Testking_640-802_V13

In order to only deny access to the 172.16.4.0 network while permitting all other access as specified in this question, we need to apply this access list to router TestKing2, and it must be placed in the outbound direction of interface fa0/0. Applying this access list to any other interface or any other router would result in making other network unreachable from the 172.16.1.0 network, except of course for 172.16.1.5.

QUESTION NO: 22

A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?

A.access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any

B.access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23 access-list 1 permit ip any any

C.access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21 access-list 1 permit ip any any

D.access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any

E.access-list 101 deny ip 192.168.1.128 0.0.0.240 192.158.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any

F.access-list 101 deny ip 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any

Answer: A Explanation:

Only choice specifies the correct TCT port and wildcard mask, and uses a valid access list number.

Incorrect Answers:

B, C. Access list 1 is used for these choices, which is a standard access list. In this example, an extended access list is required. Choice C also specifies port 21, which is used by FTP not Telnet.

D, E: These choices use an incorrect wildcard mask of 0.0.0.240. It should be 0.0.0.15 for a /28 subnet.

F. IP is specified as the protocol, when it should be TCP.

QUESTION NO: 23

Leading the way in IT testing and certification tools, www.testking.com

- 591 -

You are the network administrator at TestKing. You apply the following access list on the E0 outbound interface connected to the 192.168.1.8/29 LAN:

access-list 21 deny tcp 192.168.1.8 0.0.0.7 eq 20 any access-list 21 deny tcp 192.168.1.8 0.0.0.7 eq 21 any

What will the effect of this access list be?

A.All traffic will be allowed to out of E0 except FTP traffic.

B.FTP traffic from 192.168.1.22 to any host will be blocked.

C.FTP traffic from 192.168.1.9 to any host will be blocked.

D.All traffic will be prevented from leaving E0.

E.All FTP traffic to network 192.168.1.9/29 from any host will be blocked.

Answer: D Explanation:

By default access lists contain an implicit deny statement at the end. In this example there is no permit statement, so it will deny all traffic exiting E0 Interface. Any useful access list must contain at least one permit statement, or everything will be denied.

QUESTION NO: 24

You want to configure an ACL to block only TCP traffic using port 5190 on router TK1. Which access list statement will block all traffic on this router with a destination TCP port number of 5190 while not affecting other traffic?

A.access-list 180 deny ip any eq 5190 any

B.access-list 180 deny tcp any any eq 5190

C.access-list 180 deny tcp any eq 5190

D.access-list 180 deny tcp any eq 5190 any

E.access-list 180 deny telnet any any 5190

F.None of the above

Answer: B Explanation:

Creating an extended ACL:

These lists are created and applied to an interface as either inbound or outbound packet filters. They are implemented in this format:

Leading the way in IT testing and certification tools, www.testking.com

- 592 -

Access-list [list number] [permit | deny] [protocol] [source address] [source-mask] [destination address] [destination-mask] [operator] [port] [log]

1.List Number-A number between 100 and 199 (Think of it as the name of the list.)

2.Permit | Deny-Whether to permit or deny this packet of information if conditions match

3.Protocol-Type of protocol for this packet (i.e., IP, ICMP, UDP, TCP, or protocol number)

4.Source Address-Number of the network or host that the packet is from (Use the

dotted-decimal format 192.168.1.12 or use the keyword ANY as an abbreviation for an address of 0.0.0.0 255.255.255.255 or use HOST and the dotted-decimal address.)

5.Source Mask-The network mask to use with the source address (Cisco masks are a little different, 0 = octet must match exactly; 255 = octet is not significant or doesn't matter.)

