A network security administrator must configure an IPv4 Access Control List (ACL) on a rou… — CompTIA Network+

A network security administrator must configure an IPv4 Access Control List (ACL) on a router to enforce access policies for the internal host network ( $10.1.1.0/24$ ) communicating with a database server ( $172.16.10.5$ ). The policy requires that host $10.1.1.15$ is allowed HTTP access to the server, while all other hosts in $10.1.1.0/24$ are denied HTTP access. However, all hosts in $10.1.1.0/24$ must be allowed all other IP traffic to the server, and all remaining traffic from any other network must be dropped. Place the ACL statements in the correct top-to-bottom execution order to enforce this security policy without rule shadowing.

1access-list 105 permit tcp host 10.1.1.15 host 172.16.10.5 eq 80
2access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 172.16.10.5 eq 80
3access-list 105 permit ip 10.1.1.0 0.0.0.255 host 172.16.10.5
4access-list 105 deny ip any any

Cevap

The correct sequential order of ACL statements from top to bottom is: 1) permit tcp host 10.1.1.15 host 172.16.10.5 eq 80, 2) deny tcp 10.1.1.0 0.0.0.255 host 172.16.10.5 eq 80, 3) permit ip 10.1.1.0 0.0.0.255 host 172.16.10.5, and 4) deny ip any any.

Router Access Control Lists (ACLs) process incoming packets strictly top-to-bottom against each line item until a match is found. Once a match occurs, the action (permit or deny) is taken immediately and no further rules are evaluated. Therefore, more specific rules (such as host-specific permits or protocol-specific denies) must precede general rules (such as full subnet permits or catch-all denies). Placing host 10.1.1.15's HTTP permit first ensures it is processed before the 10.1.1.0/24 HTTP deny rule. Placing the 10.1.1.0/24 HTTP deny rule second ensures HTTP traffic from remaining subnet hosts is blocked before matching the third rule, which permits all other IP traffic from 10.1.1.0/24. Finally, the catch-all deny statement must be at the very bottom.

Adım Adım Çözüm

Identify the most specific exception rule.

The rule permitting HTTP access specifically for host 10.1.1.15 must be evaluated first.

Sequential ACL evaluation stops at the first matching statement. Placing host-specific permits first prevents broader subnet deny statements from accidentally blocking the host (rule shadowing).

Identify specific protocol restrictions for the broader network.

The rule denying HTTP traffic from subnet 10.1.1.0/24 to host 172.16.10.5 must be placed second.

This blocks HTTP for all other hosts in 10.1.1.0/24 after host 10.1.1.15 has already matched the first rule and been permitted.

Identify broad network permission rules.

The rule permitting general IP traffic from subnet 10.1.1.0/24 to host 172.16.10.5 is placed third.

Placing this rule after the specific HTTP deny rule ensures HTTP traffic is denied while allowing all other IP protocols (such as ICMP or SSH) from the subnet.

Place default clean-up or implicit deny rules at the bottom.

The explicit deny ip any any statement is placed last.

Catch-all deny statements must always be positioned at the end of the ACL to catch any traffic not explicitly permitted by previous rules.

Anahtar Kavram

ACL Sequential Processing & Rule Shadowing Avoidance

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru