Exam 350-701 topic 1 question 687 discussion

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/acl_extended.html https://community.cisco.com/t5/security-blogs/cisco-asa-access-list-acl-using-network-object/ba-p/4637574 In these examples we can see how an access-list on an ASA looks like. For a network it does not use wild card mask like a router. Also, the destination port)service is usually defined at the end. Both eq 53 and eq domain are fine. The ASA converts port 53 to domain. https://www.cisco.com/c/en/us/td/docs/security/asa/asa912/configuration/general/asa-912-general-config/ref-ports.html#ID-2120-000002b8

When I tested this on my ASA, I entered "eq 53" and when I did a show access-list, is renamed it as "eq domain". So although both appears legitmate, I will defer to 'domain'.

R1 hostname R1 ! interface ethernet0 ip access-group 102 in ! access-list 102 permit udp any any eq domain access-list 102 permit udp any eq domain any access-list 102 permit tcp any any eq domain access-list 102 permit tcp any eq domain any https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html#toc-hId--2055811851

Both A and D are correct: R9(config)#access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any R9(config)#access-list 102 permit tcp 192.168.1.0 0.0.0.255 eq 53 any R9(config)# R9(config)# R9(config)# R9(config)#do sh run | sec access-li access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any access-list 102 permit tcp 192.168.1.0 0.0.0.255 eq domain any

A and D are correct because one uses the port number (53), and the other uses the service name (domain)

tested in lab R1(config)#access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any running-config: ! access-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any ! ! ! !

answer A and D are correct

b and c are missing destination ip address or 'any' so they are wrong d - the syntax is incorrect. a - correct syntax https://community.cisco.com/t5/network-security/acl-for-dns-service/td-p/1553125

The answer may be D but is wrong access-list 102 permit tcp 192.168.1.0 0.0.0.255 any eq 53

https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html