6.Destination Address-The address that the packet is going to, or ANY

7.Destination Mask-The network mask to use with the destination address (if you specify one)

8.Operator (optional entry)-This applies to TCP or UDP ports only

eq=equal lt=less than gt=greater than neq=not equal

range=a range of ports; you must specify two different port numbers est=established connections

9.Port (optional entry)-TCP/UDP destination port number or service

10.Log-Whether to log (if logging is enabled) this entry to the console

A sample inbound ACL would be:

access-list 100 deny ip 10.0.0.0 0.255.255.255 any log access-list 100 deny ip 172.16.0.0 0.15.255.255 any log access-list 100 deny ip 192.168.0.0 0.0.255.255 any log access-list 100 deny ip any host 127.0.0.1 log

access-list 100 permit ip any [your network IP address] [your network mask] est access-list 100 deny ip [your network IP address] [your network mask] any log access-list 100 deny tcp any any eq 22222

access-list 100 deny tcp any any range 60000 60020 log access-list 100 deny udp any any eq snmp log access-list 100 permit ip any any

Reference: http://articles.techrepublic.com.com/5100-1035_11-1058307.html

Leading the way in IT testing and certification tools, www.testking.com

- 593 -

Section 3: Configure and apply an ACLs to limit telnet and SSH access to the router using (including: SDM/CLI) (9 questions)

QUESTION NO: 1

The TestKing network topology exhibit is shown below:

Configuration exhibit:

Leading the way in IT testing and certification tools, www.testking.com

- 594 -

Based on the information shown above, why would the TestKing network administrator configure Router TestKing1 as shown above?

A.To prevent students connected to TestKing2 from accessing the command prompt of Router TestKing1

B.To give administrators access to the internet

C.To prevent students from accessing the admin network

D.To prevent students from accessing the internet

E.To give students access to the internet

F.To prevent administrators from accessing the console of Router TestKing1

G.None of the above

Answer: A

QUESTION NO: 2

Part of the TestKing network is shown below:

In this TestKing network segment, the following ACL was configured on the S0/0 interface of router TestKing2 in the outbound direction:

Leading the way in IT testing and certification tools, www.testking.com

- 595 -

Access-list 101 deny tcp 192.168.15.32 0.0.0.15 any eq telnet

Access-list 101 permit ip any any

Based on this onformation which two packets, if routed to the interface, will be denied? (Choose two)

A.Source IP address: 192.168.15.5; destination port: 21

B.Source IP Address: 192.168.15.37 destination port: 21

C.Source IP Address: 192.168.15.41 destination port: 21

D.Source IP Address: 192.168.15.36 destination port: 23

E.Source IP Address: 192.168.15.46; destination port: 23

F.Source IP Address: 192.168.15.49 destination port 23

Answer: D, E

QUESTION NO: 3

You want to control all telnet access going through router TK1. Which one of the access control list statements below will deny all telnet connections to subnet 10.10.1.0/24?

A.access-list 15 deny telnet any 10.10.1.0 0.0.0.255 eq 23

B.access-list 115 deny udp any 10.10.1.0 eq telnet

C.access-list 15 deny tcp 10.10.1.0 255.255.255.0 eq telnet

D.access-list 115 deny tcp any 10.10.1.0 0.0.0.255 eq 23

E.access-list 15 deny udp any 10.10.1.0 255.255.255.0 eq 23

F.None of the above

Answer: D Explanation:

Telnet uses port TCP port 23. Since we are using source and destination IP address information, an extended access list is required. Extended access lists are access lists in the 100-199 range.

Incorrect Answers:

A, C, E. These access lists are numbered 15. Standard access lists are numbered 1-99, and in this case an extended access lists is required.

B. This access list specifies UDP port 23, and TCP port 23 is the port used by telnet.

Leading the way in IT testing and certification tools, www.testking.com

- 596 -

QUESTION NO: 4

You wish to limit telnet access into your TestKing router to only a single host. In order to accomplish this, access list 1 has been written to allow host 172.16.1.224 access to the router vty lines. What command would assign this accesslist to the Virtual Terminal Lines?

