nerdexam
Cisco

300-415 · Question #10

Refer to the exhibit. Which QoS treatment results from this configuration after the access list acl-guest is applied inbound on the vpn1 interface? policy policer ccnp rate 1000000 burst 15000…

The correct answer is C. A UDP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped. The access-list 'acl-guest' is configured to match TCP traffic (protocol 6) from 172.16.10.0/24 to 172.16.20.0/24 on destination port 20, applying a policer to it.

Security and Quality of Service

Question

Refer to the exhibit. Which QoS treatment results from this configuration after the access list acl-guest is applied inbound on the vpn1 interface? policy policer ccnp rate 1000000 burst 15000 exceed drop ! access-list acl-guest sequence 1 match source-ip 172.16.10.0/24 destination-ip 172.16.20.0/24 destination-port 20 protocol 6 ! action accept policer ccnp ! ! default-action drop

Options

  • AA TCP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped
  • BA UDP packet sourcing from 172.16.10.1 and destined to 172.16.10.1 is accepted
  • CA UDP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped
  • DA TCP packet sourcing from 172.16.10.1 and destined to 172.16.10.1 is accepted

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    77% (17)
  • D
    14% (3)

Why each option

The access-list 'acl-guest' is configured to match TCP traffic (protocol 6) from 172.16.10.0/24 to 172.16.20.0/24 on destination port 20, applying a policer to it.

AA TCP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped

A TCP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 on destination port 20 would match sequence 1 and be subjected to the policer, not directly dropped by the default action.

BA UDP packet sourcing from 172.16.10.1 and destined to 172.16.10.1 is accepted

A UDP packet sourcing from 172.16.10.1 and destined to 172.16.10.1 fails on both protocol (UDP vs. TCP) and destination IP range, thus it would be dropped by the default-action drop.

CA UDP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is droppedCorrect

A UDP packet (protocol 17) sourcing from 172.16.10.1 and destined to 172.16.20.1 does not match the 'protocol 6' (TCP) condition in sequence 1 of the 'acl-guest' access list. Since the packet does not match the explicit 'action accept' and the default action is 'drop', this UDP packet will be dropped.

DA TCP packet sourcing from 172.16.10.1 and destined to 172.16.10.1 is accepted

A TCP packet sourcing from 172.16.10.1 and destined to 172.16.10.1 fails on the destination IP range (172.16.10.1 is not in 172.16.20.0/24), thus it would be dropped by the default-action drop.

Concept tested: SD-WAN localized policy matching and actions

Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policy/sdwan-policy-book/localized-policy.html

Topics

#QoS#Policing#Access Control List#Traffic Classification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-415 Practice