Consider the following access list that allows IP phone configuration file transfers from a particular host to a TFTP server: R1(config)# access-list 105 permit udp host 10.0.70.23 host 10.0.54.5 range 1024 5000 R1(config)# access-list 105 deny ip any any R1(config)# interface gi0/0 R1(config-if)# ip access-group 105 out Which method would allow the network administrator to modify the ACL and include FTP transfers from any source IP address?

Consider the following access list that allows IP phone configuration file transfers from a particular host to a TFTP server:

R1(config)# access-list 105 permit udp host 10.0.70.23 host 10.0.54.5 range 1024 5000
R1(config)# access-list 105 deny ip any any
R1(config)# interface gi0/0
R1(config-if)# ip access-group 105 out

Which method would allow the network administrator to modify the ACL and include FTP transfers from any source IP address?

• R1(config)# interface gi0/0
  R1(config-if)# no ip access-group 105 out
  R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 20
  R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 21
  R1(config)# interface gi0/0
  R1(config-if)# ip access-group 105 out
• R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 20
  R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 21
• R1(config)# interface gi0/0
  R1(config-if)# no ip access-group 105 out
  R1(config)# no access-list 105
  R1(config)# access-list 105 permit udp host 10.0.70.23 host 10.0.54.5 range 1024 5000
  R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 20
  R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 21
  R1(config)# access-list 105 deny ip any any
  R1(config)# interface gi0/0
  R1(config-if)# ip access-group 105 out
• R1(config)# access-list 105 permit udp host 10.0.70.23 host 10.0.54.5 range 1024 5000
  R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 20
  R1(config)# access-list 105 permit tcp any host 10.0.54.5 eq 21
  R1(config)# access-list 105 deny ip any any

Explanation: When modifying a numbered ACL, new ACEs (Access Control Entries) are appended to the end of the list by default. Because the existing ACL already contains an explicit deny ip any any statement, simply adding new permit commands would place them after the deny statement, making them unreachable and ineffective. The most reliable method is to remove the ACL from the interface, delete it entirely with the no access-list command, and then recreate the entire sequence with the new entries placed before the final deny statement.

Related exam: Enterprise Networking, Security, and Automation ( Version 7.00) - ENSA Final Exam
Related exam: CCNP ENARSI v8 Final Exam Answers