请参见图示。公司的新安全策略允许来自工程部LAN的所有IP流量访问Internet，但对于来自营销部LAN的流量，则只允许其中的web流量访问Internet。为实施新的安全策略，可在营销部路由器的Serial0/1接口的出站方向上应用哪一ACL()A.access-list 197 permit ip 192.0.2.0 0.0.0.255 any access-list 197 permit ip 198.18.112.0 0.0.0.255 any eq wwwB.access-list 165 p

题目

请参见图示。公司的新安全策略允许来自工程部LAN的所有IP流量访问Internet，但对于来自营销部LAN的流量，则只允许其中的web流量访问Internet。为实施新的安全策略，可在营销部路由器的Serial0/1接口的出站方向上应用哪一ACL()

A.access-list 197 permit ip 192.0.2.0 0.0.0.255 any access-list 197 permit ip 198.18.112.0 0.0.0.255 any eq www

B.access-list 165 permit ip 192.0.2.0 0.0.0.255 any access-list 165 permit tcp 198.18.112.0 0.0.0.255 any eq www access-list 165 permit ip any any

C.access-list 137 permit ip 192.0.2.0 0.0.0.255 any access-list 137 permit tcp 198.18.112.0 0.0.0.255 any eq www

D.access-list 89 permit 192.0.2.0 0.0.0.255 any access-list 89 permit tcp 198.18.112.0 0.0.0.255 any eq www

相似考题

1.在Cisco路由器上，用扩展访问控制列表封禁IP地址为211.102.33.24的主机，正确的配置语句是______。A．access-list 99 deny ip host 211.102.33.24 any access-list 99 deny ip any host 211.102.33.24 access-list 99 permit ip any anyB．access-list 100 permit ip any any access-list 100 deny ip host 211.102.33.24 any access-list 100 deny ip any host 211.102.33.24C．access-list 199 deny ip host 211.102-33.24 any access-list 199 deny ip any host 211.102.33.24 access-list 199 permit ip any anyD．access-list 166 deny ip host 211.102.33.24 any access-list 166 permit ip any any

2.在 Cisco 路由器匕用扩展访问控制列表封禁 1P 地址为 211.102.33.24 的主机，正确的配置语句是A ）access-list 99 deny ip host 211.102.33.24 anyaccess-list 99 deny ip any host 211.102.33.24access-list 99 permit ip any anyB ）access-list 100 permit ip any anyaccess-list 100 deny ip host 211.102.33.24 anyaccess-list 100 deny ip any host 211.102.33.24C ）access-list 199 deny ip host 211.102.33.24 anyaccess-list 199 deny ip any host 211.102.33.24access-list 199 permit ip any anyD ）access-list 166 deny ip host 211.102.33.24 anyaccess-list 166 permit ip any any

3.用扩展访问控制列表配置封禁ICMP协议，只允许l68．27．95．0／24子网的ICMP数据包通过路由器，正确的配置是(61) 。A．access-list 90 deny icmp l68．27．95．0 255．255．255．0 any access-list 90 deny icmp any anyaccess—list 90 permit ip any anyB．access-list l00 permit icmp l68．27．95．0 0．0．0．255 any access-list l00 permit ip any anyC．access—list l l o permit icmp l68．27．95．0 255．255．255．0 any access—list l lo deny icmp any anyD．access-list l20 permit icmp l68．27．95．0 0．0．0．255 any access—list l20 deny icmp any any access—list l20 permit ip any any

4.定义一个用于封禁ICMP协议而只允许转发166.129.130.0/24子网的ICMP数据包的访问控制列表，Cisco路由器的正确配置是A．access-list 198 permit icmp 166.129.130.0 255.255.255.0 any access-list 198 deny icmp any any access-list 198 permit ip any anyB．access-list 198 permit icmp 166.129.130.0 0.0.0.255 any access-list 198 deny icmp any any access-list 198 permit ip any anyC．access-list 99 permit icmp 166.129.130:0 0.0.0.255 any access-list 99 deny icnip any any access-list 99 permit ip any anyD．access-list 100 permit icmp 166.129.130.0 0.0.0.255 any access-list 100 permit ip any any access-list 100 deny icmp any any

参考答案和解析

正确答案：C

更多“请参见图示。公司的新安全策略允许来自工程部LAN的所有IP流量访问Internet，但对于来自营销部LAN的流量，则只允许其中的web流量访问Internet。为实施新的安全策略，可在营销部路由器的Serial0/1接口的出站方向上应用哪一ACL()A.access-list 197 permit ip 192.0.2.0 0.0.0.255 any access-list 197 permit ip 198.18.112.0 0.0.0.255 any eq wwwB.access-list 165 p”相关问题

