Exam 350-401 topic 1 question 271 discussion

B Access lists that are applied to interfaces do not filter traffic that originates from that router!

A - wrong because outbound list won't block telnet from same router, AND it has the time-range on the permit statement. B- correct! C- wrong because it has no deny statement D- wrong because it includes Friday

R3(config)#time-range WEEKEND R3(config-time-range)#periodic Saturday Sunday 00:00 to 23:59 R3(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND R3(config)#access-list 150 permit ip any any R3(config)#interface G0/1 R3(config-if)#ip access-group 150 out # we filter trafic as close to the source as possible with extended ACLs

Shouldn't the ACL be applied outbound on R1 Gi0/1 interface?

B is correct even if the solution is not the best practice, cause the access-list is recommended to be applied on the R3 interface outbound.

B. A and C are easily discarded with the fact that ACLs are not processed by the router that originates the traffic. D is using a wrong time range, I think that if you're going to define the day individually the syntax should be something like this: time-range TEST periodic Saturday 00:00 to Sunday 23:59 but the keyword "weekend" covers this day range.

ACL cannot block traffic originates from the router were is applicatted Regards

cisco_R3(config)#time-range q_277 cisco_R3(config-time-range)#periodic ? Friday Friday Monday Monday Saturday Saturday Sunday Sunday Thursday Thursday Tuesday Tuesday Wednesday Wednesday daily Every day of the week weekdays Monday thru Friday weekend Saturday and Sunday cisco_R3(config-time-range)#periodic weekend ? hh:mm Starting time cisco_R3(config-time-range)#periodic weekend 00:00 ? to ending day and time cisco_R3(config-time-range)#periodic weekend 00:00 to ? hh:mm Ending time - stays valid until beginning of next minute cisco_R3(config-time-range)#periodic weekend 00:00 to 23:59

Both A and B will block the telnet traffic during the weekend. But only B will allow the rest of the traffic during the the rest of the days. Answer is B.

This question is still asked. Passed today.

C. RouterR3(config)#time-range WEEKEND RouterR3(config-time-range)#periodic weekend 00:00 to 23:59 RouterR3(config)#access-list 150 permit tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND RouterR3(config)#access-list 150 permit ip any any time-range WEEKEND RouterR3(config)#interface G0/1 RouterR3(config-if)#ip access-group 150 out D. RouterR1(config)#time-range WEEKEND RouterR1(config-time-range)#periodic Friday Sunday 00:00 to 00:00 RouterR1(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND RouterR1(config)#access-list 150 permit ip any any RouterR1(config)#interface G0/1 RouterR1(config-if)#ip access-group 150 in

A. RouterR3(config)#time-range WEEKEND RouterR3(config-time-range)#periodic Saturday Sunday 00:00 to 23:59 RouterR3(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND RouterR3(config)#access-list 150 permit ip any any time-range WEEKEND RouterR3(config)#interface G0/1 RouterR3(config-if)#ip access-group 150 out B. RouterR1(config)#time-range WEEKEND RouterR1(config-time-range)#periodic weekend 00:00 to 23:59 RouterR1(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND RouterR1(config)#access-list 150 permit ip any any RouterR1(config)#interface G0/1 RouterR1(config-if)#ip access-group 150 in

A is the right answer. there is no "periodic weekend" command.