ACL Implementation & Compliance Best Practices 2 — Questions and Answers
Question 1: When implementing ACLs for PCI-DSS compliance, which traffic restriction is mandatory for the cardholder data environment (CDE)?
- Allow all inbound traffic and log it
- Restrict inbound and outbound traffic to only what is necessary (Correct answer)
- Block only inbound traffic from untrusted networks
- Allow all internal traffic and block only external traffic
Correct answer: Restrict inbound and outbound traffic to only what is necessary
PCI-DSS Requirement 1 mandates that firewalls and ACLs restrict CDE traffic to only necessary communications in both directions.
Question 2: A security auditor finds ACL rules that have not been reviewed in 18 months. Which compliance framework specifically requires periodic firewall and ACL rule reviews?
- HIPAA Security Rule
- PCI-DSS Requirement 1.3 (Correct answer)
- SOC 2 Type I
- ISO 27001 Annex A.12
Correct answer: PCI-DSS Requirement 1.3
PCI-DSS Requirement 1.3 mandates reviewing firewall and router rule sets at least every six months.
Question 3: Which ACL implementation technique helps prevent IP spoofing attacks at the network perimeter?
- Applying inbound ACLs that block RFC 1918 addresses arriving on external interfaces (Correct answer)
- Using only outbound ACLs on all interfaces
- Permitting traffic from any source to reach internal hosts
- Disabling reverse path forwarding checks
Correct answer: Applying inbound ACLs that block RFC 1918 addresses arriving on external interfaces
Blocking private (RFC 1918) addresses arriving on external interfaces prevents attackers from spoofing internal source IPs.
Question 4: An organization needs to comply with NIST SP 800-53 AC-4 (Information Flow Enforcement). How should ACLs be structured to satisfy this control?
- Permit all traffic and log denials
- Enforce approved authorizations for information flows between interconnected systems (Correct answer)
- Apply ACLs only at network boundaries, not internally
- Use a single default-permit ACL on all interfaces
Correct answer: Enforce approved authorizations for information flows between interconnected systems
NIST AC-4 requires enforcing approved authorizations governing information flows based on defined policy.
Question 5: What is the recommended approach when decommissioning an ACL rule that was added for a temporary business need?
- Leave the rule in place but add a comment marking it inactive
- Remove the rule and document the change in the change management system (Correct answer)
- Disable the interface the rule applies to
- Convert the permit rule to a deny rule
Correct answer: Remove the rule and document the change in the change management system
Unused ACL rules should be removed and the removal documented in change management to maintain a clean, auditable ruleset.
Question 6: Which practice best supports ACL compliance during a network security assessment?
- Keeping ACL configurations proprietary and undocumented
- Maintaining an up-to-date network diagram with ACL rule mappings to business justifications (Correct answer)
- Allowing the security team to bypass ACLs for testing
- Using only vendor default ACL configurations
Correct answer: Maintaining an up-to-date network diagram with ACL rule mappings to business justifications
Documented network diagrams with ACL-to-business-justification mappings demonstrate compliance and support audits.
Question 7: A HIPAA-covered entity is configuring ACLs. Which data characteristic determines how strictly access must be controlled under HIPAA?
- Whether the data is stored in the cloud
- Whether the data constitutes electronic Protected Health Information (ePHI) (Correct answer)
- Whether the data is encrypted at rest
- Whether the data originates from a mobile device
Correct answer: Whether the data constitutes electronic Protected Health Information (ePHI)
HIPAA's Security Rule requires access controls specifically for systems containing electronic Protected Health Information (ePHI).
ACL Implementation & Compliance Best Practices 2
When implementing ACLs for PCI-DSS compliance, which traffic restriction is mandatory for the cardholder data environment (CDE)?