nerdexam
Cisco

350-501 · Question #591

Refer to the exhibit. A network engineer installed router R1 as the new core router and must secure the control plane. The configuration has been applied, and now the engineer is creating ACL 120. Onl

The correct answer is A. access-list 120 deny tcp any any eq telnet. The engineer is creating an Access Control List (ACL) 120 that identifies Telnet traffic not from specific allowed hosts, which will then be subject to rate-limiting and dropping by a Control Plane Policing (CoPP) policy.

Networking

Question

Refer to the exhibit. A network engineer installed router R1 as the new core router and must secure the control plane. The configuration has been applied, and now the engineer is creating ACL 120. Only hosts 192.168.1.1 and 192.168.2.2 should be allowed to access the router using Telnet. All other hosts should be rate-limited, with excess traffic dropped. Which configuration accomplishes this goal?

Exhibit

350-501 question #591 exhibit

Options

  • Aaccess-list 120 deny tcp any any eq telnet
  • Baccess-list 120 deny tcp host 192.168.1.1 any eq telnet
  • Caccess-list 120 permit tcp host 192.168.1.1 any eq telnet
  • Daccess-list 120 permit tcp any any eq telnet

How the community answered

(22 responses)
  • A
    68% (15)
  • B
    5% (1)
  • C
    9% (2)
  • D
    18% (4)

Why each option

The engineer is creating an Access Control List (ACL) 120 that identifies Telnet traffic not from specific allowed hosts, which will then be subject to rate-limiting and dropping by a Control Plane Policing (CoPP) policy.

Aaccess-list 120 deny tcp any any eq telnetCorrect

The 'access-list 120 deny tcp any any eq telnet' command, when used in conjunction with a Control Plane Policing (CoPP) policy, serves to classify all Telnet traffic destined for the router that is not explicitly permitted by higher-priority ACLs, allowing the CoPP policy to apply rate-limiting and dropping to this 'other' traffic.

Baccess-list 120 deny tcp host 192.168.1.1 any eq telnet

The 'access-list 120 deny tcp host 192.168.1.1 any eq telnet' command would specifically deny Telnet access from host 192.168.1.1, which contradicts the requirement to allow this host access.

Caccess-list 120 permit tcp host 192.168.1.1 any eq telnet

The 'access-list 120 permit tcp host 192.168.1.1 any eq telnet' command would permit Telnet access from host 192.168.1.1, but it does not address the requirement to rate-limit or drop Telnet traffic from all other hosts.

Daccess-list 120 permit tcp any any eq telnet

The 'access-list 120 permit tcp any any eq telnet' command would permit all Telnet traffic, failing to implement any restrictions or rate-limiting for other hosts.

Concept tested: Control Plane Policing (CoPP) ACL Classification

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos/configuration/xe-3s/qos-xe-3s-book/qos-copp.html

Topics

#Control Plane Policing (CoPP)#Access Control List (ACL)#Router Security#Quality of Service (QoS)

Community Discussion

No community discussion yet for this question.

Full 350-501 Practice