200-301 Question 436
Single answerA network administrator is tasked with configuring an access control list (ACL) on a router to block HTTP traffic (TCP port 80) from the 192.168.1.0/24 network to the 10.10.10.0/24 network, while allowing all other traffic. After applying the ACL to the correct interface, the administrator notices that all traffic from 192.168.1.0/24 is being blocked. Which ACL entry should be added to fix this issue?
- A
permit ip any any
- B
permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255
- C
permit tcp 192.168.1.0 0.0.0.255 any eq 80
- D
permit ip 192.168.1.0 0.0.0.255 any
- E
deny tcp 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255 eq 80
Show answer and explanation
Correct answer: D
Explanation
Access control lists (ACLs) on routers process traffic sequentially from top to bottom. Once a match is found, no further entries are evaluated. If no explicit match is found, all traffic is implicitly denied at the end. In this scenario, the administrator correctly denied HTTP traffic but did not add an appropriate permit statement for other traffic. Adding 'permit ip 192.168.1.0 0.0.0.255 any' allows all other traffic from the source network while still denying HTTP traffic due to the earlier deny statement.
- A. Incorrect.
Adding this entry would allow all traffic, including HTTP traffic, which does not meet the requirement to block HTTP traffic.
- B. Incorrect.
This entry permits all traffic between the two specific networks but does not selectively block HTTP traffic as required.
- C. Incorrect.
This entry permits HTTP traffic instead of blocking it, which is the opposite of the requirement.
- D. Correct.
This entry allows all traffic from the 192.168.1.0/24 network to any destination except the HTTP traffic already denied; it resolves the issue caused by an implicit 'deny all' rule at the end of the ACL.
- E. Incorrect.
This is the correct entry to block HTTP traffic but does not address the implicit 'deny all' rule, which is causing all traffic from 192.168.1.0/24 to be blocked.