第1题：

为了禁止网络210.93.105.0ftp到网络223.8.151.0，允许其他信息传输，则能实现该功能的选项是：()
A.access-list 1 deny 210.93.105.0.0.0.0.0.0
B.access-list 100 deny tcp 210.93.105.0 0.0.0.255 223.8.151.0 0.0.0.255 eq ftp
C.access-list 100 permit ip any any
D.access-list 100 deny tcp 210.93.105.0 0.0.0.255 223.8.151.00.0.0.255 eq ftp access list 100 permit ip any any

正确答案：D
第2题：

若要求路由器的某接口上只封禁ICMP协议，但允许159.67.183.0/24子网的ICMP数据包通过，那么使用的access-list命令是______。
A．access-list 120 deny icmp 159.67.183.0 0.0.0.255 any access-list 120 permit ip any any
B．access-list 10 permit icmp 159.67.183.0 0.0.0.255 any access-list 10 deny icmp any any access-list 10 permit ip any any
C．access-list 99 permit icmp 159.67.183.0 0.0.0.255 any access-list 99 deny icmp any any
D．access-list 110 permit icmp 159.67.183.0 0.0.0.255 any access-list 110 deny icmp any any access-list 110 permit ip any any

正确答案：D
解析：依题意，允许159.67.183.0/24子网的ICMP数据包通过该路由器的某接口，相应的配置语句是：access-list 110 permit icmp 159.67.183.0 0.0.0.255 any。
注意到题目“在该路由器接口上只封禁ICMP协议”中“只”字的要求，需要先使用命令access-list 110 deny icmp any any，再使用命令access-list 110 permit ip any any才能完成这一要求。
选项A中的“access-list 120 deny icmp 159.67.183.0 0.0.0.255 any”表示，禁止159.67.183.0/24子网的ICMP数据包通过，因此选项A不符合题意要求。
选项B中的“10”和选项C中的“99”都是标准访问控制列表的表号，而标准访问控制列表的配置命令是access-list access-list-number {permit|deny} source-address wildcard-mask。而选项B和选项C的配置语句中包含了目的IP地址范围(any)，不符合标准访问控制列表的语法格式，因此可排除选项B和选项C。
第3题：

Which item represents the standard IP ACL?()

A.access-list 50 deny 192.168.1.1 0.0.0.255
B.access-list 110 permit ip any any
C.access-list 2500 deny tcp any host 192.168.1.1 eq 22
D.access-list 101 deny tcp any host 192.168.1.1

参考答案：A
第4题：

An access list has been designed to prevent HTTP traffic from the Accounting Department from reaching the HR server attached to the Holyoke router. Which of the following access lists will accomplish this task when grouped with the e0 interface on the Chicopee router（）。
A. permit ip any any deny tcp 172.16.16.0 0.0.0.255 172.17.17.252 0.0.0.0 eq 80
B. permit ip any any deny tcp 172.17.17.252 0.0.0.0 172.16.16.0 0.0.0.255 eq 80
C. deny tcp 172.17.17.252 0.0.0.0 172.16.16.0 0.0.0.255 eq 80 permit ip any any
D. deny tcp 172.16.16.0 0.0.0.255 172.17.17.252 0.0.0.0 eq 80 permit ip any any

参考答案：D
第5题：

要创建一个扩展命名访问控制列表cisco，仅允许HTTP流量进入网络196.15.7.0/24，下面命令是错误的有（）。
- A、ip access-list extended cisco permit tcp any 196.15.7.0 0.0.0.255 eq www
- B、ip access-list extended cisco deny tcp any 196.15.7.0 eq www
- C、ip access-list extended cisco permit 196.15.7.0 0.0.0.255 eq www
- D、ip access-list extended cisco permit ip any 196.15.7.0 0.0.0.255
- E、ip access-list extended cisco permit www 196.15.7.0 0.0.0.255
正确答案:B,C,D,E
第6题：

A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?（）
- A、access-list 101 deny tcp 192.168.1.128 0.0.015 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
- B、access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23 access-list 1 permit ip any any
- C、access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21 access-list 1 permit ip any any
- D、access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
- E、access-list 101 deny ip 192.168.1.128 0.0.0.240 192.158.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
- F、access-list 101 deny ip 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
正确答案:A
第7题：

仅仅允许到主机1.1.1.1的SMTP邮件服务的命名访问控制列表语句是（）。
- A、ip access-list standard cisco permit smtp host 1.1.1.1
- B、ip access-list extended cisco permit ip smtp host 1.1.1.1
- C、ip access-list standard cisco permit tcp any host 1.1.1.1 eq smtp
- D、ip access-list extended cisco permit tcp any host 1.1.1.1 eq smtp
正确答案:D
第8题：

