HPE7-A02 · Question #56
A port-access role for AOS-CX switches has this policy applied to it: plaintext Copy code port-access policy mypolicy 10 class ip zoneC action drop 20 class ip zoneA action drop 100 class ip zoneB…
The correct answer is A. Add this rule to zoneC: 5 match any 10.2.12.0/24 eq https. The requirement is to permit HTTPS traffic from clients to the 10.2.12.0/24 subnet. ZoneC is configured to drop all HTTPS traffic to the 10.2.0.0/16 subnet. Therefore, the first match in the zoneC class (priority 10) will drop the desired traffic. To override this behavior, you…
Question
A port-access role for AOS-CX switches has this policy applied to it:
plaintext Copy code port-access policy mypolicy 10 class ip zoneC action drop 20 class ip zoneA action drop 100 class ip zoneB The classes have this configuration:
plaintext Copy code class ip zoneC 10 match tcp 10.2.0.0/16 eq https class ip zoneA 10 match ip any 10.1.0.0/16 class ip zoneB 10 match ip any 10.0.0.0/8 The company wants to permit clients in this role to access 10.2.12.0/24 with HTTPS. What should you do?
Options
- AAdd this rule to zoneC: 5 match any 10.2.12.0/24 eq https
- BAdd this rule to zoneA: 5 ignore tcp any 10.2.12.0/24 eq https
- CAdd this rule to zoneB: 5 match tcp any 10.2.12.0/24 eq https
- DAdd this rule to zoneC: 5 ignore tcp any 10.2.12.0/24 eq https
How the community answered
(53 responses)- A55% (29)
- B13% (7)
- C8% (4)
- D25% (13)
Explanation
The requirement is to permit HTTPS traffic from clients to the 10.2.12.0/24 subnet. ZoneC is configured to drop all HTTPS traffic to the 10.2.0.0/16 subnet. Therefore, the first match in the zoneC class (priority 10) will drop the desired traffic. To override this behavior, you must add a higher-priority rule (lower rule number) to zoneC that explicitly matches 10.2.12.0/24 and permits the traffic. Thus, adding the rule 5 match any 10.2.12.0/24 eq https to zoneC ensures the desired traffic is permitted while maintaining the drop behavior for the rest of 10.2.0.0/16.
Topics
Community Discussion
No community discussion yet for this question.