200-301: Cisco Certified Network AssociateDemo

By Cisco · Question Mode

QuestionQ603

Security Fundamentals

Question Image

Refer to the exhibit. An extended ACL has been configured and applied to router R2, but the configuration did not work as intended.

Which two changes will stop outbound traffic on TCP ports 25 and 80 to 10.0.20.0/26 from the 10.0.10.0/26 subnet while still permitting all other traffic?

Choose two
  • A Add a ג€permit ip any anyג€ statement at the end of ACL 101 for allowed traffic.
  • B Add a ג€permit ip any anyג€ statement to the beginning of ACL 101 for allowed traffic.
  • C The ACL must be moved to the Gi0/1 interface outbound on R2.
  • D The source and destination IPs must be swapped in ACL 101.
  • E The ACL must be configured the Gi0/2 interface inbound on R1.
Explanation

Extended ACLs match packets by protocol, then source address, then destination address, with optional port criteria. To block connections from 10.0.10.0/26 to 10.0.20.0/26 on destination TCP ports 25 and 80, the ACL entries must list 10.0.10.0/26 as the source and 10.0.20.0/26 as the destination. The shown ACL reverses those fields, so it matches the wrong direction. In addition, every ACL ends with an implicit deny, so an explicit permit ip any any must be added after the deny entries to allow all other traffic that should continue to pass. (cisco.com)

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!