A.TK1(config-line)# ip access-group 1 in

B.TK1(config-line)# access-class 1 in

C.TK1(config-line)# ip access-list 1 in

D.TK1(config-line)# access-line 1 in

E.None of the above

Answer: B Explanation:

To restrict incoming and outgoing connections between a particular vty (into a Cisco device) and the addresses in an access list, use the access-class command in line configuration mode.

Example:

The following example defines an access list that permits only the host 172.16.1.224 to connect to the virtual terminal ports on the router, as described in this question:

access-list 1 permit 172.16.1.224 0.0.0.0 line 1 5

access-class 1 in

QUESTION NO: 5

The TestKing LAN is depicted below:

Leading the way in IT testing and certification tools, www.testking.com

- 597 -

You're the systems administrator at Testing, and you create the following access control lists.

access-list 101 deny tcp 5.1.1.10 0.0.0.0 5.1.3.0 0.0.0.255 eq telnet access-list 101 permit any any

You then enter the command "ip access-group 101 in" to apply access control list 101 to router TK1s e0 interface.

Which of the following Telnet sessions will be blocked as a result of your access lists? (Select all that apply)

A.Telnet sessions from host A to host 5.1.1.10

B.Telnet sessions from host A to host 5.1.3.10

C.Telnet sessions from host B to host 5.1.2.10

D.Telnet sessions from host B to host 5.1.3.8

E.Telnet sessions from host C to host 5.1.3.10

F.Telnet sessions from host F to host 5.1.1.10

Answer: D, F

Explanation:

Leading the way in IT testing and certification tools, www.testking.com

- 598 -

All the telnet sessions from host B to network 5.1.3.0/24 will be denied. In addition, all telnet traffic to host B from the 5.1.3.0/24 network will not work, because the return telnet traffic will be denied.

QUESTION NO: 6

Which of the following commands would successfully implement an access list on a routers virtual terminal line? (Select only one answer choice)

A.RouterTK(config-line)# access-class 10 in

B.RouterTK(config-if)# ip access-class 23 out

C.RouterTK(config-line)# access-list 150 in

D.RouterTK(config-if)# ip access-list 128 out

E.RouterTK(config-line)# access-group 15 out

F.RouterTK(config-if)# ip access-group 110 in

Answer: A Explanation:

To configure VTY you must be in the config-line mode. Virtual terminal sessions use VTY lines 0-4, and VTY access lists use the access-class command.

Incorrect Answers:

B. This is placed in the wrong configuration mode

C, D, E, F. The correct syntax for VTY lines is the access-class command, not the access-group or access-list commands.

QUESTION NO: 7

The following access control list needs to be applied to one of the routers shown in the graphic:

access-list 101 permit tcp 192.168.1.16 0.0.0.15 192.168.2.16 0.0.0.15 eq 23

Leading the way in IT testing and certification tools, www.testking.com

- 599 -

What can be concluded about this ACL? (Choose two.)

A.Telnet traffic from 192.168.1.16 0.0.0.15 to 192.168.2.16 0.0.0.15 is allowed.

B.SMTP traffic from 192.168.2.16 0.0.0.15 to 192.168.1.16 0.0.0.15 is allowed.

C.The ACL is configured to allow traffic from one specific host to another.

D.When the ACL is applied, Testking 1 will be able to ping Testking 2.

E.The ACL should be applied inbound to the e0 interface of Router A.

F.The ACL should be applied outbound to the e0 interface of Router A.

Answer: A, E

Explanation:

The given extended ACL allow the telnet traffic from 192.168.1.16 0.0.0.15 to 192.168.2.16 0.0.0.15. Telnet uses TCP port 23. With access lists, the first network specified is the source of the traffic and the second is the destination, so since this access list says to allow telnet traffic from the Tessking1 network to the Testking2 network, it should be placed on the inbound interface of E0.

QUESTION NO: 8

Leading the way in IT testing and certification tools, www.testking.com

- 600 -