Question 590
At a service provider support center in Paris, a post-change check targets this documented issue: An extended IPv4 ACL correctly describes unwanted inbound traffic but was attached outbound on the wrong router interface. Which observation is the strongest evidence that the repair worked?
Explanation
Correct Answer
This is the observable outcome for acl applied wrong direction. It tests whether the targeted change, 'Apply the IPv4 ACL in the traffic ingress direction at the intended enforcement boundary', actually resolved the reported issue at a service provider support center in Paris. The original failure was: An extended IPv4 ACL correctly describes unwanted inbound traffic but was attached outbound on the wrong router interface.
Incorrect Answers
That observation verifies acl counter troubleshooting in a different situation, such as when a new permit rule is blamed for a dropped service even though its hit counter never increases. For the reported acl applied wrong direction incident at a service provider support center in Paris, the required acceptance evidence is: Matched ingress packets are denied before routing while approved packets continue. This other result does not test that condition directly.
That observation verifies urpf loose reachability in a different situation, such as when loose uRPF is installed on an edge and administrators assume it verifies incoming interface symmetry. For the reported acl applied wrong direction incident at a service provider support center in Paris, the required acceptance evidence is: Matched ingress packets are denied before routing while approved packets continue. This other result does not test that condition directly.
That observation verifies urpf strict asymmetric routes in a different situation, such as when legitimate multihomed source traffic is dropped by strict uRPF because the best reverse path uses another interface. For the reported acl applied wrong direction incident at a service provider support center in Paris, the required acceptance evidence is: Matched ingress packets are denied before routing while approved packets continue. This other result does not test that condition directly.