Exam 350-401 topic 1 question 517 discussion

A Two things to keep in mind. 1) the requirement of "WITHOUT impacting the functionality of the access list, and 2) the wildcard mask of ACE #20 does not overlap with the 172.20.10.1/32 therefore not affecting it Another thing to note is that without the sequence keyword, the new ACE is added at the end of the list.

A. tested again: cisco_R3#show access-lists 123 Extended IP access list 123 5 permit ip host 1.1.1.1 any log 15 permit ip host 4.4.4.0 any log cisco_R3#s runn | i 123 access-list 123 permit ip host 1.1.1.1 any log access-list 123 permit ip host 4.4.4.0 any log cisco_R3# cisco_R3#conf t Enter configuration commands, one per line. End with CNTL/Z. cisco_R3(config)#access-list 123 permit ip host 172.20.10.1 any log <<<<<<<<<<<<<<<<< cisco_R3(config)#^Z cisco_R3# cisco_R3#s runn | i 123 access-list 123 permit ip host 1.1.1.1 any log access-list 123 permit ip host 4.4.4.0 any log access-list 123 permit ip host 172.20.10.1 any log <<<<<<<<<<<<<< cisco_R3#show access-lists 123 Extended IP access list 123 5 permit ip host 1.1.1.1 any log 15 permit ip host 4.4.4.0 any log 25 permit ip host 172.20.10.1 any log <<<<<<<<<<<<<<<<<<<< cisco_R3#

A is the closest but its not correct as the syntax is wrong Router(config)#ip access-list 100 ? % Unrecognized command Router(config)#ip access-list extended 100 ? <cr> <cr> Router(config-ext-nacl)#5 permit ip host x.x.x.

Option B uses the wrong syntax, the sequence number is specified only after you enter the ACL configuration using an IP prefix (e.g., "ip access-list extended 100") (Incorrect answer). Option C will permit the entire subnet (172.16.10.1 - 172.16.10.255) through the ACL, but we need to allow only host "172.16.10.1" (Incorrect answer). Option D will delete the entire list and add the entry "permit ip 172.16.0.0 0.0.15.255 any log" to the extended ACL 100, thus modifying the ACL content (Incorrect answer). Correct Answer is 'A'

A is correct

Para mi la respuesta correcta es la C, la opción A nunca dejará log del host. La respuesta C si que lo hará

It is A because none of the existing ACEs match host 172.20.10.1. Even though this ACE would be the third in list, non of the other can match the host. B syntax is wrong (at least on the IOS I tried) C matches a whole subnet instead of a host D breaks the functionality of the ACL Correct answer: A

A is the correct answer. Been working with Cisco for a while I can just snipe correct syntax. idk what else to say.. Good luck folks. A is the correct answer.

People saying "B" do you have access to any network gear at all? or are you all book jockies? JFC. No wonder half the network admin pop sucks at their job, they have all these certs yet never touch a CLI LAB THIS STUFF BEFORE YOU COMMENT Answer is A

Sorry. my answer is wrong. C is not correct. But A is correct.

C is correct 100%

"...without impacting the functionality of the access list." IMO, once you add 5 you are changing the operation of the existing ACL.

Correct is answer C Answer A cannot be correct, as if the entry is added without sequence number is placed at the end, so its processed last. If its processed last then the same traffic will be matched earlier by 172.16.0.0. 0.0.15.255 statement and in result log will never be generated !! And question specifically ask for log ! Correct is answer C as correctly position new entry before 172.16.0.0. 0.0.15.255 statement thus enable logging, while not altering the rest of the ACL as the 172.20.10.0 0.0.0.255 would be matched by later statement and permitted.

Answer A) is correct. As Clauster writes "the question wants you to just permit the Interface, not the entire network". That is why A is better than C.

A is correct

A is correct 172.16.0.0 0.0.15.255 includes 172.16.0.0 - 172.16.15.255 Router(config)#do show access-list 100 Extended IP access list 100 10 permit ip 192.168.0.0 0.0.255.255 any 20 permit ip 172.16.0.0 0.0.15.255 any Router(config)#access-list 100 permit ip host 172.20.10.1 any log Router(config)#do show access-list 100 Extended IP access list 100 10 permit ip 192.168.0.0 0.0.255.255 any 20 permit ip 172.16.0.0 0.0.15.255 any 30 permit ip host 172.20.10.1 any log Router(config)#

A. extended ACL does not have seq keyword: Router(config)#access-list ? <1-99> IP standard access list <100-199> IP extended access list <1100-1199> Extended 48-bit MAC address access list <1300-1999> IP standard access list (expanded range) <200-299> Protocol type-code access list <2000-2699> IP extended access list (expanded range) <2700-2799> MPLS access list <300-399> DECnet access list <700-799> 48-bit MAC address access list compiled Enable IP access-list compilation dynamic-extended Extend the dynamic ACL absolute timer rate-limit Simple rate-limit specific access list Router(config)#access-list