200-901 · Question #303
Refer to the exhibit. A developer can access the TLS REST API on server A, but cannot access the API on server B. The developer can ping server B. When the developer performs a packet capture on the T
The correct answer is C. Port 443 is blocked on the incoming interface of firewall B.. The developer cannot access the TLS REST API on server B, despite being able to ping it and a packet capture on server B showing some response, because firewall B is blocking incoming TCP port 443.
Question
Refer to the exhibit. A developer can access the TLS REST API on server A, but cannot access the API on server B. The developer can ping server B. When the developer performs a packet capture on the TLS REST API port on server B, the capture shows that the packet arrived and the server responded. What causes the issue?
Exhibit
Options
- APort 80 is blocked on the outgoing interface of firewall B.
- BPort 443 is blocked on the outgoing interface of firewall A.
- CPort 443 is blocked on the incoming interface of firewall B.
- DPort 80 is blocked on the incoming interface of firewall A.
How the community answered
(23 responses)- A4% (1)
- B4% (1)
- C83% (19)
- D9% (2)
Why each option
The developer cannot access the TLS REST API on server B, despite being able to ping it and a packet capture on server B showing some response, because firewall B is blocking incoming TCP port 443.
Port 80 is for HTTP, not TLS, and blocking it on the outgoing interface of firewall B would affect server B's ability to initiate connections, not receive them.
If port 443 were blocked on the outgoing interface of firewall A, the developer would not be able to access the TLS REST API on *any* server, including server A, contradicting the statement that server A can be accessed.
If a developer can ping server B but cannot access its TLS REST API, it strongly indicates that a firewall is blocking TCP port 443 (the standard port for TLS/HTTPS) on the incoming path to server B. Although a packet capture on server B might show an initial response, a firewall can still block the complete connection establishment, causing the client-side access to fail.
Port 80 is for HTTP, not TLS, and blocking incoming traffic on firewall A (the client's side) would not prevent the client from initiating an outgoing connection to server B.
Concept tested: Troubleshooting firewall rules for TCP services
Source: https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfport.html
Community Discussion
No community discussion yet for this question.
