You save $69.98
Traffic enters router GigabitEthernet0/0 from users and must be filtered before it reaches a sensitive server. The extended ACL was mistakenly applied `out` on GigabitEthernet0/0. What change puts filtering on the user-to-router ingress path?
ACL interface directions are relative to the router. Incoming client packets enter Gi0/0, so the matching data-plane filter belongs inbound there under the stated topology.
`out` on Gi0/0 describes packets leaving the router through that port, not packets arriving from users.
A VTY access-class restricts terminal management sessions and does not replace an extended interface ACL for general user-to-server transit traffic.
Shutting the interface removes permitted as well as disallowed traffic, not a valid correction of ACL direction.
At a field-service firm, a network administrator needs standard IPv4 ACL 15 to permit source subnet 10.25.14.32/27 before applying an implicit deny. Which ACE matches the requested source range?
The wildcard 0.0.0.31 is the bitwise inverse of subnet mask 255.255.255.224, matching all sources in 10.25.14.32/27. A standard ACL matches source IPs rather than destination TCP ports.
The subnet mask 255.255.255.224 is not the wildcard; entering it in an IOS access-list match can select the opposite bits.
This wildcard 0.0.0.255 selects a different address set than 10.25.14.32/27; the zeros/ones in the wildcard control which bits must match.
Even with a correctly sized source range, deny blocks the required hosts rather than permitting them.
At a municipal utility, the site engineer must permit only TCP connections from 10.59.50.56 to service 192.168.238.94 destination port 123 using extended ACL 165. Which ACE expresses that exact flow?
This extended ACE matches source 10.59.50.56, destination 192.168.238.94, transport tcp, and destination port 123; it permits precisely the stipulated flow.
The fields match the flow but deny is the wrong action when the requirement is to allow it.
This reverses source and destination and describes the opposite direction of traffic. Extended ACL addresses are ordered source then destination.
An ip ACE is broader than the required tcp destination port 123; it would permit unrelated protocols and ports.
At a nonprofit organization, the on-call technician has extended ACL 175 that must check packets as they enter a router interface from source network 10.45.0.0/16. Which interface command applies it in the intended direction?
Applied inbound to the specified interface, ip access-group 175 in evaluates packets arriving from 10.45.0.0/16 before local forwarding.
Outbound placement evaluates packets leaving the interface, not those arriving from the described upstream segment.
ip helper-address forwards selected UDP broadcasts to an IP server; 175 is an ACL number, not a helper IP.
access-class is associated with line/VTY access filtering and is not the same interface data-plane ACL attachment.
At a school district, the infrastructure lead has a broad deny for a maintenance subnet but must allow approved host 10.73.114.183. Which ACL-ordering strategy preserves the explicit exception?
IOS ACLs are processed top-down and stop on the first match. The exception for 10.73.114.183 must appear before a covering deny if it is intended to be permitted.
An existing broad deny matching 10.73.114.183 terminates ACL evaluation before the later permit; moving the permit after it cannot restore this source's access.
A host-specific explicit deny would block the very source 10.73.114.183 that needs the exception. The approved host needs a permit before the broader subnet deny, not another earlier deny.
The `log` modifier records a deny match; it does not permit the packet or change first-match ACL processing. A permit earlier in the list is required.
At a field-service firm, the branch support lead must permit only device 10.129.187.118 as a source in a standard IPv4 ACL. Which ACE uses IOS host matching correctly?
The host keyword is equivalent to wildcard 0.0.0.0 and matches only IPv4 address 10.129.187.118; this is the requested single-source permit.
Wildcard 0.0.0.255 matches an entire last-octet range, not exactly 10.129.187.118. It is overly permissive.
Deny blocks the exact source host when the requirement is to allow it.
This `host` selector identifies only 10.129.187.119, whereas the requirement names 10.129.187.118. One-off differences in the last octet still designate a different IPv4 source.
Only traffic from source subnet 192.0.2.0/24 to one protected server VLAN must be blocked. Other destinations remain reachable. A standard ACL can match only IPv4 source addresses. Where is the preferred placement?
Standard ACLs cannot distinguish different destination IPs. Placing the source-based restriction close to the one affected destination minimizes collateral traffic loss.
Near-source placement can block the prohibited source from reaching many otherwise approved destinations; extended ACLs are typically better for fine destination scope.
An IOS ACL is an IP packet filter at an appropriate Layer 3 or VTY attachment, not a physical transceiver setting.
Enterprise-wide placement broadens the restriction instead of confining it to the stated protected destination.
At a nonprofit organization, an implementation partner sees unauthorized DHCP OFFER packets originate from user-facing port GigabitEthernet1/0/18 in VLAN 50. Which switch safeguard is appropriate?
DHCP snooping tracks legitimate bindings and drops DHCP server replies from untrusted ports in VLAN 50; the authorized server path must be trusted.
OSPF route exchange is unrelated to filtering rogue Layer 2 DHCP OFFER messages.
Trusting the user access port allows a rogue server to send DHCP replies and defeats the intended control boundary.
Without snooping, a rogue DHCP server can compete with the legitimate server.
At a nonprofit organization, the infrastructure lead observes forged ARP replies on user VLAN 50; DHCP snooping binding data is available. Which defense validates sender IP/MAC claims?
Dynamic ARP Inspection checks ARP claims against valid snooping bindings or ARP ACLs and can reject forged mappings on untrusted access ports in VLAN 50.
Lease duration alone does not validate the MAC/IP claimed in an ARP packet.
Routing defaults do not verify Layer 2 ARP mappings received on access ports.
Trusting all edge ports bypasses ARP validation for potential attacker traffic.
At an airport terminal, a network administrator requires port GigabitEthernet1/0/37 to admit one authorized workstation MAC and respond to extra MAC sources. Which feature should be configured?
Port security can limit which and how many MAC sources appear on access port GigabitEthernet1/0/37; max-count and violation mode control response to unexpected devices.
DHCP snooping controls rogue DHCP message sources and builds bindings; alone it does not restrict all Ethernet source MAC addresses on a workstation access port.
OSPF interface priority governs DR election, not Ethernet MAC admission limits.
BPDU guard protects an edge port against unexpected spanning-tree BPDUs; it is not a source-MAC admission policy.
At a research campus, a network operations engineer wants GigabitEthernet1/0/15 to learn an approved endpoint MAC and retain it as a secure address after a policy save. Which switch feature is designed for that?
Sticky secure MAC learning can add observed source MACs to running configuration on GigabitEthernet1/0/15 subject to configured maximum and violation rules. Administrators must review saved entries.
Root guard handles unexpected superior STP BPDUs and does not pin workstation source MACs.
A DHCP pool determines host addressing and does not directly configure port-security MAC restrictions.
DAI validates ARP sender mappings, not a general port-security sticky MAC allow-list.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (760 Questions, Last Updated on Nov 4, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
