An airport authority wants an IPv4 ACL that permits management access only from a /24 jump-host subnet and denies other sources, matching solely on source address. Which ACL type fits that requirement?
Select an answer to reveal the explanation.
Short Explanation
When you only care who is knocking—not which door or which room—a standard ACL is the simple guest list keyed on source address.
Full Explanation
An airport authority that wants an IPv4 ACL permitting management access only from a /24 jump-host subnet and denying other sources, matching solely on source address, needs a standard ACL. Standard ACLs evaluate source IPv4 addresses only, which matches the requirement when destination address and Layer-4 ports are irrelevant to the policy decision. That design works cleanly for simple source allow-listing of management clients toward a civic device or segment when operators intentionally keep the match criteria minimal. Insisting on an extended ACL that must match destination ports even when only the source subnet matters fails because extended ACLs can match ports, but the stem does not require port matching; forcing ports adds complexity without satisfying a stated need. Claiming a reflexive ACL that builds dynamic entries solely from OSPF LSAs fails conceptually: reflexive ACLs track session state from traffic triggers, not from OSPF LSA contents. Asserting that only MAC ACLs in VLAN maps can filter management sources fails because standard IPv4 ACLs are expressly capable of filtering by source IPv4 address for management access control. Exam caveat: standard ACLs are often placed closer to the destination because they lack destination granularity; misplacement can over-block unrelated civic traffic that shares sources. Operational check: write the standard ACL permitting the jump-host /24 then denying other sources as required, apply it in the correct direction on the appropriate interface or access-class, and verify with show access-lists hit counts while testing from allowed and disallowed sources.