nerdexam
Cisco

200-150 · Question #138

On a Cisco Nexus switch, you need to configure an ACL that permits HTTP traffic only from network 10.68.68.0/24 to network 10.68.69.0/24. Which command should you use?

The correct answer is B. switch(config)# ip access-list test. This question tests the correct syntax for configuring a named extended ACL on a Cisco Nexus switch to permit HTTP traffic between two specific subnets.

Cisco Data Center Network Services

Question

On a Cisco Nexus switch, you need to configure an ACL that permits HTTP traffic only from network 10.68.68.0/24 to network 10.68.69.0/24. Which command should you use?

Options

  • Aswitch(config)# ip access-list test
  • Bswitch(config)# ip access-list test
  • Cswitch(config)# ip access-list test
  • Dswitch(config)# ip access-list test

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    83% (30)
  • C
    6% (2)
  • D
    8% (3)

Why each option

This question tests the correct syntax for configuring a named extended ACL on a Cisco Nexus switch to permit HTTP traffic between two specific subnets.

Aswitch(config)# ip access-list test

This choice uses incorrect ACL rule syntax or parameters that do not properly match TCP port 80 between the specified source and destination networks.

Bswitch(config)# ip access-list testCorrect

The correct configuration enters named ACL mode with 'ip access-list test' and then adds a permit rule specifying TCP as the protocol, source network 10.68.68.0 0.0.0.255, destination network 10.68.69.0 0.0.0.255, and destination port eq 80 to match HTTP. Cisco Nexus NX-OS named extended ACLs require explicitly matching the transport protocol and port number to restrict traffic to a specific application like HTTP.

Cswitch(config)# ip access-list test

This choice contains an ACL permit statement with an incorrect protocol, port, or network specification that fails to isolate HTTP traffic between the two subnets.

Dswitch(config)# ip access-list test

This choice uses wrong parameters such as incorrect wildcard masks, port operators, or protocol identifiers that prevent it from accurately matching HTTP traffic.

Concept tested: Named extended ACL syntax on Cisco Nexus NX-OS

Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/security/configuration/guide/b-cisco-nexus-9000-nx-os-security-configuration-guide-93x/b-cisco-nexus-9000-nx-os-security-configuration-guide-93x_chapter_01001.html

Topics

#ACL#Nexus switch#HTTP filtering#NX-OS

Community Discussion

No community discussion yet for this question.

Full 200-150 Practice