Refer to the exhibit. An engineer is scripting ACLs to handle traffic on the given network. The engineer must block users on the network between R1 and R2 from leaving the network through R5, but…

A 'permit any' ACL on the R1 interface to R2 in the egress direction would allow all traffic between R1 and R2, and if applied at R5, it would permit all external traffic, which contradicts the goal of blocking external access.

Applying an ACL that only permits traffic to any internal address 'to the R5 interfaces to' (presumably facing the external network) would not explicitly deny external traffic, relying solely on an implicit deny, and the application point is ambiguous.

An ACL that denies traffic to any internal address would prevent users from accessing internal resources, which directly violates the requirement that users 'must still be able to access all resources within the administrative domain'.

This configuration precisely meets the requirements by explicitly permitting traffic destined for all internal networks, followed by an implicit 'deny any' for all other traffic. This ensures users can access internal resources but are blocked from reaching external destinations through R5.