Examkin

Soru

Zorluk: ZorAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is configuring an IPv4 extended named access control list (ACL) on a Cisco router interface to implement security controls for the host subnet 10.50.1.0/2410.50.1.0/24. The ACL must satisfy the following traffic policies:

1. Allow ICMP echo requests from 10.50.1.0/2410.50.1.0/24 strictly to the default gateway at 10.50.1.110.50.1.1.
2. Allow HTTPS access from 10.50.1.0/2410.50.1.0/24 to the internal application server at 192.168.20.45192.168.20.45.
3. Explicitly deny all other IPv4 traffic originating from 10.50.1.0/2410.50.1.0/24 destined to the internal server subnet 192.168.20.0/24192.168.20.0/24.
4. Permit all remaining outbound traffic from 10.50.1.0/2410.50.1.0/24 to any other network destination.

Which two ACL entries must be placed in the access list to achieve this exact behavior without blocking general Internet access? (Select two.)

  1. permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443Cevap
  2. permit ip 10.50.1.0 0.0.0.255 anyCevap
  3. C
    deny ip 10.50.1.0 0.0.0.255 any
  4. D
    permit ip 10.50.1.0 0.0.0.255 192.168.20.0 0.0.0.255

Cevap

The correct options are 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' and 'permit ip 10.50.1.0 0.0.0.255 any'.
The correct configuration requires allowing TCP port 443 traffic to the specific host 192.168.20.45 first. Following the explicit block of all other IP traffic to 192.168.20.0/24, an explicit permit ip entry from the source network to 'any' destination is mandatory to prevent the default implicit deny clause from blocking general Internet and external traffic.

Adım Adım Çözüm

1
Analyze extended ACL processing order rules.
Cisco IOS ACLs process entries sequentially from top to bottom until the first match occurs.
Specific permit rules must precede broader deny rules to ensure target traffic is allowed.
2
Construct the rule for HTTPS access to the application server.
The entry 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' correctly permits SSL/TLS traffic to port 443 of the target server.
Requirements demand permitting HTTPS specifically to 192.168.20.45.
3
Address general outbound connectivity while maintaining subnet restrictions.
After specifying 'deny ip 10.50.1.0 0.0.0.255 192.168.20.0 0.0.0.255', the rule 'permit ip 10.50.1.0 0.0.0.255 any' must be appended.
Without an explicit permit statement at the end of the ACL, the invisible default 'implicit deny ip any any' clause drops all traffic destined for other locations.

Anahtar Kavram

ACL Sequential Evaluation and Implicit Deny Handling
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru