What is the result of applying this access control list? ip access-list extended STATEFUL 10 permit tcp any any established 20 deny ip any any

Question

Options

• ATCP traffic with the URG bit set is allowed
• BTCP traffic with the SYN bit set is allowed
• CTCP traffic with the ACK bit set is allowed
• DTCP traffic with the DF bit set is allowed

• A
  3% (1)
• C
  95% (35)
• D
  3% (1)

Explanation

Explanation

Option C is correct because the established keyword in an extended ACL matches TCP segments that have the ACK or RST bit set, which indicates the traffic is part of an already-established TCP connection (i.e., return traffic responding to an outbound session). This effectively creates a stateful-like behavior by allowing return TCP traffic while blocking unsolicited inbound connections.

Why the distractors are wrong:

• A (URG bit): The established keyword does not check the URG bit; URG is used for urgent data prioritization and is unrelated to connection state matching.
• B (SYN bit): A SYN-only packet (used to initiate a new connection) would be denied, because it lacks the ACK bit - this is precisely what makes the ACL "stateful-like," blocking new inbound TCP connections.
• D (DF bit): The DF (Don't Fragment) bit is an IP header flag related to fragmentation, not TCP connection state, and is completely irrelevant to the established keyword.

Memory Tip: Think of established as the "ACK = you're allowed back in" rule - only reply traffic carrying an ACK (or RST) gets through, while fresh SYN packets (new connection attempts) are stopped at the door.

No community discussion yet for this question.