ITForMe Beta Sign in
CCNA 200-301 v1.1 IP connectivity and security Fictional web platform recovery · 3 of 4 Runs in your browser · no setup Original practice · Review pending

Constrain a proxy-to-application network path

Map the routed flow, write a narrow extended ACL, and preserve a separate management route.

Estimated16 min
DifficultyAdvanced
Points16
Scenario brief

Northwind Orchard routes application traffic from RPX-01 through CORE-01 to APP-01. A broad temporary ACL still permits the whole server subnet. The approved design allows one proxy service flow and SSH from one management workstation.

Content record

Original practice · Review pending

Mapped to Cisco 200-301 objectives · Internal validation 2026-08-13 · Original ITForMe practice mapped to published objectives; not an official exam question. A named independent subject-matter expert has not yet verified the question and answer key.

Community review →
3.1Interpret the components of a routing table. 3.2Determine how a router makes a forwarding decision by default. 5.6Configure and verify access control lists.
Show review record and official sources

Method: Mapped to CCNA v1.1 objectives 3.1, 3.2, and 5.6; routed path selection, extended ACL syntax, and controlled management cutover were checked.

Current-profile check: 2026-08-12 · Next review due 2027-02-02

01

Inspect the evidence

Use only the information provided to complete the tasks.

Addresses and required flows

table
SystemAddressRequired destination
RPX-01192.0.2.20APP-01 TCP 8443
APP-01192.0.2.35PostgreSQL DB-01 TCP 5432
MGMT-01198.51.100.26APP-01 TCP 22
DB-01192.0.2.50No direct proxy or management flow

If columns are offscreen, scroll sideways or focus the table and use arrow keys.

CORE-01 excerpt

code
CORE-01# show ip route 192.0.2.35
Routing entry for 192.0.2.32/27
  Known via "connected", distance 0, metric 0 (connected, via interface)
  Routing Descriptor Blocks:
  * directly connected, via Vlan35
      Route metric is 0, traffic share count is 1
CORE-01# show access-lists APP-IN
Extended IP access list APP-IN
    10 permit ip 192.0.2.0 0.0.0.255 192.0.2.0 0.0.0.255 (1284 matches)
    20 permit tcp host 198.51.100.26 host 192.0.2.35 eq 22 (37 matches)
02

Complete the response

Partial credit is available for matching, ordering, and multi-select tasks.

Changes will save automatically.
01
matching

Match each component to its role in the approved request path.

4 pts
Need a hint?

Start with the row and choice that have the most distinctive purpose, then use that pair to narrow the rest.

Show another hint

For each remaining pair, explain the relationship in one sentence before selecting it.

02
command

Enter the IOS extended ACE that permits only RPX-01 to reach APP-01 on TCP 8443.

4 pts

Whitespace and capitalization are ignored when grading.

Need a hint?

Break the request into three parts: the action, the target, and the required constraint or verification.

Show another hint

Check the tool and subcommand first, then add only the flags, values, and paths the prompt requires.

03
ordering

Order the ACL cutover to reduce exposure without losing management access.

4 pts

Drag the rows or use the arrow buttons to reorder.

  1. 1 Record the current ACL, attachment point, direction, counters, and recovery access
  2. 2 Insert the RPX-01 to APP-01 TCP 8443 permit at a sequence number below 10
  3. 3 From a second management session, confirm the new permit and line 20 both count matches
  4. 4 Remove line 10, then repeat the permitted tests and prove an unapproved source is denied
Need a hint?

Identify the prerequisite that must happen first and the verification or documentation that belongs last.

Show another hint

For the middle steps, ask what must already be true before each action can safely happen.

04
multi select

Select the FOUR results required before closing the network change.

4 pts
Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

Ready to check your work?Unanswered tasks and matches earn no points. A partial submission is scored and saved in your history.
Persistent progress

Attempt history

Every submission is retained. Starting another attempt never replaces or unlocks the previous one.

No attempts yet

Your first submitted score and detailed answer review will appear here.

Community quality control

Question or answer look wrong?

Proposals and votes help staff prioritize review. They never change the scoring key automatically.

Full review queue →
No community corrections yet

Be the first to flag unclear wording, an answer-key issue, or a source that needs another look.

Propose a correction