Cisco 200-301 Exam Dumps, Practice Test Questions

This would include unrelated public traffic instead of only the two authorized protected subnets.

That is a much broader private network and would include unapproved site traffic.

Site-to-site policy must agree on the intended bidirectional protected traffic between the two endpoints.

This permits ICMP echo traffic, not the required TCP HTTP requests to destination port 80.

TCP destination port 443 normally matches HTTPS, not the HTTP destination port 80 in the stated policy.

This ACE matches all IPv4 protocols to the server and is too broad for the requirement to permit only TCP destination port 80.

This matches clients headed to the server’s destination port 443. It does not match the specified server-to-client direction with TCP source port 443.

HTTPS as specified uses TCP; a UDP ACE for source port 443 matches a different transport and would not satisfy the TCP requirement.

An IP-wide permit does not restrict the source to TCP port 443 and could allow unrelated protocols from that host.

An ACL wildcard mask is the inverse of the subnet mask; 255.255.255.0 is not the wildcard for /24.

This matches only the one host address 192.0.2.0 rather than every host in the /24 source range.

This applies the /24 as the destination network instead of the source and reverses the stated policy direction.

This permits TCP HTTP sessions, not the ICMP echo-request protocol and message type asked for.

The echo-reply keyword matches responses rather than incoming echo requests to this server.

Permit ip would match all IP protocols to the destination and is broader than the explicit ICMP echo-only rule.

A final permit would bypass the intended default deny policy for every flow not matched earlier.

This denies only TCP destination port 80 and leaves other protocol types to the subsequent implicit deny without requested logging.

This blocks only one source and does not explicitly log all other unmatched traffic as required.

The first matching deny stops ACL evaluation, so the later host-specific permit is never considered for that host.

ACLs are evaluated by configured sequence, not by routing-style longest-prefix selection among ACL statements.

An implicit deny blocks unmatched traffic and cannot be used to permit an exception.

IOS ACLs have an implicit deny at the end, so a packet that matches no explicit ACE is not automatically permitted.

ACL evaluation terminates after the ordered list; unmatched traffic does not loop through the ACEs.

ACL matching uses address, protocol and port fields and does not synthesize new rules through DNS.

Traditional standard IPv4 ACLs match source IPv4 addresses, not destination IP predicates.

Transport protocol/port matching requires an extended ACL, not standard source-only filtering.

MAC-based filtering is a different mechanism; standard IPv4 ACLs evaluate source IPv4 addresses.

Standard IPv4 ACLs cannot match the full source/destination/transport-port tuple required.

MAC-based port security is not the IPv4 TCP transport port 443 predicate.

A route map without appropriate matching/enforcement is not the specified packet-filtering ACL.

A routing table reports installed prefixes, not ACL entries and per-line match counters.

Logging output may omit unlogged matches and does not replace per-rule ACL counters.

Link state cannot enumerate ACL rules or their match counters.