nerdexam
CompTIA

SY0-301 · Question #209

Users are unable to connect to the web server at IP 192.168.0.20. Which of the following can be inferred of a firewall that is configured ONLY with the following ACL? PERMIT TCP ANY HOST…

The correct answer is D. It implements an implicit deny. The ACL only permits traffic to 192.168.0.10, so all traffic to 192.168.0.20 is silently dropped by the firewall's implicit deny rule that exists at the end of every ACL.

Security architecture

Question

Users are unable to connect to the web server at IP 192.168.0.20. Which of the following can be inferred of a firewall that is configured ONLY with the following ACL? PERMIT TCP ANY HOST 192.168.0.10 EQ 80 PERMIT TCP ANY HOST 192.168.0.10 EQ 443

Options

  • AIt implements stateful packet filtering.
  • BIt implements bottom-up processing.
  • CIt failed closed.
  • DIt implements an implicit deny.

How the community answered

(43 responses)
  • A
    2% (1)
  • B
    9% (4)
  • C
    14% (6)
  • D
    74% (32)

Why each option

The ACL only permits traffic to 192.168.0.10, so all traffic to 192.168.0.20 is silently dropped by the firewall's implicit deny rule that exists at the end of every ACL.

AIt implements stateful packet filtering.

Stateful packet filtering tracks connection state for return traffic; the ACL provided shows only static permit entries with no indication of stateful inspection.

BIt implements bottom-up processing.

ACLs use top-down processing, matching rules in order from first to last, not bottom-up.

CIt failed closed.

Failing closed means the device blocks all traffic upon a failure event; the firewall here is functioning normally and applying its explicit ACL rules, not in a failed state.

DIt implements an implicit deny.Correct

Firewalls and routers automatically append an implicit 'deny all' to the end of every ACL. Because the ACL shown only explicitly permits TCP port 80 and 443 to host 192.168.0.10, any traffic destined for 192.168.0.20 matches no permit rule and is dropped by this implicit deny, explaining why users cannot connect.

Concept tested: Firewall ACL implicit deny behavior

Source: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

Topics

#firewall ACL#implicit deny#packet filtering#network access control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-301 Practice