Update ACL Summarization for Vendor Remote Login

Troubleshoot router security features

exhibit Refer to the exhibit. A network engineer received a call from the vendor for a failed attempt to remotely log in to their managed router loopback interface from 192.168.40.15. Which action must the network engineer take to resolve the issue?

  1. The source IP summarization must be updated to include the vendor source IP address. Correct Answer
  2. The time-range configuration must be changed to use absolute instead of periodic.
  3. The EIGRP configuration must be updated to include a network statement for loopback 100.
  4. The IP access list VENDOR must be applied to interface loopback 100.
Answer Correct answer: A — The source IP summarization in the VENDOR access list must be updated to include the 192.168.40.15 IP address.

Community Insight

This question tests IP access list wildcard mask calculation; the common trap is assuming the ACL covers the vendor IP or misapplying the ACL to the loopback interface instead of fixing the address range.

A vendor attempting to remotely log in from 192.168.40.15 is blocked because the VENDOR IP access list only permits the 192.168.32.0/21 range. Updating the source IP summarization in the ACL to include 192.168.40.15 resolves the access failure.

Choosing D, thinking the ACL needs to be applied to the loopback interface, which does not filter inbound VTY sessions correctly, or choosing C, assuming the loopback isn't advertised when it already is via redistribution.

Community Discussion (10 comments)

Mario73 👍 1 Selected: D
The correct answer is D
XxnightwingxX 👍 3 Selected: A
A will fix the problem of the vendor SSH traffic, but nothing else is getting through that interface lol
NazgulNr5 👍 5
'source IP summarization' when you're talking about an ACL is borderline prosa...
AlbertoStu 👍 1
Correctly? Where's the metric? There seems to be multiple problems with this configuration. It's my belief that A and C would both have to be accomplished.
Carltonkh 👍 1
Isn't an implicit deny is applied at F1/0, wouldn’t it block all traffic?
AlexInShort12 👍 1 Selected: C
Are you for real guys? The loopback is not even advertised. Unless the provider has some static route. Nothing will even go to that loopback. ACL and summarization are not the same thing. We are not even sure the ACL is being us to filter the vty access...
XBfoundX 👍 1
As Imado is saying the loopback is been correctly advertised via the eigrp redistribution command. The traffic is filtered because the interface is the P2P link between the other EIGRP neighbor so all the traffic needs to go trough this interface. If I'm gonna deny traffic in inbound from that interface you will never reach the vty anyways.
Imado 👍 7
redistribute connected under eigrp config
inteldarvid 👍 3 Selected: A
The option correct is A
ellen_AA 👍 15 Selected: A
the extended access-list VENDOR: 192.168.32.0 0.0.0.7.255 that starts at 192.168.32.1 and ends at 192.168.39.254 doesn't include the vendor ip address of 192.168.40.15

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The IP access list VENDOR permits the 192.168.32.0 0.0.7.255 range, which covers IP addresses from 192.168.32.1 to 192.168.39.254. The vendor's source IP of 192.168.40.15 falls outside this permitted range and is implicitly denied. Updating the source IP summarization in the ACL to encompass the 192.168.40.x subnet will explicitly permit the vendor's traffic.

Why the Other Options Are Wrong

Option B is incorrect because there is no indication that a time-range configuration is causing the failure. Option C is incorrect because the loopback is already advertised into EIGRP via the redistribute connected command, as noted in the community comments. Option D is incorrect because applying an inbound ACL to the loopback interface does not filter traffic destined for the router's VTY lines; access lists for remote login must be applied to the VTY lines or evaluated against the transit interface.

Community Comment Notes

Commenters pointed out the ACL range limitation, with one noting the "extended access-list VENDOR: 192.168.32.0 0.0.0.7.255" does not include 192.168.40.15. Another clarified that the loopback is correctly advertised via "eigrp redistribution command", eliminating the need for a network statement. The phrasing of "source IP summarization" was questioned as awkward but technically refers to the ACL's summarized network statement.

Exam Strategy

Carefully calculate the range of IP addresses covered by an ACL's network and wildcard mask. Convert the wildcard mask octets to binary to find the exact boundaries of the permitted subnet, ensuring the source IP falls within that range.

Related Analysis

SIMULATION Guidelines This is a lab item in which tasks will

A-Grade

Refer to the exhibit. Which configuration allows the operati

A-Grade

What is an advantage of using BFD?

A-Grade

Practice All 300-410 Questions

Access 159 questions with complete answers and detailed explanations.

View Full 300-410 Practice Test →

← Back to 300-410 Study Guide