ACL Compliance & Regulatory Frameworks 3 — Questions and Answers
Question 1: Under FISMA, federal agencies must implement access controls aligned with FIPS 199 impact levels. Which ACL approach corresponds to a HIGH impact system?
- Permit-all with logging enabled
- Strict deny-by-default ACLs with continuous monitoring and mandatory access control enforcement (Correct answer)
- Allow all RFC 1918 traffic and block only internet access
- Use ACLs only on external-facing interfaces
Correct answer: Strict deny-by-default ACLs with continuous monitoring and mandatory access control enforcement
FIPS 199 HIGH impact systems require the most stringent access controls, including deny-by-default ACLs with continuous monitoring as specified in NIST SP 800-53.
Question 2: The NIST Cybersecurity Framework (CSF) 'Protect' function includes PR.AC-5 (Network Integrity). Which ACL practice directly supports this subcategory?
- Encrypting ACL configurations at rest
- Implementing network segmentation and access control lists to protect network integrity (Correct answer)
- Backing up ACL configurations weekly
- Using IDS signatures alongside ACLs
Correct answer: Implementing network segmentation and access control lists to protect network integrity
PR.AC-5 explicitly calls for network integrity to be protected through network segmentation and access control as primary technical controls.
Question 3: An auditor reviewing CIS Benchmark compliance checks router ACL configurations. Which finding would be flagged as non-compliant with CIS Controls?
- Explicit deny-all statement at the end of each ACL
- Unused permit rules that allow traffic to deprecated services still present in the ACL (Correct answer)
- Named ACLs used instead of numbered ACLs
- ACL remarks documenting the purpose of each rule
Correct answer: Unused permit rules that allow traffic to deprecated services still present in the ACL
CIS Controls require organizations to remove or disable unused/unnecessary network rules, and permit rules for deprecated services represent an unnecessary attack surface.
Question 4: Under GLBA (Gramm-Leach-Bliley Act), financial institutions must protect customer financial data. Which ACL design supports GLBA's Safeguards Rule?
- A single flat network with logging to detect breaches after the fact
- Segmented network zones with ACLs restricting access to customer financial data to only authorized applications and staff (Correct answer)
- Allowing all branch office traffic to headquarters financial servers
- Using ACLs only on DMZ interfaces, not internal segments
Correct answer: Segmented network zones with ACLs restricting access to customer financial data to only authorized applications and staff
GLBA's Safeguards Rule requires implementing access controls including network segmentation to protect customer financial information from unauthorized access.
Question 5: A company undergoes a SOC 2 Type II audit focusing on the Security trust service criteria. Which ACL-related evidence would the auditor request?
- Marketing brochures describing the company's security posture
- Documented ACL change management procedures, ACL rule reviews, and logs showing unauthorized access attempts were blocked (Correct answer)
- Only the most recent ACL configuration backup
- Penetration test reports from external firms
Correct answer: Documented ACL change management procedures, ACL rule reviews, and logs showing unauthorized access attempts were blocked
SOC 2 Type II audits require operational evidence over a period of time, including ACL change logs, review records, and evidence that controls functioned effectively.
Question 6: NERC CIP-007-6 (Systems Security Management) applies to bulk electric system assets. Which requirement does ACL implementation directly address?
- Physical security of control rooms
- Disabling unnecessary network ports and services via ACL on cyber assets (Correct answer)
- Incident response plan documentation
- Recovery time objectives for generation assets
Correct answer: Disabling unnecessary network ports and services via ACL on cyber assets
NERC CIP-007-6 Requirement R1 specifically requires disabling or restricting unnecessary network ports using ACLs or host-based firewalls on applicable cyber assets.
Question 7: ISO/IEC 27001 Annex A control A.13.1.1 (Network Controls) requires managing networks to protect systems. Which ACL governance practice best satisfies this control?
- Deploying ACLs without formal documentation since they are technical controls
- Establishing a formal ACL rule review process with defined ownership, change approval, and periodic audits (Correct answer)
- Using only vendor default ACL templates for all network devices
- Reviewing ACLs only when a security incident occurs
Correct answer: Establishing a formal ACL rule review process with defined ownership, change approval, and periodic audits
ISO 27001 A.13.1.1 requires formal management of network controls including documented procedures, ownership, and regular reviews of ACL configurations.
ACL Compliance & Regulatory Frameworks 3
Under FISMA, federal agencies must implement access controls aligned with FIPS 199 impact levels.
Which ACL approach corresponds to a HIGH impact system?