Refer to the exhibit. A network engineer must correct the security policy on the EDGE_R router, which is connected to two Tier 1 ISPs. After another engineer added ip as-path access-list 11 permit 11

Question

Exhibit

Options

• AConfigure ip as-path distribution-list 11 deny *[0-9]+$.
• BConfigure ip as-path access-list 11 deny_4832$.
• CConfigure ip as-path access-list 11 permit_11_.
• DConfigure ip as-path prefix-list 11 permit_11$.

• A
  12% (4)
• B
  79% (26)
• C
  6% (2)
• D
  3% (1)

Explanation

Option B is correct because adding ip as-path access-list 11 deny _4832$ precisely targets routes originating from AS 4832: the trailing $ anchors to the end of the AS path (the rightmost AS = the originating AS), and the leading _ acts as a delimiter, together matching only paths where AS 4832 is the origin. Placed before the existing permit 11 entry, it blocks AS 4832 routes (which carry paths like 11 4832) before the broader permit can match them.

Why the distractors fail:

• A uses ip as-path distribution-list, which is not a valid Cisco IOS command - the correct syntax is ip as-path access-list.
• C uses permit _11_, where the underscore acts as a wildcard delimiter matching start/end of string too - so a path like 11 4832 still matches (_ at the front matches ^), meaning AS 4832 routes are still permitted.
• D uses ip as-path prefix-list, another non-existent command; the correct term is access-list, not prefix-list.

Memory tip: In BGP AS-path regex, $ means "end of the AS path," which is always the originating AS - so _4832$ reads as "a path where AS 4832 originated the route." Anchoring with $ is the key to filtering by origin versus transit.

No community discussion yet for this question.