350-401 Question 252
Single answerA network administrator is tasked with configuring an ACL to allow only HTTP traffic from the 192.168.10.0/24 subnet to the server 10.1.1.10. All other traffic should be denied. Which of the following ACL entries should the administrator configure to achieve this?
- A
access-list 100 permit tcp any host 10.1.1.10 eq 80
- B
access-list 100 permit tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 80
- C
access-list 100 deny ip 192.168.10.0 0.0.0.255 host 10.1.1.10
- D
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
- E
access-list 100 permit tcp host 192.168.10.10 host 10.1.1.10 eq 80
Show answer and explanation
Correct answer: B
Explanation
To meet the requirement, the ACL must allow only HTTP traffic (TCP port 80) from the entire 192.168.10.0/24 subnet to the specific server 10.1.1.10. The correct entry is 'access-list 100 permit tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 80' because it precisely matches these conditions. Other options either allow too much traffic, deny the required traffic, or apply to incorrect sources or destinations.
- A. Incorrect.
This entry allows all TCP traffic from any source to the host 10.1.1.10 on port 80, which does not limit the source to the 192.168.10.0/24 subnet as required.
- B. Correct.
This entry correctly permits only TCP traffic (HTTP) from the 192.168.10.0/24 subnet to the specific host 10.1.1.10 on port 80, which aligns with the requirements.
- C. Incorrect.
This entry denies all IP traffic from the 192.168.10.0/24 subnet to 10.1.1.10, which contradicts the requirement to allow HTTP traffic.
- D. Incorrect.
This entry permits all IP traffic from the 192.168.10.0/24 subnet to any destination, which is too permissive and does not meet the requirement to restrict traffic to HTTP and to a specific destination.
- E. Incorrect.
This entry permits HTTP traffic from a single host (192.168.10.10) to the server 10.1.1.10, but it does not include the entire 192.168.10.0/24 subnet as specified in the requirement.