ACL Implementation & Compliance Best Practices 3 — Questions and Answers
Question 1: An engineer is implementing ACLs on a Cisco router and notices the implicit deny at the end. What action should be taken to meet logging compliance requirements for denied traffic?
- Add an explicit 'deny any any log' rule before the implicit deny (Correct answer)
- Remove the implicit deny and add a custom permit rule
- Enable SNMP traps instead of ACL logging
- Apply the ACL outbound only to avoid log clutter
Correct answer: Add an explicit 'deny any any log' rule before the implicit deny
The implicit deny does not generate log entries; adding an explicit 'deny any any log' statement captures denied traffic for compliance logging.
Question 2: When using ACLs to segment a network for SOX compliance, which systems should be isolated in a separate security zone?
- Development servers with source code repositories
- Systems that process or store financial reporting data (Correct answer)
- Backup servers and archival storage
- Employee workstations in the finance department
Correct answer: Systems that process or store financial reporting data
SOX compliance requires controls around systems that directly process or store financial reporting data to ensure data integrity and confidentiality.
Question 3: Which ACL design principle aligns with the Zero Trust security model?
- Trust all internal traffic and only filter external traffic
- Grant access by default and audit exceptions
- Verify every request regardless of network location and apply least-privilege ACLs (Correct answer)
- Use broad subnet-level ACLs to reduce management overhead
Correct answer: Verify every request regardless of network location and apply least-privilege ACLs
Zero Trust requires verifying all requests regardless of origin and enforcing least-privilege access, which means granular ACLs for all traffic flows.
Question 4: A network team is implementing ACLs across 50 branch routers. Which approach reduces misconfiguration risk while ensuring compliance consistency?
- Have each branch administrator create custom ACLs based on local needs
- Deploy templated ACLs via a network automation tool with peer review and version control (Correct answer)
- Apply a single wildcard ACL that permits all RFC 1918 traffic
- Only implement ACLs on headquarters routers
Correct answer: Deploy templated ACLs via a network automation tool with peer review and version control
Templated ACLs deployed through automation with version control and peer review reduce errors and ensure consistent compliance across all sites.
Question 5: During an ACL audit, a tester discovers a 'permit ip any any' rule positioned before more restrictive rules. What is the security impact?
- No impact — later rules still apply to matching traffic
- The permissive rule overrides all subsequent restrictive rules for matching traffic (Correct answer)
- The router will balance traffic across both matching rules
- Only the last matching rule in the ACL applies
Correct answer: The permissive rule overrides all subsequent restrictive rules for matching traffic
ACLs are processed top-down and stop at the first match, so a broad 'permit ip any any' early in the list allows all traffic before restrictive rules are reached.
Question 6: Which method is recommended for testing ACL changes in a production environment to minimize risk?
- Apply all changes during peak business hours to catch issues quickly
- Test in a staging environment first, then deploy during a maintenance window (Correct answer)
- Apply changes directly and roll back if users complain
- Skip testing if the change is minor
Correct answer: Test in a staging environment first, then deploy during a maintenance window
Validating ACL changes in a staging environment before deploying during a scheduled maintenance window minimizes disruption and rollback complexity.
Question 7: An ACL is configured with 'permit tcp 192.168.1.0 0.0.0.255 any eq 443'. Which traffic does this rule explicitly allow?
- All TCP traffic from any source destined for the 192.168.1.0/24 subnet on port 443
- HTTPS traffic originating from the 192.168.1.0/24 subnet to any destination (Correct answer)
- UDP traffic from 192.168.1.0/24 to any destination on port 443
- All traffic from 192.168.1.0/24 regardless of protocol or port
Correct answer: HTTPS traffic originating from the 192.168.1.0/24 subnet to any destination
This rule permits TCP traffic sourced from the 192.168.1.0/24 network destined for any IP on port 443 (HTTPS).
ACL Implementation & Compliance Best Practices 3
An engineer is implementing ACLs on a Cisco router and notices the implicit deny at the end.
What action should be taken to meet logging compliance requirements for denied traffic?