Wildcard Mask Answer Key

1. Which range represents all the IP addresses that are affected when network 10.120.160.0 with a wildcard mask of 0.0.7.255 is used in an ACE?  10. 120. 160. 0t o10. 120. 168. 0  10. 120. 160. 0t o10. 127. 255. 255  10. 120. 160. 0t o10. 120. 191. 255  10.120.160.0 to 10.120.167.255* hatt hefi r s t5bi t soft he3r doct etmus tr emai nt hes amebutt hel ast Awi l dc ar dmas kof0. 0. 7. 255meanst ueof255,whi c hmeanst hel astoct etc an 3bi t scanhav eval uesf r om 000t o111.Thel as toct ethasav al hav ev al uesf r om al l z er ost oal l 1s . 2. What two functions describe uses of an access control list? (Choose two.) oades t i nat i on.  ACLsas s i s tt her out eri ndet er mi ni ngt hebestpat ht  St andar dACLscanr es t r i c tac c es st os pec i fi cappl i c at i onsandpor t s .  ACLs provide a basic level of security for network access.* es sor i gi nat i ngont her out er .  ACLscanper mi tordenyt r afficbas edupont heMACaddr  ACLs can control which areas a host can access on a network.* 3. Which two statements describe the effect of the access control list wildcard mask 0.0.0.15? (Choose two.)  The first 28 bits of a supplied IP address will be matched.*  Thel as tf ourbi t sofas uppl i edI Paddr es swi l l bemat c hed. uppl i edI Paddr es swi l l bei gnor ed.  Thefi r s t28bi t sofas  The last four bits of a supplied IP address will be ignored.*  Thel as tfi v ebi t sofas uppl i edI Paddr es swi l l bei gnor ed. esswi l l bemat c hed.  Thefi r s t32bi t sofas uppl i edI Paddr Awi l dc ar dmas kus es0st oi ndi c at et hatbi t smustmat ch.0si nt hefi r s tt hr eeoc t et sr epr esent24bi t sand ez er osi nt hel as toc t et ,r epr es entat ot al of28bi t st hatmus tmat ch.Thef our1sr epr es ent edby f ourmor ent st hef ourbi t st oi gnor e. t hedec i malv al ueof15r epr es 4. Refer to the exhibit. A network administrator is configuring an ACL to limit the connection to R1 vty lines to only the IT group workstations in the network 192.168.22.0/28. The administrator verifies the successful Telnet connections from a workstation with IP 192.168.22.5 to R1 before the ACL is applied. However, after the ACL is applied to the interface Fa0/0, Telnet connections are denied. What is the cause of the connection failure?  Theenabl es ec r etpas swor di snotc onfi gur edonR1.  The IT group network is included in the deny statement.*  Theper mi tACEspec i fi esawr ongpor tnumber . ocol i pi ns t eadoft c p.  Theper mi tACEs houl ds peci f ypr ot  Thel ogi nc ommandhasnotbeenent er edf orv t yl i nes . 255,whi c hc ov er sI Paddr es s esf r om Thes our c eI Pr angei nt hedenyACEi s192. 168. 20. 00. 0. 3. 22 192. 168. 20. 0t o192. 168. 23. 255.TheI Tgr oupnet wor k192. 168. 22. 0/ 28i si nc l udedi nt he192. 168. 20/ net wor k .Ther ef or e,t heconnect i oni sdeni ed.Tofi xi t ,t heor deroft hedenyandper mi tACEshoul dbe s wi t ched. 5. Refer to the exhibit. The network administrator that has the IP address of 10.0.70.23/25 needs to have access to the corporate FTP server (10.0.54.5/28). The FTP server is also a web server that is accessible to all internal employees on networks within the 10.x.x.x address. No other traffic should be allowed to this server. Which extended ACL would be used to filter this traffic, and how would this ACL be applied? (Choose two.) confi g) #i nt er f aces 0/ 0/ 0  R1( R1( confi gi f ) #i pacc es s gr oup105out R2( c onfig) #i nt er f acegi 0/ 0 R2( confi gi f ) #i pacces s gr oup105i n  access-list 105 permit tcp host 10.0.70.23 host 10.0.54.5 eq 20 access-list 105 permit tcp host 10.0.70.23 host 10.0.54.5 eq 21 access-list 105 permit tcp 10.0.0.0 0.255.255.255 host 10.0.54.5 eq www access-list 105 deny ip any host 10.0.54.5 access-list 105 permit ip any any*  ac c es s l i s t105per mi ti phost10. 0. 70. 23hos t10. 0. 54. 