300-410 Question 217
Single answerA network administrator has configured an extended IPv4 access control list (ACL) to block HTTP traffic from a specific subnet (192.168.10.0/24) during business hours (9 AM to 5 PM). The administrator applied the ACL to the router interface facing the destination server, but HTTP traffic from the subnet still reaches the server. What could be the cause of this issue?
- A
The ACL is not applied in the correct direction on the interface.
- B
Time-based ACLs are not supported on the router.
- C
The ACL is missing a permit statement for other traffic.
- D
The time range defined for the ACL does not match the current system clock on the router.
Show answer and explanation
Correct answer: D
Explanation
Time-based ACLs rely on the router's system clock to enforce rules within a specific time range. If the system clock is not correctly configured, the time range will not trigger, and the ACL will not take effect. Administrators should verify the clock settings and ensure that they align with the time range defined in the ACL.
- A. Incorrect.
An ACL applied in the wrong direction can cause issues, but the scenario does not indicate a misconfiguration in direction. The issue is related to time-based functionality.
- B. Incorrect.
Time-based ACLs are supported on most enterprise-grade Cisco routers, and the scenario does not suggest that the router lacks this feature.
- C. Incorrect.
While a missing permit statement can cause unintended traffic filtering, the scenario specifically focuses on time-based ACL behavior, not general permit/deny rules.
- D. Correct.
If the time range used in the ACL does not align with the router's system clock, the ACL will not function as intended. This is a common issue with time-based ACLs.