CCNA 200-301 v1.1 IP connectivity and security Fictional web platform recovery · 3 of 4 Runs in your browser · no setup Preview · not independently reviewed

Constrain a proxy-to-application network path

Map the routed flow, write a narrow extended ACL, and preserve a separate management route.

Estimated16 min

DifficultyAdvanced

Points16

Content record

Preview · not independently reviewed

Mapped to Cisco 200-301 objectives · Internal validation 2026-08-13 · Available as preview practice, but a named independent subject-matter expert has not yet verified the question and answer key.

Community review →

3.1Interpret the components of a routing table. 3.2Determine how a router makes a forwarding decision by default. 5.6Configure and verify access control lists.

Show review record and official sources

Method: Mapped to CCNA v1.1 objectives 3.1, 3.2, and 5.6; routed path selection, extended ACL syntax, and controlled management cutover were checked.

Current-profile check: 2026-08-12 · Next review due 2027-02-08

Inspect the evidence

Use only the information provided to complete the tasks.

Addresses and required flows

table

System	Address	Required destination
RPX-01	192.0.2.20	APP-01 TCP 8443
APP-01	192.0.2.35	PostgreSQL DB-01 TCP 5432
MGMT-01	198.51.100.26	APP-01 TCP 22
DB-01	192.0.2.50	No direct proxy or management flow

CORE-01 excerpt

code

CORE-01# show ip route 192.0.2.35
Routing entry for 192.0.2.32/27
  Known via connected, directly connected, Vlan35
CORE-01# show access-lists APP-IN
10 permit ip 192.0.2.0 0.0.0.255 192.0.2.0 0.0.0.255 (temporary)
20 permit tcp host 198.51.100.26 host 192.0.2.35 eq 22

Complete the response

Partial credit is available for matching, ordering, and multi-select tasks.

matching

Match each component to its role in the approved request path.

4 pts

RPX-01 loopback listener → CORE-01 route for 192.0.2.32/27 → APP-01 TCP 8443 → DB-01 TCP 5432 →

Need a hint?

Start with the row and choice that have the most distinctive purpose, then use that pair to narrow the rest.

Show another hint

For each remaining pair, explain the relationship in one sentence before selecting it.

command

Enter the IOS extended ACE that permits only RPX-01 to reach APP-01 on TCP 8443.

4 pts

CORE-01(config-ext-nacl)#

Whitespace and capitalization are ignored when grading.

Need a hint?

Break the request into three parts: the action, the target, and the required constraint or verification.

Show another hint

Check the tool and subcommand first, then add only the flags, values, and paths the prompt requires.

ordering

Order the ACL cutover to reduce exposure without losing management access.

4 pts

Drag the rows or use the arrow buttons to reorder.

1 Record the current ACL, attachment point, direction, counters, and recovery access
2 Add the exact RPX-01:8443 and MGMT-01:22 permits before the implicit deny
3 Use a second management session to test both permits and a denied source; inspect counters
4 Remove the temporary subnet-wide permit and repeat positive and negative tests

Need a hint?

Identify the prerequisite that must happen first and the verification or documentation that belongs last.

Show another hint

For the middle steps, ask what must already be true before each action can safely happen.

multi select

Select the FOUR results required before closing the network change.

4 pts

RPX-01 reaches APP-01:8443 and the permit counter increments MGMT-01 reaches APP-01:22 and the management permit counter increments An unapproved source fails to reach APP-01:8443 and matches the deny behavior RPX-01 cannot reach DB-01:5432 while APP-01 retains its required database flow An any-to-any permit remains at the top for emergency convenience APP-01 accepts SSH from the Internet as an alternate recovery path

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

Ready to check your work?Submit to finish this session and review your feedback. Extra practice is optional.

Persistent progress

Attempt history

Every submission is retained. Starting another attempt never replaces or unlocks the previous one.

No attempts yet

Your first submitted score and detailed answer review will appear here.

Community quality control

Question or answer look wrong?

Proposals and votes help staff prioritize review. They never change the scoring key automatically.

Full review queue →

No community corrections yet

Be the first to flag unclear wording, an answer-key issue, or a source that needs another look.

Propose a correction

Preview · not independently reviewed

Inspect the evidence

Complete the response

Review your result

Attempt history

Question or answer look wrong?