200-301: Cisco Certified Network AssociateDemo

By Cisco · Question Mode

QuestionQ586

Security Fundamentals

An engineer is setting up remote access to a router from IP subnet 10.139.58.0/28. The domain name, crypto keys, and SSH are already configured. Which configuration permits this traffic on the destination router?

  • A interface FastEthernet0/0ip address 10.122.49.1 255.255.255.252ip access-group 110 inip access-list extended 110permit tcp 10.139.58.0 0.0.0.15 host 10.122.49.1 eq 22
  • B interface FastEthernet0/0ip address 10.122.49.1 255.255.255.240access-group 120 inip access-list extended 120permit tcp 10.139.58.0 255.255.255.248 any eq 22
  • C interface FastEthernet0/0ip address 10.122.49.1 255.255.255.252ip access-group 105 inip access-list standard 105permit tcp 10.139.58.0 0.0.0.7 eq 22 host 10.122.49.1
  • D interface FastEthernet0/0ip address 10.122.49.1 255.255.255.248ip access-group 10 inip access-list standard 10permit udp 10.139.58.0 0.0.0.7 host 10.122.49.1 eq 22
Explanation

SSH uses TCP port 22, so the required filter must be an extended ACL that permits TCP traffic from source subnet 10.139.58.0/28, expressed with wildcard mask 0.0.0.15, to the router’s destination interface address on port 22. Standard ACLs cannot match TCP/UDP protocol or port numbers, and UDP would not permit SSH. The only choice that correctly matches the source subnet, protocol, destination host, and destination port is A.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!