350-501 · Question #591
Refer to the exhibit. A network engineer installed router R1 as the new core router and must secure the control plane. The configuration has been applied, and now the engineer is creating ACL 120. Onl
The correct answer is A. access-list 120 deny tcp any any eq telnet. The engineer is creating an Access Control List (ACL) 120 that identifies Telnet traffic not from specific allowed hosts, which will then be subject to rate-limiting and dropping by a Control Plane Policing (CoPP) policy.
Question
Refer to the exhibit. A network engineer installed router R1 as the new core router and must secure the control plane. The configuration has been applied, and now the engineer is creating ACL 120. Only hosts 192.168.1.1 and 192.168.2.2 should be allowed to access the router using Telnet. All other hosts should be rate-limited, with excess traffic dropped. Which configuration accomplishes this goal?
Exhibit
Options
- Aaccess-list 120 deny tcp any any eq telnet
- Baccess-list 120 deny tcp host 192.168.1.1 any eq telnet
- Caccess-list 120 permit tcp host 192.168.1.1 any eq telnet
- Daccess-list 120 permit tcp any any eq telnet
How the community answered
(22 responses)- A68% (15)
- B5% (1)
- C9% (2)
- D18% (4)
Why each option
The engineer is creating an Access Control List (ACL) 120 that identifies Telnet traffic not from specific allowed hosts, which will then be subject to rate-limiting and dropping by a Control Plane Policing (CoPP) policy.
The 'access-list 120 deny tcp any any eq telnet' command, when used in conjunction with a Control Plane Policing (CoPP) policy, serves to classify all Telnet traffic destined for the router that is not explicitly permitted by higher-priority ACLs, allowing the CoPP policy to apply rate-limiting and dropping to this 'other' traffic.
The 'access-list 120 deny tcp host 192.168.1.1 any eq telnet' command would specifically deny Telnet access from host 192.168.1.1, which contradicts the requirement to allow this host access.
The 'access-list 120 permit tcp host 192.168.1.1 any eq telnet' command would permit Telnet access from host 192.168.1.1, but it does not address the requirement to rate-limit or drop Telnet traffic from all other hosts.
The 'access-list 120 permit tcp any any eq telnet' command would permit all Telnet traffic, failing to implement any restrictions or rate-limiting for other hosts.
Concept tested: Control Plane Policing (CoPP) ACL Classification
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos/configuration/xe-3s/qos-xe-3s-book/qos-copp.html
Topics
Community Discussion
No community discussion yet for this question.
