Wildcard Mask Matching in ACL Rule 5
Short answer
ABD Wildcard 0.0.254.255 requires an even third octet, matching 10.0.6.7, 10.0.2.1 and 10.0.4.5 but not 10.0.5.6.
Question
rule 5 permit ip source 10.0.2.0 0.0.254.255
Key Takeaways
The test is whether you evaluate a wildcard mask bitwise per octet instead of treating it as a contiguous address range, which is what makes 10.0.5.6 fail.
This H12-811 ACL question tests wildcard mask matching for rule 5 permit ip source 10.0.2.0 0.0.254.255. The answer is A, B and D, because the third octet must be even while the fourth octet is ignored.
Common mistake: Choosing C (10.0.5.6) or restricting the range to 10.0.2.0–10.0.3.255 by misreading 0.0.254.255 as a subnet-style mask; wildcard bits are non-contiguous, so only the lowest bit of the third octet is checked.
Expert Analysis
Reading the wildcard mask bit by bit
An ACL wildcard mask is the inverse of a subnet mask: a 0 bit means "the source address must match this bit", while a 1 bit means "ignore this bit". The rule rule 5 permit ip source 10.0.2.0 0.0.254.255 therefore has to be evaluated octet by octet against each candidate address.
Where the constraint actually bites
- First and second octets: wildcard
0.0→ both must be exactly10.0. All four options pass. - Fourth octet: wildcard
255→ completely ignored, so the last octet of every option is free to be anything. This is why both10.0.2.1and10.0.4.5are acceptable despite looking "outside" a simple range. - Third octet: wildcard
254= binary11111110. Only the lowest-order bit is significant, and it must equal the corresponding bit of the address2(binary00000010, i.e.0). So the third octet must be even.
Applying the test to the options
- A.
10.0.6.7→ third octet 6 is even → match. - B.
10.0.2.1→ third octet 2 is even → match. - C.
10.0.5.6→ third octet 5 is odd → its lowest bit is1, which conflicts with the required0→ no match. - D.
10.0.4.5→ third octet 4 is even → match.
Community reasoning agrees with this bit-level trace: the wildcard permits addresses whose third octet is even, and 10.0.5.6 fails because 5 is odd. So A, B and D are all matched by the permit rule.
The trap
The classic mistake is to read 0.0.254.255 as a contiguous block such as 10.0.2.0–10.0.3.255 (as if the mask were 0.0.1.255), which would reject A and D. Wildcard masks are non-contiguous: each 1 bit independently punches a hole in the match space, which is exactly what produces the even/odd pattern here.
Exam Strategy
For wildcard-mask questions, convert each mask octet to binary and mark which bits are significant before looking at the options; a 0 bit is a hard constraint, a 1 bit is a wildcard. Then test only the constrained octets—here just the third—because fully wildcarded octets (255) eliminate options automatically. Expect even/odd patterns such as 254, 252 or 248, and never convert a wildcard into a simple start–end range unless the mask is contiguous.
Frequently Asked Questions
Why does wildcard mask 0.0.254.255 match even third octets only?
Does 10.0.6.7 really match when the source is 10.0.2.0?
Why is 10.0.5.6 not matched by rule 5?
Community Votes
34% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Fmoura17 👍 1The correct answers are A, B, and D Summary: IP Address3rd OctetEven/OddMatched?10.0.6.76Even✅ Yes10.0.2.12Even✅ Yes10.0.5.65Odd❌ No10.0.4.54Even✅ Yes
-
ButcherCapybara 👍 10.0.254.255 permits IP addresses where the third octet is an even number. 10.0.5.6 does not havean even number in the third octet
-
Heidorn 👍 12 4 and 6 Have their significant bits from the wildcard matching where needed, 5 does not match.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.