5 ac c es s l i s t105per mi tt c panyhost10. 0. 54. 5eqwww ac c es s l i st105per mi ti panyany  R1(config)# interface gi0/0 R1(config-if)# ip access-group 105 out*  ac c es s l i s t105per mi tt c phost10. 0. 54. 5anyeqwww ac ces s l i s t105per mi tt c phos t10. 0. 70. 23hos t10. 0. 54. 5eq20 l i s t105per mi tt c phos t10. 0. 70. 23hos t10. 0. 54. 5eq21 ac ces shathast heI Paddr essof Thefi r s tt wol i nesoft heACLal l owhos t10. 0. 70. 23FTPacc es st ot hes er v ert 10. 0. 54. 5.Thenextl i neoft heACLal l owsHTTPacces st ot hes er v erf r om anyhostt hathasanI P hats t ar t swi t ht henumber10.Thef our t hl i neoft heACLdeni esan yot hert y peoft r affict ot he addr es st astl i neoft heACLper mi t sany t hi ngel s ei ncas et her ear eot her ser v erf r om anys our c eI Paddr es s .Thel sbei ngfi l t er edf r om al l ot her ser v er sordev i c esaddedt ot he10. 0. 54. 0/ 28net wor k.Bec aus et r affici . l ocat i onsandf ort he10. 0. 70. 23hostdev i c e,t hebes tpl ac et oputt hi sACLi sc l os es tt ot hes er v er 6. A network administrator is designing an ACL. The networks 192.168.1.0/25, 192.168.0.0/25, 192.168.0.128/25, 192.168.1.128/26, and 192.168.1.192/26 are affected by the ACL. Which wildcard mask, if any, is the most efficient to use when specifying all of these networks in a single ACL permit entry?  0. 0. 0. 127  0. 0. 0. 255  0.0.1.255*  0. 0. 255. 255 wor k sor Asi ngl eACLc ommandandwi l dc ar dmas ks houl dnotbeus edt os peci f yt hes epar t i c ul arnet ot hert r afficwi l l beper mi t t edordeni edandpr esentas ec ur i t yr i s k . hebi nar ydi gi t st hatar ei dent i c al i ncons ec ut i v e Wr i t eal l oft henet wor knumber si nbi nar yanddet er mi net l dc ar dmas kof0. 0. 1. 255 bi tpos i t i onsf r om l ef tt or i ght .I nt hi sex ampl e,23bi t smat c hper f ect l y .Thewi des i gnat est hat25bi t smus tmat ch. 7. The exhibit shows router R2 connected through int fa0/0 to a switch which in turn is connected to host with an IP address 192.168.1.1 /24. R2 is connected to another switch through interface fa0/1 and the switch is connected to a server with the IP address 192.168.2.1 /24.Refer to the exhibit. A network administrator wants to permit only host 192.168.1.1 /24 to be able to access the server 192.168.2.1 /24. Which three commands will achieve this using best ACL placement practices? (Choose three.)  R2( confi gi f ) #i pacc ess gr oup101out i s t101per mi ti p192. 168. 1. 0255. 255. 255. 0192. 168. 2. 0255. 255. 255. 0  R2( confi g) #ac c ess l  R2( confi g) #i nt er f ac ef as t et her net0/ 1  R2(config)# interface fastethernet 0/0*  R2(config)# access-list 101 permit ip host 192.168.1.1 host 192.168.2.1*  R2(config-if)# ip access-group 101 in* l i s t101per mi ti panyany  R2( confi g) #ac ces s Anext endedACLi spl ac edasc l oset ot hes our c eoft het r afficasposs i bl e.I nt hi scas e. i ti spl ac edi nan nbounddi r ec t i ononi nt er f ac ef a0/ 0onR2f ort r afficent er i ngt her out erf r om hos twi t ht heI P i t ht heI Paddr es s192. 168. 2. 1. addr es s 192. 168. 1. 1boundf ort hes er v erwi 8. Which two statements are correct about extended ACLs? (Choose two)  Extended ACLs evaluate the source and destination addresses.*  Port numbers can be used to add greater definition to an ACL.*  Ex t endedACLsendwi t hani mpl i ci tper mi ts t at ement .  Ext endedACLsus eanumberr angef r om 199.  Mul t i pl eACLsc anbepl ac edont hes amei nt er f ac easl ongast heyar ei nt hes amedi r ec t i on. Ex t endedACLsc anbeus edf orpr eci s et r affic fi l t er i ng.Ext endedACLsc hec kf orbot hs our c eand s oc hec kt hepr ot oc ol sandpor tnumber s( ors er vi c es ) ,t hus dest i nat i onaddr es sesofpac k et s .Theyal al l owi ngf oragr eat err angeofc r i t er i aonwhi cht obas et heACL. 