Examkin

Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

An administrator needs to restrict access on a Cisco IOS router so that only traffic from host 192.168.10.15192.168.10.15 can reach the internal web server at 10.1.1.5010.1.1.50 via HTTPS (TCP port 443443). All other traffic originating from the 192.168.10.0/24192.168.10.0/24 network destined to any location must be allowed. Which set of IPv4 access control list statements correctly satisfies these requirements?

  1. ip access-list extended SECURE_ACCESS
    permit tcp host 192.168.10.15 host 10.1.1.50 eq 443
    deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.50 eq 443
    permit ip 192.168.10.0 0.0.0.255 any    Cevap
  2. B
    ip access-list extended SECURE_ACCESS
    permit tcp host 192.168.10.15 host 10.1.1.50 eq 443
    deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.50 eq 443
  3. C
    ip access-list standard SECURE_ACCESS
    permit host 192.168.10.15
    permit 192.168.10.0 0.0.0.255
  4. D
    ip access-list extended SECURE_ACCESS
    deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.50 eq 443
    permit tcp host 192.168.10.15 host 10.1.1.50 eq 443
    permit ip any any

Cevap

The extended IPv4 ACL configuration that permits HTTPS traffic from host 192.168.10.15, denies HTTPS traffic from the rest of the 192.168.10.0/24 subnet to host 10.1.1.50, and permits all remaining IPv4 traffic from 192.168.10.0/24.
The correct configuration uses an extended named ACL to specify protocol (TCP) and port numbers (443). By placing the specific host permit line before the broader subnet deny line, the router allows host 192.168.10.15 to connect via HTTPS while blocking other hosts in 192.168.10.0/24 from reaching the web server on port 443. Finally, the trailing permit entry ensures other general IP traffic from the subnet is not dropped by the implicit deny rule.

Adım Adım Çözüm

1
Determine the ACL type required
Extended ACL is required because filtering is based on source address, destination address, and protocol/port (TCP 443).
Standard ACLs can only filter based on source IP address.
2
Order the ACL permit and deny rules from most specific to least specific
First permit host 192.168.10.15 to reach host 10.1.1.50 eq 443, then deny the subnet 192.168.10.0 0.0.0.255 to host 10.1.1.50 eq 443.
Cisco IOS processes ACL entries top-down; matching stops at the first matching entry.
3
Account for the implicit deny clause at the end of the ACL
Add an explicit permit rule 'permit ip 192.168.10.0 0.0.0.255 any'.
Without an explicit permit statement at the end, all other IP traffic from the subnet would be blocked by the invisible implicit deny entry.

Anahtar Kavram

Extended IPv4 Access Control Lists top-down processing and implicit deny behavior
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru