SY0-701 · Question #501
The security team has been asked to only enable host A (10.2.2.7) and host B (10.3.9.9) to the new isolated network segment (10.9.8.14) that provides access to legacy devices. Access from all other…
The correct answer is C. Permit 10.2.2.7/32 to 10.9.8.14/27 Permit 10.3.9.9/32 to 10.9.8.14/27 Deny 0.0.0.0/0 to 10.9.8.14/27. Option C is correct because it uses /32 host masks to permit only the specific IP addresses of Host A (10.2.2.7/32) and Host B (10.3.9.9/32), ensuring no other hosts on those subnets gain access. The final 'Deny 0.0.0.0/0' rule acts as an explicit catch-all to block all other…
Question
The security team has been asked to only enable host A (10.2.2.7) and host B (10.3.9.9) to the new isolated network segment (10.9.8.14) that provides access to legacy devices. Access from all other hosts should be blocked. Which of the following entries would need to be added on the firewall? A. B. C. D.
Options
- APermit 10.2.2.0/24 to 10.9.8.14/27 Permit 10.3.9.0/24 to 10.9.8.14/27 Deny 0.0.0.0/0 to 10.9.8.14/27
- BDeny 0.0.0.0/0 to 10.9.8.14/27 Permit 10.2.2.0/24 to 10.9.8.14/27 Permit 10.3.9.0/24 to 10.9.8.14/27
- CPermit 10.2.2.7/32 to 10.9.8.14/27 Permit 10.3.9.9/32 to 10.9.8.14/27 Deny 0.0.0.0/0 to 10.9.8.14/27
- DPermit 10.2.2.7/32 to 10.9.8.14/27 Permit 10.3.9.0/24 to 10.9.8.14/27 Deny 10.9.8.14/27 to 0.0.0.0/0
How the community answered
(58 responses)- A16% (9)
- B3% (2)
- C72% (42)
- D9% (5)
Explanation
Option C is correct because it uses /32 host masks to permit only the specific IP addresses of Host A (10.2.2.7/32) and Host B (10.3.9.9/32), ensuring no other hosts on those subnets gain access. The final 'Deny 0.0.0.0/0' rule acts as an explicit catch-all to block all other traffic, and firewall rules are processed top-to-bottom so the permits are evaluated before the deny.
Topics
Community Discussion
No community discussion yet for this question.