9. Which three values or sets of values are included when creating an extended access control list entry? (Choose three.)  source address and wildcard mask*  access list number between 100 and 199* s our ces ubnetmas kandwi l dc ar dmas k  ac c es sl i s tnumberbet ween1and99  destination address and wildcard mask*  des t i nat i ons ubnetmas kandwi l dc ar dmas k es sandwi l dc ar dmas k  def aul tgat ewayaddr 10. Refer to the exhibit. This ACL is applied on traffic outbound from the router on the interface that directly connects to the 10.0.70.5 server. A request for information from a secure web page is sent from host 10.0.55.23 and is destined for the 10.0.70.5 server. Which line of the access list will cause the router to take action (forward the packet onward or drop the packet)? 1  3* 2 t hedenyi panyanyt hati satt heendofev er yACL 5 4 l owt r afficf r om apar t i c ul arappl i c at i onf r om t heI Paddr es s10. 0. 55. 23 Thefi r s tt wol i nesoft heACLal hec r i t er i onofr eques tf ori nf or mat i onf r om dest i nedf or10. 0. 70. 55.Bec aus enei t heroft hesel i nesmeet st 70. 5,noact i on asec ur ewebpage( por t443i sHTTPS)f r om 10. 0. 55. 23t ot hewebs er v erl oc at edat10. 0. i st ak enbyt her out er .Thet hi r dl i nei samat c handbecaus et he“ per mi s s i on”i st odenyt hepack et ,t he opped.Nof ur t herex ami nat i oni sdonebyt her out er . pack eti sdr 11. Which set of access control entries would allow all users on the 192.168.10.0/24 network to access a web server that is located at 172.17.80.1, but would not allow them to use Telnet?  ac c es s l i s t103denyt c phos t192. 168. 10. 0anyeq23 tt c phos t192. 168. 10. 1eq80 ac c es sl i st103per mi  access-list 103 permit tcp 192.168.10.0 0.0.0.255 host 172.17.80.1 eq 80 access-list 103 deny tcp 192.168.10.0 0.0.0.255 any eq 23*  ac c es sl i st103per mi tt cp192. 168. 10. 00. 0. 0. 255anyeq80 0. 0. 255anyeq23 acc es s l i s t103denyt c p192. 168. 10. 00.  ac c es s l i s t103per mi t192. 168. 10. 00. 0. 0. 255host172. 17. 80. 1 el net ac c es s l i s t103denyt c p192. 168. 10. 00. 0. 0. 255anyeqt Foranex t endedACLt omeett hes er equi r ement st hef ol l owi ngneedt obei ncl udedi nt heacc essc ont r ol ent r i es: nt her ange100199or20002699 i dent i ficat i onnumberi per mi tordenypar amet er pr ot oc ol s our ceaddr es sandwi l dc ar d dest i nat i onaddr es sandwi l dc ar d por tnumberorname 12. Which two packet filters could a network administrator use on an IPv4 extended ACL? (Choose two.)  destination UDP port number* s our ceTCPhel l oaddr es s  ICMP message type*  des t i nat i onMACaddr es s c omput ert y pe sl i s t sc ommonl yfi l t erons our c eanddes t i nat i onI Pv 4addr es s esandTCPorUDPpor t Ext endedac c es ot oc ol t y pes . number s .Addi t i onal fi l t er i ngcanbepr ov i dedf orpr 13. Which two ACE commands will block traffic that is destined for a web server which is listening to default ports? (Choose two.)  ac c ess l i s t110denyt c panyan yl t80  ac c es sl i st110denyt c panyan yeq21  access-list 110 deny tcp any any eq https*  access-list 110 deny tcp any any gt 75* ygt443  acc es s l i s t110denyt cpanyan Tr affict hati sdes t i nedf orawebs er v erwi l l us epor t80or443.Thek ey wor deqr epr esent sequal ,gt tl es st han. r epr es ent sgr eat ert han,andl 14. Which feature is unique to IPv6 ACLs when compared to those of IPv4 ACLs? t heus eofwi l dc ar dmas k s  an implicit permit of neighbor discovery packets*  ani mpl i c i tdenyanyanyACE t heus eofnamedACLACE weenI Pv6andI Pv 4ACLsar et woi mpl i c i tper mi tACEsatt heendofany Oneoft hemaj ordi ffer enc esbet at i onst of unct i onont her out eri nt er f ace. I Pv6ACL.Thes et woper mi tACEsal l ownei ghbordi s c ov er yoper 15. What two ACEs could be used to deny IP traffic from a single source host 10.1.1.1 to the 192.168.0.0/16 network? (Choose two.)  ac c es s l i s t100denyi p10. 