nerdexam
Cisco

300-410 · Question #88

During the maintenance window an administrator accidentally deleted the Telnet-related configuration that permits a Telnet connection from the inside network (Eth0/0) to the outside of the network onl

The correct answer is C. interface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit tcp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic Friday Saturday Sunday 22:00 to 05:00. To permit Telnet from an inside network to an outside network only during specified weekend night hours, an ACL with a time-range using TCP port 23 must be applied.

Infrastructure Security

Question

During the maintenance window an administrator accidentally deleted the Telnet-related configuration that permits a Telnet connection from the inside network (Eth0/0) to the outside of the network only between Friday, Sunday night hours only. Which configuration resolves the issue?

Exhibit

300-410 question #88 exhibit

Options

  • Ainterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit tcp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic 22:00 to 05:00
  • Binterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit udp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic Friday Saturday Sunday
  • Cinterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit tcp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic Friday Saturday Sunday 22:00 to 05:00
  • Dinterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit udp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic Friday Saturday Sunday 22:00 to 05:00

How the community answered

(24 responses)
  • A
    8% (2)
  • B
    4% (1)
  • C
    71% (17)
  • D
    17% (4)

Why each option

To permit Telnet from an inside network to an outside network only during specified weekend night hours, an ACL with a time-range using TCP port 23 must be applied.

Ainterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit tcp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic 22:00 to 05:00

The time-range `periodic 22:00 to 05:00` applies every day, not just on Friday and Sunday nights as specified in the requirement.

Binterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit udp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic Friday Saturday Sunday

Telnet uses TCP port 23, not UDP, rendering this ACL ineffective for Telnet connections.

Cinterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit tcp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic Friday Saturday Sunday 22:00 to 05:00Correct

This configuration correctly permits TCP traffic (for Telnet, port 23) from the inside network (10.1.0.0/24) to the outside network (172.16.1.0/24). The time-range `periodic Friday Saturday Sunday 22:00 to 05:00` correctly defines the weekend night hours, allowing Telnet connections from Friday 22:00 to Monday 05:00, encompassing the 'Friday, Sunday night hours' requirement.

Dinterface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit udp 10.1.0.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range changewindow ! time-range changewindow periodic Friday Saturday Sunday 22:00 to 05:00

Telnet uses TCP port 23, not UDP, rendering this ACL ineffective for Telnet connections.

Concept tested: Configuring time-based access control lists (ACLs)

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-v1.html

Topics

#Access Control Lists (ACLs)#Time-based ACLs#Telnet#Interface Configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-410 Practice