350-401 Question 553
Single answerA network administrator is tasked with configuring an access control list (ACL) to block HTTP traffic (TCP port 80) from a specific host (192.168.1.10) to the server at 10.1.1.100, but only during business hours from 9:00 AM to 5:00 PM. What type of ACL configuration is required, and which command should be used within the ACL configuration?
- A
Use a standard numbered ACL and the command: access-list 10 deny 192.168.1.10 10.1.1.100 eq 80
- B
Use an extended named ACL and the command: ip access-list extended BusinessACL deny tcp host 192.168.1.10 host 10.1.1.100 eq 80 time-range BusinessHours
- C
Use a time-based standard ACL and the command: access-list 10 deny host 192.168.1.10 eq 80 time-range BusinessHours
- D
Use an extended numbered ACL and the command: access-list 101 deny tcp 192.168.1.10 host 10.1.1.100 eq 80
- E
Configure a time range with the command: time-range BusinessHours permit tcp host 192.168.1.10 host 10.1.1.100 eq 80
Show answer and explanation
Correct answer: B
Explanation
Time-based extended ACLs are required to block specific traffic during certain hours. In this scenario, the administrator needs to use an extended ACL to filter traffic based on the source IP address (192.168.1.10), destination IP address (10.1.1.100), protocol (TCP), port number (80), and time range (BusinessHours). Option 2 correctly uses an extended named ACL with a time range to achieve the desired outcome.
- A. Incorrect.
Standard ACLs only filter traffic based on source IP address and cannot specify protocols, ports, or time ranges. This configuration is incorrect for the given requirements.
- B. Correct.
Extended ACLs allow filtering based on source/destination IP, protocols, ports, and time ranges. Specifying a time-range (e.g., BusinessHours) in the ACL correctly meets the requirement to block HTTP traffic during business hours.
- C. Incorrect.
Time-based standard ACLs do not exist. Standard ACLs cannot filter traffic based on ports or time ranges, so this configuration is invalid.
- D. Incorrect.
Extended numbered ACLs support filtering based on protocols and ports, but this configuration does not include a time range. Without a time range, the traffic would be blocked permanently, not just during business hours.
- E. Incorrect.
The time-range configuration is used to define the permissible time period but does not independently block traffic. It must be referenced within an ACL for proper functionality.