1. 1. 1255. 255. 255. 255192. 168. 0. 00. 0. 255. 255  access-list 100 deny ip 10.1.1.1 0.0.0.0 192.168.0.0 0.0.255.255* s t100denyi p192. 168. 0. 00. 0. 255. 255hos t10. 1. 1. 1  ac ces s l i  access-list 100 deny ip host 10.1.1.1 192.168.0.0 0.0.255.255*  ac c es s l i s t100denyi p192. 168. 0. 00. 0. 255. 25510. 1. 1. 10. 0. 0. 0 p192. 168. 0. 00. 0. 255. 25510. 1. 1. 1255. 255. 255. 255  ac c es s l i s t100denyi st ous et hehostk ey wor dwi t h Ther ear et woway st oi dent i f yas i ngl ehos ti nanac ces sl i s tent r y .One,i c eof t hehostI Paddr es s,t heot heri st ous eawi l dc ar dmas kof0. 0. 0. 0wi t ht hehos tI Paddr es s .Thes our t het r affict obei ns pec t edbyt heac ces sl i s tgoesfi r s ti nt hes y nt axandt hedes t i nat i ongoesl as t . 16. Refer to the exhibit. The IPv6 access list LIMITED_ACCESS is applied on the S0/0/0 interface of R1 in the inbound direction. Which IPv6 packets from the ISP will be dropped by the ACL on R1?  ICMPv6 packets that are destined to PC1*  nei ghboradv er t i s ement st hatar er ec ei v edf r om t heI SPr out er  HTTPSpac ket st oPC1  pack et st hatar edes t i nedt oPC1onpor t80 c es sl i s tLI MI TED_ACCESSwi l lbl ockI CMPv 6pac k et sf r om t heI SP.Bot hpor t80,HTTPt r affic , Theac l yper mi t t edbyt heACL.Thenei ghboradv er t i s ement sf r om t he andpor t443,HTTPSt r affic ,ar eex pl i c i t nast at ementatt heendofal l I SPr out erar ei mpl i c i t l yper mi t t edbyt hei mpl i c i tper mi ti c mpanyanyndI Pv6ACLs . 17. Which command is used to activate an IPv6 ACL named ENG_ACL on an interface so that the router filters traffic prior to accessing the routing table? i pv 6acces s c l assENG_ACLi n i pv 6t r affic fi l t erENG_ACLout  ipv6 traffic-filter ENG_ACL in* i pv 6acc es s cl as sENG_ACLout Fort hepur pos eofappl y i nganacc essl i s tt oapar t i c ul ari nt er f ace,t hei pv 6t r affic fi l t erI Pv 6commandi s s gr oupI Pv 4c ommand.Thedi r ect i oni nwhi c ht het r affici sexami ned( i norout )i s equi v al entt ot heac c es al sor equi r ed. 18. What is the wildcard mask that is associated with the network 192.168.12.0/24?  0.0.0.255  0. 0. 255. 255  0. 0. 0. 256 255. 0  255. 255. Thewi l dc ar dmas kc anbef oundbys ubt r ac t i ngt hes ubnetmas kf r om 255. 255. 255. 255. 19. Which IPv6 ACL command entry will permit traffic from any host to an SMTP server on network 2001:DB8:10:10::/64?  per mi tt c phos t2001: DB8: 10: 10: : 100anyeq23  permit tcp any host 2001:DB8:10:10::100 eq 25*  per mi tt c pan yhost2001: DB8: 10: 10: : 100eq23  per mi tt c phos t2001: DB8: 10: 10: : 100anyeq25 TheI Pv6acces sl i sts t at ement ,per mi tt c panyhost2001: DB8: 10: 10: : 100eq25,wi l lal l owI Pv 6pac k et s DB8: 10: 10: : 100.Thesour c eoft hepack eti sl i st edfi r s ti nt he f r om anyhostt ot heSMTPser v erat2001: i s t edsec ond,i nt hi sc as et heI Pv 6addr es s ACL,whi c hi nt hi sc asei sanys our c e,andt hedes t i nat i oni sl k nownpor tf or oft heSMTPs er v er .Thepor tnumberi sl asti nt hes t at ement ,por t25,whi c hi st hewel l SMTP. 20. In applying an ACL to a router interface, which traffic is designated as outbound? t r afficf orwhi c ht her out erc anfi ndnor out i ngt abl eent r y nt ot her out er t r affict hati sgoi ngf r om t hedest i nat i onI Paddr essi  traffic that is leaving the router and going toward the destination host* t r affict hati sc omi ngf r om t hes our ceI Paddr es si nt ot her out er ewoft her out er .T r affict hati sdesi gnat edi nan I nboundandout boundar ei nt er pr et edf r om t hepoi ntofvi r om as our c e.Tr affict hat i nboundACLwi l l bedeni edorper mi t t edwhenc omi ngi nt ot hatr out eri nt er f ac ef i sdes i gnat edi nanout boundACLwi l lbedeni edorper mi t t edwhengoi ngoutt hei nt er f ac et ot he dest i nat i on.