Which item represents the standard IP ACL?（）
- A、access-list 50 deny 192.168.1.1 0.0.0.255
- B、access-list 110 permit ip any any
- C、access-list 2500 deny tcp any host 192.168.1.1 eq 22
- D、access-list 101 deny tcp any host 192.168.1.1
正确答案:A
第9题：

单选题
计费服务器的ip地址在192.168.1.0/24子网内，为了保证计费服务器的安全，不允许任何用户telnet到该服务器，则需要配置的访问列表条目为：（）
A
access-list 11 deny tcp 192.168.1.0 0.0.0.255 eq telnet/access-list 111 permit ip any any
B
access-list 111 deny tcp any 192.168.1.0 eq telnet/access-list 111 permit ip any any
C
access-list 111 deny udp 192.168.1.0 0.0.0.255 eq telnet/access-list 111 permit ip any any
D
access-list 111 deny tcp any 192.168.1.0 0.0.0.255 eq telnet/access-list 111 permit ip any any

正确答案： D
解析：暂无解析
第10题：

单选题
A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?（）
A
access-list 101 deny tcp 192.168.1.128 0.0.015 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
B
access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23 access-list 1 permit ip any any
C
access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21 access-list 1 permit ip any any
D
access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
E
access-list 101 deny ip 192.168.1.128 0.0.0.240 192.158.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
F
access-list 101 deny ip 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any

正确答案： A
解析：暂无解析
第11题：

单选题
An access list has been designed to prevent HTTP traffic from the Accounting Department from reaching the HR server attached to the Holyoke router. Which of the following access lists will accomplish this task when grouped with the e0 interface on the Chicopee router（）。
A
permit ip any any deny tcp 172.16.16.0 0.0.0.255 172.17.17.252 0.0.0.0 eq 80
B
permit ip any any deny tcp 172.17.17.252 0.0.0.0 172.16.16.0 0.0.0.255 eq 80
C
deny tcp 172.17.17.252 0.0.0.0 172.16.16.0 0.0.0.255 eq 80 permit ip any any
D
deny tcp 172.16.16.0 0.0.0.255 172.17.17.252 0.0.0.0 eq 80 permit ip any any

正确答案： D
解析：暂无解析
第12题：

多选题
要创建一个扩展命名访问控制列表cisco，仅允许HTTP流量进入网络196.15.7.0/24，下面命令是错误的有（）。
A
ip access-list extended cisco permit tcp any 196.15.7.0 0.0.0.255 eq www
B
ip access-list extended cisco deny tcp any 196.15.7.0 eq www
C
ip access-list extended cisco permit 196.15.7.0 0.0.0.255 eq www
D
ip access-list extended cisco permit ip any 196.15.7.0 0.0.0.255
E
ip access-list extended cisco permit www 196.15.7.0 0.0.0.255

正确答案： E,D
解析：暂无解析
第13题：

要禁止内网中IP地址为198.168.46.8的PC访问外网，正确的ACL规则是(11)。
A．access-list 1 permit ip 192.168.46.00.0.0.255 any access-list 1 deny ip host 198.168.46.8 any
B．access-list 1 permit ip host 198.168.46.8 any access-list 1 deny ip 192.168.46.00.0.0.255 any
C．access-list 1 deny ip 192.168.46.00.0.0.255 any access-list 1 permit ip host 198.168.46.8 any
D．access-list 1 deny ip host 198.168.46.8 any access-list 1 permitip 192.168.46.00.0.0.255 any

正确答案：D
D 解析：这是一道要求掌握标准访问控制列表的具体应用的理解题。本题的解答思路如下。
最简单的访问控制列表就是标准访问控制列表。它是通过使用IP包中的源IP地址进行过滤，使用访问控制列表号1～99宋创建相应的ACL。其具体的语法格式如下：

例如，access-list 1 deny ip host 198.168.46.8 any配置语句可将所有来自198.168.46.8地址的数据包丢弃。对于标准访问控制列表而言，可以省略默认的关键词host。换言之，语句access-list 1 deny ip host 198.168.46.8 any与语句access-list 1deny中198.168.46.8 any是等价的。
当然也可以用网段来表示ip地址＞，以实现对某个网段的数据包的过滤。例如，access-list 1 permit ip 192.168.46.00.0.0.255 any配置语句，允许所有来自198.168.46.0/24网段内所有计算机的数据包通过防火墙。其中，0.0.0.255是子网掩码255.255.255.0的反向掩码。
第14题：

