A security analyst is auditing an edge router configured with stateless Access Control Lis… — CompTIA Network+

A security analyst is auditing an edge router configured with stateless Access Control Lists (ACLs) to filter traffic between an internal management subnet ( $10.200.5.0/24$ ) and a cloud monitoring cluster ( $172.31.40.0/24$ ). The analyst notes that SNMP monitoring requests sent over UDP port 161 from the cloud cluster to internal endpoints pass successfully, but the response packets generated by the internal endpoints fail to reach the monitoring cluster.

Which TWO of the following statements correctly explain why this issue occurs and identify an appropriate resolution?

Stateless ACLs evaluate packets individually without tracking connection state, requiring an explicit reverse ACL rule to permit return UDP traffic from source port 161 back to the monitoring cluster.Cevap
Migrating the filtering mechanism to a stateful firewall would resolve the issue because stateful inspection dynamically allows return traffic by referencing an entry created in its state table during outbound transmission.Cevap
C
Deleting the implicit deny statement at the end of the stateless ACL automatically allows returning response packets to pass without adding specific permit statements.
D
Implementing Layer 2 MAC address filtering on the router interface enables automatic deep packet inspection to track UDP payload sessions across subnets.

Cevap

The issue occurs because stateless ACLs inspect packets individually without maintaining connection tables, requiring an explicit reverse permit rule for returning traffic. Alternatively, replacing the stateless ACL with a stateful firewall resolves the issue by dynamically tracking sessions and automatically permitting return packets matching an active state table entry.

Stateless ACLs evaluate every packet independently without storing state history. Consequently, permitting outbound queries from a monitoring cluster does not automatically permit the response packets returning from internal hosts; an explicit reverse ACL entry is required to allow traffic flowing back. Alternatively, deploying a stateful firewall resolves this limitation because stateful devices monitor communication flows and dynamically permit return packets corresponding to active session entries.

Adım Adım Çözüm

Analyze the filtering architecture

Identified that the edge router uses stateless Access Control Lists (ACLs).

Stateless devices treat every packet as an independent event and do not keep memory of previous packets or established connections.

Evaluate why return packets are dropped

Outbound SNMP queries from

172.31.40.0/24

10.200.5.0/24

match an outbound permit rule, but returning response traffic moving in the opposite direction hits the implicit deny rule because no matching inbound rule exists.

Stateless ACLs require symmetric, bidirectional rule definitions for bidirectional communication.

Determine valid remediation approaches

Two solutions exist: (1) Add an explicit reverse ACL rule for return traffic, or (2) replace the stateless ACL with a stateful firewall.

Stateful firewalls maintain connection tables (even creating pseudo-state entries for UDP flows) to dynamically permit returning response packets.

Anahtar Kavram

Stateless vs. Stateful Packet Filtering and ACL Directionality

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru