200-101 · Question #185
Refer to the exhibit. Statements A, B, C, and D of ACL 10 have been entered in the shown order and applied to interface E0-inbound, to prevent all hosts (except those whose addresses are the first and
The correct answer is D. CDBA. The correct order is CDBA. The subnet 172.21.1.128/28 has a range of 172.21.1.129–172.21.1.142, with .129 as the first host and .142 as the last. The ACL must first explicitly permit those two specific hosts before denying the rest of the subnet. The current order fails because a
Question
Options
- AACDB
- BBADC
- CDBAC
- DCDBA
How the community answered
(54 responses)- A4% (2)
- B17% (9)
- C11% (6)
- D69% (37)
Explanation
The correct order is CDBA. The subnet 172.21.1.128/28 has a range of 172.21.1.129–172.21.1.142, with .129 as the first host and .142 as the last. The ACL must first explicitly permit those two specific hosts before denying the rest of the subnet. The current order fails because a broad deny (or permit) statement appears before the specific permit entries, so ACL processing stops at that first match and the specific host permits are never reached. The CDBA order places the specific permit for the last host (C), then the specific permit for the first host (D), then a broader deny for the subnet (B), then the permit or deny for all other traffic (A). Specific entries must always precede general ones.
Topics
Community Discussion
No community discussion yet for this question.