200-201 Question 114
Single answerA security analyst is tasked with configuring an access control list (ACL) on a router to block all incoming traffic from the IP range 192.168.1.0/24 but allow all other traffic. Which ACL configuration should the analyst use?
- A
deny ip 192.168.1.0 0.0.0.255 any
- B
permit ip any any
- C
deny ip any any
- D
deny ip 192.168.1.0 0.0.0.255 any; permit ip any any
Show answer and explanation
Correct answer: D
Explanation
ACLs process rules sequentially, and without an explicit 'permit' statement, all traffic is blocked by default due to the implicit 'deny all' rule at the end of the list. To achieve the desired behavior, the analyst must first deny traffic from the specified IP range and then explicitly permit all other traffic. The correct configuration is 'deny ip 192.168.1.0 0.0.0.255 any; permit ip any any'.
- A. Incorrect.
This command only denies traffic from the specified IP range but does not permit other traffic, which would block all traffic by default due to the implicit 'deny all' rule.
- B. Incorrect.
This command allows all traffic, which defeats the purpose of blocking the specified IP range.
- C. Incorrect.
This command denies all traffic, including the traffic that should be allowed, which is not the desired behavior.
- D. Correct.
This configuration correctly denies traffic from the specified IP range and explicitly permits all other traffic, ensuring the desired functionality.