Refer to the exhibit. Which command set must be added to permit and log all traffic that comes from 172.20.10.1 in interface GigabitEthernet0/1 without impacting the functionality of the access…

Question

Exhibits

Options

• ARouter(config)#access-list 100 permit ip 172.20.10.1 any log Router(config-if)#interface GigabitEthernet0/1 Router(config-if)#access-group 100 in
• BRouter(config)#access-list 100 seq 5 permit ip host 172.20.10.1 any log Router(config)#interface GigabitEthernet0/1 Router(config-if)#access-group 100 in
• CRouter(config)#ip access-list extended 100 Router(config-ext-nacl)#5 permit ip 172.20.10.0 0.0.0.255 any log Router(config)#interface GigabitEthernet0/1 Router(config-if)#access-group 100 in
• DRouter(config)#no access-list 100 permit ip 172.16.0.0 0.0.15.255 any Router(config)#access-list 100 permit ip 172.16.0.0 0.0.15.255 any log Router(config)#interface GigabitEthernet0/1 Router(config-if)#access-group 100 in

• A
  71% (30)
• B
  5% (2)
• C
  17% (7)
• D
  7% (3)

Explanation

Option A correctly appends a single permit + log statement to the existing numbered ACL 100 and re-applies it to the interface. Because Cisco IOS appends new entries to numbered ACLs without disturbing existing ones, the existing rules remain intact and functional.

Why the distractors fail:

• B uses the seq keyword (access-list 100 seq 5 ...), which is invalid syntax for numbered ACLs - sequence-based insertion only works with named ACLs (ip access-list extended).
• C uses the wildcard 0.0.0.255, which matches the entire 172.20.10.0/24 subnet rather than the specific host 172.20.10.1, so it over-permits beyond what the question requires.
• D is the most dangerous: no access-list 100 permit ip ... on a numbered ACL deletes the entire ACL, not just that one line - this completely breaks existing functionality before re-adding a partial rule.

Memory tip: Think of numbered ACLs as a one-way tape - you can only append to the end or delete the whole thing. If you need to insert, delete a single line, or reorder entries, you must convert to a named ACL (ip access-list extended). This distinction is a frequent exam trap.

No community discussion yet for this question.