350-401 Question 254
Select 3A network administrator is tasked with implementing an ACL on a router to allow HTTP and HTTPS traffic from a specific subnet (192.168.10.0/24) to a web server (10.1.1.10) while blocking all other traffic. Which of the following ACL entries should be included in the configuration?
- A
permit tcp 192.168.10.0 0.0.0.255 10.1.1.10 0.0.0.0 eq 80
- B
permit tcp 192.168.10.0 0.0.0.255 10.1.1.10 0.0.0.0 eq 443
- C
deny ip 192.168.10.0 0.0.0.255 any
- D
permit ip any any
- E
deny ip any any
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the scenario requirements, the ACL must explicitly allow HTTP and HTTPS traffic (ports 80 and 443) from the 192.168.10.0/24 subnet to the web server (10.1.1.10). A 'deny ip any any' statement is also necessary to block all other traffic. The correct ACL entries should permit the required traffic first and then deny all other traffic to enforce the intended restrictions.
- A. Correct.
This entry allows HTTP (port 80) traffic from the 192.168.10.0/24 subnet to the web server at 10.1.1.10, which is required as per the scenario.
- B. Correct.
This entry allows HTTPS (port 443) traffic from the 192.168.10.0/24 subnet to the web server at 10.1.1.10, which is also required.
- C. Incorrect.
This entry denies all IP traffic from the 192.168.10.0/24 subnet to any destination. However, this would conflict with the requirement to allow HTTP and HTTPS traffic, so it is not correct.
- D. Incorrect.
This is a general permit statement that allows all traffic from any source to any destination. It is not specific to the scenario and violates the need for controlled traffic, hence it is incorrect.
- E. Correct.
This entry denies all other traffic (after the specific permit statements) and is needed to ensure only HTTP and HTTPS traffic is allowed as required.