nerdexam
Cisco

200-901 · Question #303

Refer to the exhibit. A developer can access the TLS REST API on server A, but cannot access the API on server B. The developer can ping server B. When the developer performs a packet capture on the T

The correct answer is C. Port 443 is blocked on the incoming interface of firewall B.. The developer cannot access the TLS REST API on server B, despite being able to ping it and a packet capture on server B showing some response, because firewall B is blocking incoming TCP port 443.

Question

Refer to the exhibit. A developer can access the TLS REST API on server A, but cannot access the API on server B. The developer can ping server B. When the developer performs a packet capture on the TLS REST API port on server B, the capture shows that the packet arrived and the server responded. What causes the issue?

Exhibit

200-901 question #303 exhibit

Options

  • APort 80 is blocked on the outgoing interface of firewall B.
  • BPort 443 is blocked on the outgoing interface of firewall A.
  • CPort 443 is blocked on the incoming interface of firewall B.
  • DPort 80 is blocked on the incoming interface of firewall A.

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    83% (19)
  • D
    9% (2)

Why each option

The developer cannot access the TLS REST API on server B, despite being able to ping it and a packet capture on server B showing some response, because firewall B is blocking incoming TCP port 443.

APort 80 is blocked on the outgoing interface of firewall B.

Port 80 is for HTTP, not TLS, and blocking it on the outgoing interface of firewall B would affect server B's ability to initiate connections, not receive them.

BPort 443 is blocked on the outgoing interface of firewall A.

If port 443 were blocked on the outgoing interface of firewall A, the developer would not be able to access the TLS REST API on *any* server, including server A, contradicting the statement that server A can be accessed.

CPort 443 is blocked on the incoming interface of firewall B.Correct

If a developer can ping server B but cannot access its TLS REST API, it strongly indicates that a firewall is blocking TCP port 443 (the standard port for TLS/HTTPS) on the incoming path to server B. Although a packet capture on server B might show an initial response, a firewall can still block the complete connection establishment, causing the client-side access to fail.

DPort 80 is blocked on the incoming interface of firewall A.

Port 80 is for HTTP, not TLS, and blocking incoming traffic on firewall A (the client's side) would not prevent the client from initiating an outgoing connection to server B.

Concept tested: Troubleshooting firewall rules for TCP services

Source: https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfport.html

Community Discussion

No community discussion yet for this question.

Full 200-901 Practice