Examkin

Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator must configure a Cisco IOS extended IPv4 Access Control List (ACL) numbered 105 to enforce the following security policy for outbound traffic from an internal subnet:

1. Permit HTTPS traffic originating from subnet 192.168.10.0/24 destined to the database server at 10.0.0.50.
2. Deny all other TCP traffic originating from subnet 192.168.10.0/24 destined to the database server at 10.0.0.50.
3. Permit all remaining IP traffic originating from subnet 192.168.10.0/24 to any destination.

Arrange the ACL statements in the correct top-down sequential order required to successfully enforce this security policy.

  1. 1access-list 105 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 443
  2. 2access-list 105 deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50
  3. 3access-list 105 permit ip 192.168.10.0 0.0.0.255 any
  4. 4(Implicit deny ip any any)

Cevap

The correct sequential order of statements from top to bottom is: 1) access-list 105 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 443, 2) access-list 105 deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50, 3) access-list 105 permit ip 192.168.10.0 0.0.0.255 any, 4) (Implicit deny ip any any).
Cisco IPv4 access control lists execute line-by-line starting from the top entry (lowest sequence number) and stop evaluating as soon as a match occurs. Therefore, rules must strictly proceed from most specific (permitting HTTPS port 443 to the single host 10.0.0.50) to moderately specific (denying all other TCP to host 10.0.0.50), followed by broader subnet access (permitting all IP from 192.168.10.0/24), and finally concluding with the built-in implicit deny rule.

Adım Adım Çözüm

1
Identify the most specific requirement
HTTPS traffic (TCP port 443) from 192.168.10.0/24 to host 10.0.0.50 is the most narrow requirement.
Cisco ACLs process sequentially top-down; specific permit rules must precede broader deny rules to prevent legitimate traffic from being matched early and dropped.
2
Place the specific host/port restriction next
Denying general TCP traffic from 192.168.10.0/24 to host 10.0.0.50 follows the HTTPS permit rule.
This blocks all other TCP application ports destined for 10.0.0.50 without affecting HTTPS traffic matched in step 1.
3
Place the general subnet permit rule
Permitting all IP traffic from 192.168.10.0/24 to any destination is placed after host-specific TCP rules.
This guarantees other destinations and protocols (such as ICMP or traffic to other servers) from subnet 192.168.10.0/24 are permitted.
4
Account for implicit ACL behavior
The implicit deny ip any any statement automatically resides at the end of the access list.
Cisco IOS automatically appends an invisible implicit deny to the end of every ACL, dropping any traffic that fails to match any explicit permit entries above.

Anahtar Kavram

Top-Down Sequential Processing and Specific-to-General Rule Ordering in Cisco IPv4 Extended ACLs
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru