The ACL configuration of a router is as shown in the figure. [Huawei] acl adv 3000 [Huawei-acl-adv-3000] rule 3 deny tcp source 192.168.1.0 0.0.0.255 destination 10.167.12.1 0 destination-port eq 23…

Question

Options

• AAccessing all hosts in the 10.167.12.0/24 network segment through Telnet from the 192.168.1.0/24 network segment is allowed
• BAccessing from all hosts in the 10.167.12.1 address through SSH from the 192.168.1.0/24 network segment is denied.
• CTraffic in this device from the 192.168.1.0/24 network segment to the host address other than 10.167.12.1 is not allowed to pass.
• DAccessing all hosts in the 10.167.12.0/24 network segment through remote desktop from the 192.168.1.0/24 network segment is allowed

• A
  4% (1)
• B
  11% (3)
• C
  4% (1)
• D
  81% (22)

Explanation

Option D is correct because Remote Desktop Protocol (RDP) uses TCP port 3389, which is not matched by either ACL rule - Rule 3 only denies port 23 (Telnet) and Rule 5 only permits port 22 (SSH), both targeted at the single host 10.167.12.1. In Huawei's traffic-filter implementation, packets that match no explicit rule are permitted by default, so RDP traffic to any host in 10.167.12.0/24 passes freely.

Why the distractors are wrong:

• A is wrong - Telnet (port 23) to 10.167.12.1 is explicitly denied by Rule 3, so Telnet is not allowed to all hosts in that segment.
• B is wrong - Rule 5 explicitly permits SSH (port 22) to 10.167.12.1, so SSH access is allowed, not denied.
• C is wrong - Traffic destined for addresses other than 10.167.12.1 matches no rule at all and is therefore permitted by default, not blocked.

Memory tip: Think of Huawei traffic-filter as "guilty until proven innocent" only for what you name - anything the rules don't mention walks right through. Contrast this with firewall zone policies, which default-deny. On exams, spotting an unmentioned port (like RDP here) is the fastest path to the correct answer.

No community discussion yet for this question.