定义一个用于封禁ICMP协议而只允许转发l66．129．130．0／24子网的ICMP数据包的访问控制列表，Cisc0路由器的正确配置是（）。
A.access-list 198 permit icmp 166．129．130．0 255．255．255．0 anyaccess-list 198 deny iemp any anyaccess-list 198 permit ip any any
B.access-list 198 permit icmp 166．129．130．0 0．0．0．255 anyaccess-list 198 deny iemp any anyaccess-list 198 permit ip any any
C.access-list 99 permit icmp 166．129．130．0 0．0．0．255 anyaccess-list 99 deny iemp any anyaccess-list 99 permit ip any any
D.access-list 100 permit icmp 166．129．130．0 0．0．0．255 anyaccess-list 100 permit ip any anyaccess-list 100 deny icmp any any

正确答案：B
标准访问控制列表标号为1～99，1300～1999。100～199，2000～2699为扩展控制列表。标准访问控制列表只能检查数据包的源地址，因此其功能有很大的局限性，扩展访问控制列表可以检查数据包的源地址和目的地址，还可以对数据包头中的协议进行过滤，如IP协议，ICMP协议和TCP协议等，因此排除C。访问控制列表的通配符是子网掩码的反码。所以A项错误。而D项先执行"access-list100per-mitipanyany"，那么所有的IP地址都不禁封，而后面命令的将不执行，D项错。所以选B。
第15题：

A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?（）
A.access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
B.access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
C.access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21 access-list 1 permit ip any any
D.access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23 access-list 1 permit ip any any

参考答案：A
第16题：

计费服务器的ip地址在192.168.1.0/24子网内，为了保证计费服务器的安全，不允许任何用户telnet到该服务器，则需要配置的访问列表条目为：（）
- A、access-list 11 deny tcp 192.168.1.0 0.0.0.255 eq telnet/access-list 111 permit ip any any
- B、access-list 111 deny tcp any 192.168.1.0 eq telnet/access-list 111 permit ip any any
- C、access-list 111 deny udp 192.168.1.0 0.0.0.255 eq telnet/access-list 111 permit ip any any
- D、access-list 111 deny tcp any 192.168.1.0 0.0.0.255 eq telnet/access-list 111 permit ip any any
正确答案:D
第17题：

仅允许HTTP流量进入网络196.15.7.0，下面命令错误的是（）。
- A、access-list 100 permit tcp any 196.15.7.0 0.0.0.255 eq www
- B、access-list 10 deny tcp any 196.15.7.0 eq www
- C、access-list 100 permit 196.15.7.0 0.0.0.255 eq www
- D、access-list 110 permit ip any 196.15.7.0 0.0.0.255
- E、access-list 110 permit www 196.15.7.0 0.0.0.255
正确答案:B,C,D,E
第18题：

在访问列表中，有一条规则如下：access-list 131 permit ip any 192.168.10.0 0.0.0.255 eq ftp 在该规则中，any的意思是表示：（）
- A、检察源地址的所有bit位
- B、检查目的地址的所有bit位
- C、允许所有的源地址
- D、允许255.255.255.255 0.0.0.0
正确答案:C
第19题：

哪个选项代表了标准的IP ACL？（）
- A、 access-list 50 deny 192.168.1.1 0.0.0.255
- B、 access-list 110 permit ip any any
- C、 access-list 2500 deny tcp any host 192.168.1.1 eq 22
- D、 access-list 101 deny tcp any host 192.168.1.1
正确答案:C
第20题：

A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?（）
- A、access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
- B、access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
- C、access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21 access-list 1 permit ip any any
- D、access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23 access-list 1 permit ip any any
正确答案:A
第21题：

单选题
哪个选项代表了标准的IP ACL？（）
A
access-list 50 deny 192.168.1.1 0.0.0.255
B
access-list 110 permit ip any any
C
access-list 2500 deny tcp any host 192.168.1.1 eq 22
D
access-list 101 deny tcp any host 192.168.1.1

正确答案： D
解析：暂无解析
第22题：

多选题
仅允许HTTP流量进入网络196.15.7.0，下面命令错误的是（）。
A
access-list 100 permit tcp any 196.15.7.0 0.0.0.255 eq www
B
access-list 10 deny tcp any 196.15.7.0 eq www
C
access-list 100 permit 196.15.7.0 0.0.0.255 eq www
D
access-list 110 permit ip any 196.15.7.0 0.0.0.255
E
access-list 110 permit www 196.15.7.0 0.0.0.255

正确答案： C,B
解析：暂无解析
第23题：

单选题
A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?（）
A
access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
B
access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
C
access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21 access-list 1 permit ip any any
D
access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23 access-list 1 permit ip any any

正确答案： A
解析：暂无解析

题目

相似考题

参考答案和解析

相关内容