A public-health department must block SMB from the Internet to civic file servers while still allowing administrative SSH from approved jump hosts. Which extended ACL design approach is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Order matters: let the jump-host SSH through, slam the door on Internet SMB, then permit whatever else you still need—because the invisible deny at the bottom eats anything you forget.
Full Explanation
A public-health department blocking SMB from the Internet to civic file servers while still allowing administrative SSH from approved jump hosts should permit TCP from jump-host sources to servers on port 22, deny TCP from untrusted sources to ports 445/139 as needed, and explicitly permit any other required traffic before the implicit deny. That extended ACL design works because order and specificity encode both the allow-management and deny-SMB intents in one list evaluated top-down. Placing permit ip any any at the top so later SMB denies still take effect first fails because the first match wins—broad early permits shadow later denies. Using only a standard ACL matching destination port 445 without sources fails conceptually: standard ACLs cannot match destination ports, and source/untrusted-versus-jump-host distinction requires extended criteria. Relying on loose uRPF alone to distinguish SSH from SMB fails because uRPF checks reverse-path of sources; it does not classify destination ports 22 versus 445. Exam caveat: "deny SMB from the Internet" must not accidentally deny SMB between internal civic segments if those flows traverse the same ACL path—scope denies to untrusted sources or Internet-facing interfaces. Operational check: order jump-host SSH permits first, then Internet SMB denies, then other required permits, apply on the Internet edge inbound, and test jump-host SSH success alongside external SMB attempt drops with ACE hit counters.