300-440 Question 218
Single answerA network administrator is tasked with configuring an extended IPv4 ACL to allow HTTP and HTTPS traffic from the 192.168.1.0/24 network to a web server with the IP address 10.10.10.10. The ACL should also prevent all other traffic to the web server. Which ACL configuration will meet these requirements?
- A
access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 80 443
- B
access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 80 access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 443
- C
access-list 100 permit tcp any host 10.10.10.10 eq 80 443
- D
access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 80 access-list 100 permit tcp any any access-list 100 deny ip any host 10.10.10.10
Show answer and explanation
Correct answer: B
Explanation
To meet the requirements, the ACL must allow only HTTP and HTTPS traffic from the 192.168.1.0/24 network to the web server's IP (10.10.10.10) and deny all other traffic. Option 2 achieves this by specifying individual permit statements for HTTP and HTTPS traffic and relying on the implicit 'deny all' at the end of the ACL to block other traffic. Other options fail due to syntax errors or overly permissive rules.
- A. Incorrect.
This option is incorrect because the syntax 'eq 80 443' is invalid in an ACL. Separate statements are required for each port.
- B. Correct.
This is the correct answer. It permits both HTTP (port 80) and HTTPS (port 443) traffic from the 192.168.1.0/24 source to the specific destination of 10.10.10.10, while implicitly denying all other traffic.
- C. Incorrect.
This option is incorrect because it allows traffic from any source to the web server, which does not meet the requirement to restrict the source to the 192.168.1.0/24 network.
- D. Incorrect.
This option is incorrect because the 'permit tcp any any' statement allows all TCP traffic through, overriding the intent to block other traffic to the web server.