Exam 350-701 topic 1 question 687 discussion

When I tested this on my ASA, I entered "eq 53" and when I did a show access-list, is renamed it as "eq domain". So although both appears legitmate, I will defer to 'domain'.

R1 hostname R1 ! interface ethernet0 ip access-group 102 in ! access-list 102 permit udp any any eq domain access-list 102 permit udp any eq domain any access-list 102 permit tcp any any eq domain access-list 102 permit tcp any eq domain any https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html#toc-hId--2055811851

Both A and D are correct: R9(config)#access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any R9(config)#access-list 102 permit tcp 192.168.1.0 0.0.0.255 eq 53 any R9(config)# R9(config)# R9(config)# R9(config)#do sh run | sec access-li access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any access-list 102 permit tcp 192.168.1.0 0.0.0.255 eq domain any

A and D are correct because one uses the port number (53), and the other uses the service name (domain)

tested in lab R1(config)#access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any running-config: ! access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any ! ! ! !

answer A and D are correct

b and c are missing destination ip address or 'any' so they are wrong d - the syntax is incorrect. a - correct syntax https://community.cisco.com/t5/network-security/acl-for-dns-service/td-p/1553125

The answer may be D but is wrong access-list 102 permit tcp 192.168.1.0 0.0.0.255 any eq 53

https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html