200-301 Question 435
Single answerYou are configuring an access control list (ACL) on a router to allow only SSH traffic from the 192.168.1.0/24 network to the router itself, while denying all other traffic. Which of the following is the correct ACL configuration?
- A
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 22
- B
access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 22
- C
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 23
- D
access-list 100 permit udp 192.168.1.0 0.0.0.255 any eq 22
Show answer and explanation
Correct answer: A
Explanation
To allow only SSH traffic from a specific source network to the router, the ACL must permit TCP traffic on port 22 (SSH) for the specified source network range. Option 1 achieves this by permitting TCP traffic from the 192.168.1.0/24 network to any destination on port 22. The other options are either using the wrong protocol, port, or specifying an incorrect destination.
- A. Correct.
This is the correct answer. The ACL permits TCP traffic (used by SSH) from the 192.168.1.0/24 network to any destination on port 22 (SSH).
- B. Incorrect.
This is incorrect because it specifies a single host (192.168.1.1) as the destination instead of the router itself or any destination.
- C. Incorrect.
This is incorrect because it permits traffic on port 23, which is used for Telnet, not SSH.
- D. Incorrect.
This is incorrect because it uses UDP, which is not the protocol used by SSH (SSH uses TCP).