP port 443 traffic and is dropped by the implicit deny.Answer
  3. C
    The IP address assigned to the workstation is reserved as the broadcast address for the 192.168.50.128/26192.168.50.128/26 subnet.
  4. D
    The ACL rule fails because HTTPS connections use UDP port 80 instead of TCP port 80.

Answer

The two issues preventing access are that the configured default gateway resides outside the workstation's local IP subnet range, and the router ACL lacks an explicit permit rule for HTTPS (TCP port 443) traffic, causing it to be dropped by the implicit deny.
The host is unable to send traffic to external networks due to two misconfigurations. First, the configured default gateway address belongs to the subnet range 192.168.50.0/26192.168.50.0/26, whereas the host resides in the 192.168.50.128/26192.168.50.128/26 subnet; a gateway must reside on the same IP subnet as the host to be reachable. Second, the destination server connection requires HTTPS on port 443, but the ACL only permits HTTP on port 80. Since ACLs evaluate sequentially and end with an implicit deny statement, the HTTPS packets are blocked by the firewall/router.

Step-by-Step Solution

1
Analyze the IP addressing and subnet mask boundary.
A /26/26 subnet mask (255.255.255.192255.255.255.192) creates block sizes of 64. For the host IP 192.168.50.140192.168.50.140, the subnet boundary spans from 192.168.50.128192.168.50.128 to 192.168.50.191192.168.50.191 (usable host range: 192.168.50.129192.168.50.129 – 192.168.50.190192.168.50.190).
The host cannot forward traffic outside its local network because its gateway address (192.168.50.1192.168.50.1) lies in a completely different subnet (192.168.50.0/26192.168.50.0/26).
2
Evaluate the Access Control List (ACL) rule matching logic.
The configured ACL line explicitly permits traffic destination TCP port 80 (`eq 80`). The host is attempting to reach a secure portal on TCP port 443 (`203.0.113.50:443`).
Because network ACLs end with an implicit deny all rule, any traffic not matched by an explicit permit line (such as HTTPS port 443) will be silently dropped.

Key Concept

Subnet Mask Boundaries and Access Control List Filtering Mechanics
Rate this question

Topics

Troubleshooting Routing, Default Gateways, and ACLs

More questions from this topic