exam questions

Exam 200-150 All Questions

View all questions & answers for the 200-150 exam

Exam 200-150 topic 1 question 56 discussion

Actual exam question from Cisco's 200-150
Question #: 56
Topic #: 1
[All 200-150 Questions]

What is the correct format of an access control list on a Cisco Nexus switch to deny FTP traffic from any source to destination host 10.10.1.110?

  • A. N5K-A(config)# ip access-list 101 N5K-A(config-acl)# deny tcp any host 10.10.1.110 eq ftp
  • B. N5K-A(config)#access-list 101 deny tcp any host 10.10.1.110 eq ftp
  • C. N5K-A(config)# access-list 101 deny tcp any host 10.10.1.110 eq ftp N5K-A(config)# access-list 101 denyip any any
  • D. N5K-A(config)# ip access-list 101 N5K-A(config-acl)# deny udp any host 10.10.1.110 eq 21 N5K-A(config-acl)# permit ip any any
  • E. N5K-A(config)# ip access-list 101 N5K-A(config-acl)# deny tcp any host 10.10.1.110 eq 21
Show Suggested Answer Hide Answer
Suggested Answer: E 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
BlueYeti
4 years, 11 months ago
I don't think standard or extended is part of NX-OS, only IOS - there is nothing in the Command Reference Guide for standard or extended as part of 'ip access-list'. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/security/command/reference/n7k_sec_cmd/sec_cmd_i.html#pgfId-1245141
upvoted 1 times
BlueYeti
4 years, 11 months ago
A similar one was included in Lammle's DCICN book, using FTP instead of HTTP. ip access-list 101 deny tcp any host 10.10.1.110 eq 21 permit ip any any
upvoted 1 times
...
...
snapper
5 years, 3 months ago
D is the "most correct", but it's wrong as well. Whenever you configure an ACL starting with ip access-list (vs. just access-list), you must use either keyword "standard" or "extended" before the ACL number.
upvoted 1 times
...
snapper
5 years, 3 months ago
Agree with Ezzedine. "D" is correct. Answers A and E are wrong because when you start with "ip access-list", you first have to specify keyword standard or extended before specifying the number. Answer B is wrong because there's an implicit deny at the end of all ACLs, so because you didn't use a permit ip any any at the end, ALL traffic is being blocked.
upvoted 1 times
...
Ezzedine
5 years, 7 months ago
D) IS CORRECT N5K-A(config)# ip access-list 101 N5K-A(config-acl)# deny tcp any host 10.10.1.110 eq 21 N5K-A(config-acl)# permit ip any any
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago