200-301: Cisco Certified Network AssociateDemo

By Cisco · Question Mode

QuestionQ1007

Network Access

A network engineer must configure an access list on a new Cisco IOS router.

The access list must:

  • deny HTTP traffic to network 10.125.128.32/27 from the 192.168.240.0/20 network
  • allow the 192.168.240.0/20 network to reach the rest of the 10.0.0.0/8 network

Which configuration must the engineer apply?

  • A ip access-list extended deny_outbound10 permit ip 192.168.240.0 255.255.240.0 10.0.0.0 255.0.0.020 deny tcp 192.168.240.0 255.255.240.0 10.125.128.32 255.255.255.224 eq 44330 permit ip any any
  • B ip access-list extended deny_outbound10 deny tcp 192.168.240.0 0.0.15.255 10.125.128.32 0.0.0.31 eq 8020 permit ip 192.168.240.0 0.0.15.255 10.0.0.0 0.255.255.25530 deny ip any any log
  • C ip access-list extended deny_outbound10 deny tcp 10.125.128.32 255.255.255.224 192.168.240.0 255.255.240.0 eq 44320 deny tcp 192.168.240.0 255.255.240.0 10.125.128.32 255.255.255.224 eq 44330 permit ip 192.168.240.0 255.255.240.0 10.0.0.0 255.0.0.0
  • D ip access-list extended deny_outbound10 deny tcp 192.168.240.0 0.0.15.255 any eq 8020 deny tcp 192.168.240.0 0.0.15.255 10.125.128.32 0.0.0.31 eq 8030 permit ip 192.168.240.0 0.0.15.255 10.0.0.0 0.255.255.255
Explanation

Option B uses correct wildcard masks (0.0.15.255 for /20 and 0.0.0.31 for /27), specifies HTTP with eq 80, and places the specific deny statement before the broader permit. ACLs are processed top-to-bottom, so the specific deny for HTTP to the target subnet is evaluated first, then the permit allows all other IP traffic from the source to the broader 10.0.0.0/8 network.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!