CXA - Access Control List

Which of the following answers list a valid number that can be used with extended numbered IP ACLs? (Choose two answers).

• 89

• 123

• 2000

• 1989

In which layer or layers does packet filtering works?

• Layer 3

• Layer 2 and 3

• Layer 4

• Layer 3 and 4

Which of the following wildcard masks is most useful for matching all IP packets in subnet 192.168.128.0/21?

• 0.0.127.255

• 0.0.7.255

• 0.0.0.31

• 0.0.15.255

Which of the following access-list commands matches all packets sent from hosts in subnet 10.1.120.0 255.255.252.0?

• access-list 1 permit 10.1.120.0

• access-list 1 permit 10.1.120.0 0.0.3.255

• access-list 1 permit 10.10.120.0 0.0.3.255

• access-list 1 permit 10.10.0.120 0.0.3.255

On applying an ACL to a router interface, where will an inbound ACL filter its packets?

• Before being routed to the inbound interface.

• After leaving the router and going towards the destination host.

• Before being routed to the outbound interface.

• a.     After leaving the router and going towards the source host.

An administrator has configured an access list on R1 to allow SSH administrative access from host 172.20.1.50. Which command correctly applies the ACL?

• R1(config-if)# ip access-group 1 out

• R1(config-line)# ip access-class 1 out

• R1(config-if)# ip access-group 1 in

• R1(config-line)# ip access-class 1 in

1Which of the following access-list commands permit packets going from host 172.16.5.1 to all web servers whose IP addresses begin with 10.1.1? (Choose two answers)

• access-list 111 permit tcp host 172.16.5.1 10.1.1.0 0.0.0.255 eq www

• access-list 1395 permit tcp host 172.16.5.1 10.1.1.0 0.0.0.255 eq www

• access-list 2123 permit tcp host 172.16.5.1 eq www 10.1.1.0 0.0.0.255

• access-list 2123 permit tcp host 172.16.5.1 10.1.1.0 0.0.0.255 eq www

Refer to the following command output. Which answers list a configuration mode and command that would result in the deletion of the line that matches subnet 192.168.2.0/24? (Choose two answers)

• In ACL control-list config mode: no 20

• In ACL control-list config mode: no permit 192.168.2.0 0.0.0.255

• In global config mode: no 20

• In global config mode: no permit 192.168.2.0 0.0.0.255

Which statements of standard ACLs are correct? (Select two).

• Should be applied as close the destination as possible.

• Match based on destination IP address.

• One of its ranges is 1300-1999

• Should be applied as close the origin as possible.

Which ACL entry satisfies the next requirement?

“Allow traffic from 10.0.0.0/16 to access the server at 8.8.8.8/32 using HTTPS.”

• R1(config-ext-nacl)#permit udp 10.0.0.0 0.0.255.255 8.8.8.8 0.0.0.0 eq 443

• R1(config-ext-nacl)#permit tcp 10.0.0.0 0.0.255.255 8.8.8.8 0.0.0.0 neq 443

• R1(config-ext-nacl)#permit tcp 10.0.0.0 0.255.255.255 8.8.8.8 0.0.0.0 eq 443

• R1(config-ext-nacl)#permit tcp 10.0.0.0 0.0.255.255 8.8.8.8 0.0.0.0 eq 443