300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and ServicesDemo

Question

Question Image

Refer to the exhibit. The ACL is applied inbound on the router’s Gigabit 0/1 interface. Host 192.168.10.10 cannot SSH to host 192.168.100.10, even though the flow is permitted. Which action resolves the problem without allowing full access to this router?

A Temporarily move the permit ip any any line to the beginning of the ACL to see if the flow works
B Temporarily remove the ACL from the interface to see if the flow works.
C Move the SSH entry to the beginning of the ACL.
D Run the show access-list FILTER command to view if the SSH entry has any hit statistics associated with it.

Explanation

Cisco IOS ACL entries are processed in order, and evaluation stops at the first matching permit or deny entry. The general SSH deny matches this traffic before the later host-specific SSH permit. Moving the SSH permit to the beginning lets that specific flow pass while keeping the other restrictions intact.

Learn more

Cisco Security Configuration Guide: Creating an IP Access List and Applying It to an Interface

300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and ServicesDemo

AstroTutor

Notes

Readiness

QuestionQ156

Community Discussion