A)
access-list 110 deny 200.200.10.0 to network 200.199.11.0 eq ftp
access-list 111 permit ip any 0.0.0.0 255.255.255.255
B) access-list 1 deny ftp 200.200.10.0 200.199.11.0 any any
C) access-list 100 deny tcp 200.200.10.0 0.0.0.255 200.199.11.0 0.0.0.255 eq ftp
D)
access-list 198 deny tcp 200.200.10.0 0.0.0.255 200.199.11.0 0.0.0.255 eq ftp
access-list 198 permit ip any 0.0.0.0 255.255.255.255
Correct Option - D
ExplanationExtended IP access lists use numbers 100-199 and 2000-2699 and filter based on source and destination IP address, protocol number, and port number. The last option is correct because of the second line that specifies permit ip any any. (I used 0.0.0.0 255.255.255.255, which is the same as the any option.) The third option does not have this, so it would deny access but not allow everything else.
A) Router(config)# ip access-group 110 in
B) Router(config)# ip access-list 110 in
C) Router(config-if)# ip access-group 110 in
D) Router(config-if)# ip access-list 110 in
Correct Option - C
ExplanationTo place an access list on an interface, use the ip access-group command in interface configuration mode.
A) show ip port
B) show access-lists
C) show ip interface
D) show access-lists interface
Correct Option - C
ExplanationOnly the show ip interface command will tell you which interfaces have access lists applied. show access-lists will not show you which interfaces have an access list applied.
A) show access-lists
B) show interface Ethernet 0
C) show ip access-lists
D) show ip interface Ethernet 0
Correct Option - D
ExplanationThe only command that shows which access lists have been applied to an interface is show ip interface Ethernet 0. The command show access-lists displays all configured access lists, and show ip access-lists displays all configured IP access lists, but neither command indicates whether the displayed access lists have been applied to an interface.
A) (config)# ip access-group 110 in
B) (config-if)# ip access-group 110 in
C) (config-if)# ip access-group Blocksales in
D) (config-if)# blocksales ip access-list in
Correct Option - C
ExplanationUsing a named access list just replaces the number used when applying the list to the router's interface. ip access-group Blocksales in is correct.
A) access-list 10 deny 172.16.192.0 0.0.31.255
B) access-list 10 deny 172.16.0.0 0.0.255.255
C) access-list 10 deny 172.16.172.0 0.0.31.255
D) access-list 10 deny 172.16.188.0 0.0.15.255
Correct Option - A
ExplanationFirst, you must know that a /19 is 255.255.224.0, which is a block size of 32 in the third octet. Counting by 32, this makes our subnet 192 in the third octet, and the wildcard for the third octet would be 31 since the wildcard is always one less than the block size.
A) access-list 10 deny 192.168.160.0 255.255.224.0
B) access-list 10 deny 192.168.160.0 0.0.191.255
C) access-list 10 deny 192.168.160.0 0.0.31.255
D) access-list 10 deny 192.168.0.0 0.0.31.255
Correct Option - C
ExplanationThe range of 192.168.160.0 to 192.168.191.0 is a block size of 32. The network address is 192.168.160.0 and the mask would be 255.255.224.0, which for an access list must be a wildcard format of 0.0.31.255. The 31 is used for a block size of 32. The wildcard is always one less than the block size.