Question 60
A distribution switch applies an ingress ACL to a routed SVI, but administrators expect it to block frames bridged only inside the same VLAN. Which immediate engineering change most directly addresses this issue?
Explanation
Correct Answer
The underlying issue is that an L3 SVI ACL may not inspect traffic that never traverses that routed interface. This intervention addresses that cause directly. A useful result to confirm is: the blocked same-VLAN flow fails while explicitly permitted traffic continues.
Incorrect Answers
This is suited to a different condition, such as when a multicast video stream floods every port in a VLAN after an IGMP snooping feature is disabled. The reported fault instead arises because an L3 SVI ACL may not inspect traffic that never traverses that routed interface.
This is suited to a different condition, such as when a client subnet uses an on-box DHCP relay but its requests never reach the centralized server after a VRF split. The reported fault instead arises because an L3 SVI ACL may not inspect traffic that never traverses that routed interface.
This is suited to a different condition, such as when a service requires large Ethernet payloads, but a path across several CX switches drops only oversized frames. The reported fault instead arises because an L3 SVI ACL may not inspect traffic that never traverses that routed interface.