N10-009 Question 35
Single answerNetwork security listsA network administrator is hardening traffic between subnets by applying an IPv4 ACL on the router interface connected to the server VLAN. Users in the client VLAN should be able to access only HTTPS on the web server at 10.10.50.20. SSH to the server must be blocked from the client VLAN, while management hosts in 10.10.99.0/24 must still be able to use SSH. The administrator wants to stop unwanted traffic as close to the source as practical without affecting other traffic. Which ACL implementation best meets these requirements?
- A
Apply a standard ACL inbound on the server VLAN interface that permits traffic from the client VLAN and denies traffic from all other subnets.
- B
Apply an extended ACL inbound on the client VLAN interface that permits TCP from the client VLAN to 10.10.50.20 on port 443, denies TCP from the client VLAN to 10.10.50.20 on port 22, permits TCP from 10.10.99.0/24 to 10.10.50.20 on port 22, and then permits other required traffic.
- C
Apply an extended ACL outbound on the client VLAN interface that denies TCP port 22 to 10.10.50.20 and relies on the implicit permit for HTTPS traffic.
- D
Apply a standard ACL outbound on the server VLAN interface that denies source 10.10.99.0/24 and permits all other traffic to the web server.
Show answer and explanation
Correct answer: B
Explanation
The best answer is the extended ACL applied inbound on the client VLAN interface. In practical Network+ scenarios, standard ACLs match only source addresses, while extended ACLs can match source, destination, protocol, and port. Because the requirement is service-specific, the administrator must use an extended ACL. Best practice is to place extended ACLs as close to the traffic source as possible to reduce unnecessary transit of unwanted traffic, while standard ACLs are commonly placed closer to the destination because they are broader and can block more than intended. Another key concept is the implicit deny at the end of ACLs, so explicit permit statements are needed for allowed traffic. These behaviors are consistent with common router ACL implementation guidance from major networking vendors such as Cisco and align with the access control principles typically tested on Network+.
- A. Incorrect.
Incorrect. A standard ACL filters only by source IP address, not by protocol or destination port. It cannot distinguish HTTPS from SSH traffic to the same server. Placing it on the server VLAN interface also does not stop unwanted traffic as close to the source as practical; standard ACLs are typically placed closer to the destination because they are less granular.
- B. Correct.
Correct. An extended ACL can match source, destination, protocol, and port, which is required here to allow HTTPS but block SSH from the client VLAN while still permitting SSH from the management subnet. Applying the ACL inbound on the client VLAN interface aligns with best practice for extended ACLs: place them as close to the source as possible to prevent unnecessary traffic from traversing the network. The mention of permitting other required traffic is important because ACLs include an implicit deny at the end.
- C. Incorrect.
Incorrect. ACLs do not have an implicit permit at the end; they have an implicit deny. If the administrator only adds a deny statement and applies the ACL outbound on the client VLAN interface, other traffic may be unintentionally blocked unless explicitly permitted. In addition, placing the ACL outbound on the client interface is not the best choice for stopping unwanted traffic near the source.
- D. Incorrect.
Incorrect. A standard ACL cannot filter by TCP port, so it cannot specifically block SSH while allowing HTTPS. It also denies the management subnet, which is the opposite of the requirement to allow SSH from 10.10.99.0/24. This reflects a common misconception that any ACL can filter by service/port.