Exam 300-410 All QuestionsBrowse all questions from this exam
Go to Exam
Question 148

Refer to the exhibit. A network administrator configured an IPv6 access list to allow TCP return traffic only, but it is not working as expected.

Which changes resolve this issue?

A.

B.

C.

D.

    Correct Answer:

    To allow only TCP return traffic, the access list should be configured to permit established TCP sessions and applied to incoming traffic on the interface. The correct configuration would include the 'permit tcp any any established' command to allow the return traffic and the access list applied in the inbound direction. This ensures that only packets associated with existing TCP sessions are permitted. Therefore, the appropriate changes would be: ipv6 access-list inbound permit tcp any any established deny ipv6 any any log interface gi0/0 ipv6 traffic-filter inbound in. This matches the configuration depicted in option A, making it the correct answer.

Discussion
GreatDane

TCP hosts establish a connection-oriented session with one another using a “three-way handshake” mechanism. As far as I know, the TCP return frame is the last frame involved in the three-way handshake (the ACK frame). Then, the session between the two hosts is established. So: permit tcp any any established (let the TCP return frame in, from any host) deny ipv6 any any log (deny any other IPv6 traffic from any host) Since the TCP return frame must be allowed IN, the ACL must be applied IN. Answer A is correct.

dapardo

great explanation!

examShark

The given answer is correct

SeMo0o0o0

A is correct

bk989

out keyword does not help us. This wont affect traffic coming to router. That leaves A or C. C is not the correct answer: TCP permit any any SYN" refers to a firewall rule that allows any TCP connection with the SYN flag set from any source to any destination. TCP: Refers to the Transmission Control Protocol. permit: Indicates that the traffic matching the rule is allowed. any any: Applies to any source and destination IP addresses. SYN: Stands for the Synchronize flag, which is set in the first step of the TCP three-way handshake, initiating a TCP connection. If C was permit tcp any any syn and permit tcp any any ack this may work, but this also allows new tcp connections