ACL Implementation & Compliance Best Practices 2

Question 1

When implementing ACLs for PCI-DSS compliance, which traffic restriction is mandatory for the cardholder data environment (CDE)?

Accepted Answer

Restrict inbound and outbound traffic to only what is necessary

Answer

PCI-DSS Requirement 1 mandates that firewalls and ACLs restrict CDE traffic to only necessary communications in both directions.

Question 2

A security auditor finds ACL rules that have not been reviewed in 18 months. Which compliance framework specifically requires periodic firewall and ACL rule reviews?

Accepted Answer

PCI-DSS Requirement 1.3

Answer

PCI-DSS Requirement 1.3 mandates reviewing firewall and router rule sets at least every six months.

Question 3

Which ACL implementation technique helps prevent IP spoofing attacks at the network perimeter?

Accepted Answer

Applying inbound ACLs that block RFC 1918 addresses arriving on external interfaces

Answer

Blocking private (RFC 1918) addresses arriving on external interfaces prevents attackers from spoofing internal source IPs.

Question 4

An organization needs to comply with NIST SP 800-53 AC-4 (Information Flow Enforcement). How should ACLs be structured to satisfy this control?

Accepted Answer

Enforce approved authorizations for information flows between interconnected systems

Answer

NIST AC-4 requires enforcing approved authorizations governing information flows based on defined policy.

Question 5

What is the recommended approach when decommissioning an ACL rule that was added for a temporary business need?

Accepted Answer

Remove the rule and document the change in the change management system

Answer

Unused ACL rules should be removed and the removal documented in change management to maintain a clean, auditable ruleset.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Implementation & Compliance Best Practices 2