nerdexam
Cisco

200-150 · Question #41

Which command set creates an access control list on a Cisco Nexus switch to deny only FTP traffic from any source to destination host 10.10.10.10?

The correct answer is D. N5K-A(config)# Ip access-list 101. Denying FTP on a Cisco Nexus switch requires first creating an ACL context with 'ip access-list' and then entering a 'deny tcp' rule specifying the correct destination host and eq ftp.

Cisco Data Center Networking Technologies

Question

Which command set creates an access control list on a Cisco Nexus switch to deny only FTP traffic from any source to destination host 10.10.10.10?

Options

  • AN5K-A(config)# Ip access-list 101
  • BN5K-A(config)# Ip access-list 101
  • CN5K-A(config)# deny tcp any host 10.10.1.110. eq ftp
  • DN5K-A(config)# Ip access-list 101

How the community answered

(64 responses)
  • A
    16% (10)
  • B
    6% (4)
  • C
    5% (3)
  • D
    73% (47)

Why each option

Denying FTP on a Cisco Nexus switch requires first creating an ACL context with 'ip access-list' and then entering a 'deny tcp' rule specifying the correct destination host and eq ftp.

AN5K-A(config)# Ip access-list 101

Choice A contains only the ACL creation command without the accompanying deny statement, leaving the ACL empty and non-functional.

BN5K-A(config)# Ip access-list 101

Choice B is identical to choice A and similarly omits the deny rule required to actually block FTP traffic.

CN5K-A(config)# deny tcp any host 10.10.1.110. eq ftp

Choice C specifies the wrong destination IP address (10.10.1.110 with a stray period instead of 10.10.10.10), making the rule syntactically invalid and targeting the wrong host.

DN5K-A(config)# Ip access-list 101Correct

Choice D represents the complete two-step command set: 'ip access-list 101' to enter the numbered extended ACL configuration context, followed by 'deny tcp any host 10.10.10.10 eq ftp' to block TCP port 21 (FTP) from any source to the target host. This is valid NX-OS syntax for creating a numbered ACL with a protocol-specific deny entry targeting a single host.

Concept tested: Cisco Nexus extended ACL configuration for FTP filtering

Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/security/503_n2_1/b_Cisco_n5k_security_config_gd_503_N2_1/b_Cisco_n5k_security_config_gd_503_N2_1_chapter_01001.html

Topics

#ACL configuration#Nexus switch#FTP filtering#access control list

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-150 Practice