200-201 Question 115
Single answerYou are a junior cybersecurity analyst tasked with implementing an access control list (ACL) on a network device to restrict unauthorized access to a server. The server is located at IP address 192.168.1.10 and is running on TCP port 443. Only traffic from the subnet 192.168.2.0/24 should be allowed to access the server. Which of the following ACL rules would achieve this goal?
- A
permit tcp 192.168.2.0 0.0.0.255 192.168.1.10 eq 443
- B
permit tcp any 192.168.1.10 eq 443
- C
deny tcp 192.168.2.0 0.0.0.255 192.168.1.10 eq 443
- D
permit udp 192.168.2.0 0.0.0.255 192.168.1.10 eq 443
Show answer and explanation
Correct answer: A
Explanation
Access control lists (ACLs) are used to control traffic flow into or out of a network interface based on defined rules. To achieve the goal of allowing only TCP traffic from the 192.168.2.0/24 subnet to access the server at 192.168.1.10 on port 443, the correct ACL rule must explicitly permit this traffic while denying all others implicitly. The other options either allow incorrect traffic or deny the required traffic.
- A. Correct.
This is the correct rule. It permits TCP traffic from the subnet 192.168.2.0/24 to the server at 192.168.1.10 on port 443 (HTTPS). The subnet mask 0.0.0.255 specifies the /24 subnet.
- B. Incorrect.
This option allows any source IP to access the server on port 443, which does not restrict traffic to only the 192.168.2.0/24 subnet as required.
- C. Incorrect.
This option denies TCP traffic from the subnet 192.168.2.0/24 to the server, which is the opposite of the desired behavior.
- D. Incorrect.
This option permits UDP traffic from the 192.168.2.0/24 subnet to the server on port 443. However, the question specifies that the server uses TCP, not UDP.