Standard ACL

Which of the following ranges is used for numbered standard ACLs?

• 100-199 and 2000-2699

• 1-499 and 1000-1499

• 1-99 and 1300-1999

• 1-999 and 2000-2999

What is the key difference between a named standard ACL and a numbered standard ACL?

• Named ACLs have a broader filtering capability than numbered ACLs.

• Numbered ACLs can be applied to both inbound and outbound traffic, but named ACLs can only be applied outbound.

• Named ACLs can filter on protocols, while numbered ACLs cannot.

• Named ACLs allow for more descriptive rule sets and easier editing.

Answer explanation

Named ACLs use a descriptive name instead of a number, making them easier to manage, edit, and understand, especially with large configurations.

Where should a standard ACL typically be placed in a network for maximum efficiency?

• As close to the source as possible.

• In the core of the network.

• As close to the destination as possible.

• On all interfaces of all routers.

Answer explanation

Placing a standard ACL close to the destination ensures that only the required traffic is blocked, as the router can't filter on the destination IP address.

A standard ACL has the following entry:

R(config)# access-list 10 deny host 192.168.1.5

R(config)# access-list 10 permit any

What is the result for a packet from 192.168.1.5?

• The packet will be dropped due to the implicit 'deny all' statement.

• The router will send an error message because of a conflicting rule.

• The packet will be denied.

• The packet will be permitted because of the 'permit any' statement.

Answer explanation

The ACL processing is sequential, and the first entry that matches (the 'deny' statement) will be applied, so the packet from that host is denied.

You are asked to block all traffic from the IT department's network (192.168.10.0/24) from reaching the finance department's server (192.168.20.50). Which standard ACL configuration would accomplish this?

• access-list 10 permit 192.168.10.0 0.0.0.255

• access-list 10 deny ip 192.168.10.0 0.0.0.255 192.168.20.50 0.0.0.0

• access-list 10 deny 192.168.10.0 0.0.0.255

• access-list finance deny host 192.168.10.0

Answer explanation

access-list 10 deny 192.168.10.0 0.0.0.255

This command correctly denies the entire IT department network, which would be sufficient for a standard ACL placed at the correct location