A county courts edge router should accept management protocols only from the jump-host subnet as defense in depth. What ACL pattern best supports that goal?
Select an answer to reveal the explanation.
Short Explanation
Think of an infrastructure ACL as a velvet rope at the router’s management door—jump hosts get in; random Internet scanners hear ‘no.’ Transit traffic can still pass while admin planes stay fenced.
Full Explanation
Infrastructure ACLs restrict traffic destined to a device’s management and often control-plane addresses, allowing protocols such as SSH, HTTPS, or SNMP only from approved management networks. A county courts edge router should apply iACLs that permit management from the jump-host subnet and deny other sources to those management planes before broader transit permits, as defense in depth alongside AAA and CoPP.
Permit any any on all VTYs relying solely on enable secret complexity leaves management open to scanners. Filtering only multicast control-plane packets while allowing all unicast management from the Internet fails the jump-host-only goal. Port security on routed WAN Ethernet does not replace IPv4 management ACLs for SSH/SNMP sources.
Exam caveat: iACL = filter traffic to the device itself; do not confuse with transit-only ACLs or L2 port security.
Operational check: place iACL entries permitting jump-host subnets to management planes, deny other sources to those ports/addresses, verify transit still forwards, and test blocked scanners versus allowed jump-host sessions. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.