300-410 Question 214
Single answerYour network consists of multiple branch offices connected to the headquarters via a WAN. You need to implement an IPv4 extended ACL on a router to block HTTP traffic (TCP port 80) from the branch office subnet (192.168.20.0/24) to a public web server (203.0.113.10) during business hours (8:00 AM to 6:00 PM) but allow all other traffic. Which configuration will meet this requirement?
- A
access-list 100 deny tcp 192.168.20.0 0.0.0.255 host 203.0.113.10 eq 80 time-range BUSINESS_HOURS
- B
access-list 100 permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.10 eq 80 time-range BUSINESS_HOURS
- C
access-list 100 deny ip 192.168.20.0 0.0.0.255 host 203.0.113.10 time-range BUSINESS_HOURS
- D
access-list 100 deny tcp 192.168.20.0 0.0.0.255 any eq 80 time-range BUSINESS_HOURS
Show answer and explanation
Correct answer: A
Explanation
In this scenario, an extended IPv4 access control list must be used to block HTTP traffic specifically (TCP port 80) between the branch office subnet (192.168.20.0/24) and a specific public web server (203.0.113.10) during business hours. The correct ACL configuration must include the 'deny' action, the source and destination IP addresses, the protocol (TCP), the destination port (80), and the time range (BUSINESS_HOURS). Only the first option meets all these criteria.
- A. Correct.
This is the correct configuration as it denies TCP traffic on port 80 (HTTP) from the branch office subnet to the specific public web server during the defined time range.
- B. Incorrect.
This configuration permits HTTP traffic instead of blocking it, which is not the intended requirement.
- C. Incorrect.
This configuration denies all IP traffic between the branch office subnet and the web server, not just HTTP traffic, making it too restrictive.
- D. Incorrect.
This configuration denies HTTP traffic to any destination, not just to the specific public web server, which is not what the scenario requires.