A building-permits office drafts an extended ACL to allow SSH from a jump host to a router address while denying other TCP. Which match criteria set correctly expresses that intent without relying on object-group shortcuts in the stem?
Select an answer to reveal the explanation.
Short Explanation
Spell out the five Ws the bouncer needs: TCP, from jump host, to router, port 22—then deny the rest you care about. No magic MAC-only or DSCP-only shortcut replaces that.
Full Explanation
A building-permits office drafting an extended ACL to allow SSH from a jump host to a router address while denying other TCP should match TCP, the jump-host source, the router destination, and destination port 22 in a permit, then deny other unwanted TCP as required. That criteria set expresses the intent explicitly without relying on object-group shortcuts. The correct match works because extended ACLs combine Layer 3/4 fields to select a precise management service path. Matching only the Ethernet MAC of the jump host in a standard ACL numbered 50 fails because standard IPv4 ACLs match source IPv4 addresses, not MACs, and MAC-only matching does not express SSH to a router IPv4 address on port 22. Matching OSPF router LSA age fields inside an extended ACL protocol keyword fails conceptually: ACLs do not parse OSPF LSA age as a permit criterion for SSH. Matching only DSCP EF with no addresses or ports fails because DSCP alone does not imply SSH or identify the jump host and router endpoints. Exam caveat: if the ACL is used as an access-class on VTY lines, remember access-class semantics (source-focused) differ slightly from interface data-plane ACLs—still specify the intended sources and verify with real SSH attempts. Operational check: enter the extended permit for TCP/jump-host/router/22, add required TCP denies, apply to the correct interface or VTY access-class, and confirm SSH from the jump host succeeds while other TCP sources/ports hit denies with incrementing counters.