200-301 Question 437
Single answerYou are configuring an extended access control list (ACL) on a router to allow HTTP traffic (port 80) from the 192.168.1.0/24 network to the destination server 10.0.0.5, while denying all other traffic to the server. Which of the following commands will correctly configure this ACL?
- A
access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 80
- B
access-list 100 permit tcp any host 10.0.0.5 eq 80
- C
access-list 100 deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 80
- D
access-list 100 permit ip 192.168.1.0 0.0.0.255 host 10.0.0.5
Show answer and explanation
Correct answer: A
Explanation
The correct ACL command must allow only HTTP traffic (TCP port 80) from the specified source network (192.168.1.0/24) to the specific destination server (10.0.0.5). The first option correctly meets these criteria by specifying the source network, the destination host, the protocol (TCP), and the port (80) in the permit statement. Other options either allow too much traffic, deny the required traffic, or are not specific enough.
- A. Correct.
This command is correct because it allows HTTP (TCP port 80) traffic from the 192.168.1.0/24 network to the specific destination host 10.0.0.5, which is the requirement in the scenario.
- B. Incorrect.
This command allows HTTP traffic from any source to the destination host 10.0.0.5, which does not meet the requirement of restricting traffic to the 192.168.1.0/24 network only.
- C. Incorrect.
This command denies HTTP traffic from the 192.168.1.0/24 network to the destination, which is the opposite of the intended ACL configuration.
- D. Incorrect.
This command permits all IP traffic (not just HTTP) from the 192.168.1.0/24 network to the destination, which is less restrictive than the requirement.