N10-009 Question 34
Single answerNetwork security listsA network administrator is hardening a perimeter router that connects the internal 10.20.30.0/24 subnet to the internet. The company hosts a public web server at 10.20.30.50 using static NAT to a public IP. Employees on the internal subnet must still be able to browse the web and use DNS normally. Management wants to reduce exposure by allowing only inbound HTTP and HTTPS traffic from the internet to the web server while blocking all other unsolicited inbound traffic. Which access control list (ACL) implementation BEST meets this requirement?
- A
Apply an extended ACL inbound on the internet-facing interface permitting TCP any to host 10.20.30.50 eq 80 and eq 443, then deny the remaining inbound traffic.
- B
Apply a standard ACL outbound on the internal interface permitting only source 10.20.30.50 and denying all other traffic.
- C
Apply an extended ACL inbound on the internal interface permitting TCP host 10.20.30.50 to any eq 80 and eq 443, then deny all other traffic.
- D
Apply a standard ACL inbound on the internet-facing interface permitting the public IP of the web server and denying all other traffic.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use an extended ACL inbound on the internet-facing interface, permitting only TCP traffic destined for the web server on ports 80 and 443 and denying other unsolicited inbound traffic. Extended ACLs are appropriate when filtering must consider protocol and port numbers. Standard ACLs are too limited because they match only source IP addresses. From an operational standpoint, placing the ACL as close to the source of unwanted traffic as possible is a widely accepted best practice because it prevents unnecessary traffic from traversing the network. This aligns with common networking guidance from vendors such as Cisco on ACL design and placement: use extended ACLs near the source when possible, especially for edge filtering scenarios.
- A. Correct.
Correct. An extended ACL can filter by protocol, source, destination, and port, which is necessary here because the requirement is specifically to allow only inbound HTTP (TCP 80) and HTTPS (TCP 443) traffic to a single internal server while blocking other unsolicited inbound connections. Placing it inbound on the internet-facing interface stops unwanted traffic as early as possible, which is a common best practice for reducing unnecessary load and exposure.
- B. Incorrect.
Incorrect. A standard ACL filters only on source IP address, not destination port or protocol. It also does not meet the requirement to allow only HTTP and HTTPS inbound to the server. Applying it outbound on the internal interface would be an imprecise and poor placement for controlling unsolicited inbound internet traffic.
- C. Incorrect.
Incorrect. This ACL is written in the wrong traffic direction for the stated goal. It permits traffic sourced from the web server going out to any destination on ports 80 and 443, which would affect outbound traffic from the server rather than inbound traffic from the internet to the server. This is a common confusion between source/destination matching and interface direction.
- D. Incorrect.
Incorrect. A standard ACL on the internet-facing interface can match only source IP addresses, not the destination TCP ports 80 and 443. Even if it references the web server's public IP, it cannot distinguish web traffic from other traffic types, so it would not satisfy the requirement to allow only HTTP and HTTPS.