Refer to the exhibit. An engineer must troubleshoot an issue with excessive SSH traffic leaving the internal network between the hours of 18:00 and 08:00. The engineer applies a policy to the Cisco…

Question

Exhibit

Options

• AChange the time of rule 2.
• BDelete rule 4
• CDelete rule 3
• DChange the time of rule 5

• A
  4% (2)
• B
  69% (34)
• C
  10% (5)
• D
  16% (8)

Explanation

Deleting rule 4 is correct because Cisco ASA processes access control rules top-to-bottom, first match wins. Rule 4 is a broad permit rule that matches SSH traffic without a time restriction, meaning it allows outbound SSH before the engineer's time-based blocking rule is ever evaluated - the block rule is simply never reached during off-hours.

Why the distractors are wrong:

• A (Change time of rule 2): Rule 2 is not the rule permitting the SSH traffic that's bypassing the block; modifying its time range doesn't remove the unconditional permit in rule 4.
• C (Delete rule 3): Rule 3 is either a legitimate or already-restricted rule unrelated to the bypass; removing it could break valid traffic without solving the problem.
• D (Change time of rule 5): Rule 5 likely already has the correct time range for blocking, but it's irrelevant because rule 4 matches SSH first and the engine never reaches rule 5.

Memory tip: Think of firewall rules like a traffic cop line - the first cop to flag down a packet makes the call. If a "let it through" cop (rule 4) stands ahead of your "stop after 6pm" cop (the block rule), the block never applies. Always audit rules above your new policy for conflicting permits.

No community discussion yet for this question.