Referring to the following figure, you need to block traffic from the host 192.168.2.6 to the HR web application server but allow it to get to all other servers and the Internet. Which command(s) will achieve this?
Answer Options
access-list 101 deny tcp host 192.168.2.6 host 192.168.1.3 eq 80 access-list 101 permit any any
access-list 101 deny tcp host 192.168.2.6 host 192.168.1.3 eq 80 access-list 101 permit ip any any
access-list 101 deny host 192.168.2.6 host 192.168.1.3 eq 80 access-list 101 permit any any
access-list 101 deny tcp host 192.168.2.6 host 192.168.1.3 eq 80 access-list 101 permit ip any any eq 80
Correct Answer: B
Explanation
The command access-list 101 deny tcp host 192.168.2.6 host 192.168.1.3 eq 80 denies access from the host 192.168.2.6 to the host 192.168.1.3 for port 80. The next command, access-list 101 permit ip any any, allows all IP traffic from any to any. With extended access lists, the protocol needs to be described. Option A is incorrect because 'permit any any' lacks the IP protocol specification. Option C is incorrect because 'deny host' without TCP protocol is invalid for extended ACLs. Option D is incorrect because 'eq 80' on the permit statement would unnecessarily restrict permitted traffic.