ACL Incident Response & Recovery 2 — Questions and Answers
Question 1: After discovering a security breach caused by a misconfigured ACL, what is the FIRST remediation step an administrator should take?
- Delete all existing ACLs and start fresh
- Identify and isolate affected network segments (Correct answer)
- Notify all users of the breach immediately
- Upgrade all network hardware
Correct answer: Identify and isolate affected network segments
Isolating affected segments prevents further lateral movement while preserving evidence for forensic analysis.
Question 2: Which ACL log entry pattern most strongly indicates an ongoing port scan attack against a protected network?
- Repeated denied ICMP echo requests from one source
- A single denied TCP connection to port 80
- Multiple denied TCP SYN packets to sequential ports from one source IP (Correct answer)
- Allowed UDP traffic on port 53
Correct answer: Multiple denied TCP SYN packets to sequential ports from one source IP
Sequential port probing via SYN packets from a single source is the hallmark of an automated port scan.
Question 3: When recovering from an ACL-related incident where traffic was incorrectly permitted, which recovery action verifies the fix is effective?
- Rebooting all routers and switches
- Running a penetration test against the fixed ACL (Correct answer)
- Reviewing only outbound traffic logs post-fix
- Disabling logging temporarily to reduce noise
Correct answer: Running a penetration test against the fixed ACL
A targeted penetration test confirms that previously exploited traffic paths are now correctly blocked by the corrected ACL.
Question 4: An ACL permits traffic from 10.0.0.0/24 but logs show 10.0.0.50 exfiltrating data. Which incident response action addresses the root cause?
- Block 10.0.0.50 specifically with a deny ACE before the permit statement (Correct answer)
- Expand the ACL to allow all RFC 1918 space
- Remove the entire ACL and rebuild from scratch
- Increase bandwidth on the egress interface
Correct answer: Block 10.0.0.50 specifically with a deny ACE before the permit statement
Adding a specific deny ACE for the compromised host before the broad permit statement blocks that host while preserving access for legitimate users.
Question 5: During incident response, an analyst needs to determine which ACL rule permitted unauthorized SSH access. What is the most efficient method?
- Disable SSH globally and observe service interruptions
- Review ACL hit counters and logs filtered for port 22 traffic (Correct answer)
- Replace all permit any rules with deny any
- Capture full packet payloads on all interfaces
Correct answer: Review ACL hit counters and logs filtered for port 22 traffic
ACL hit counters combined with syslog entries filtered for destination port 22 pinpoint the permissive rule without disrupting the network.
Question 6: A company's ACL was modified by an attacker to allow inbound traffic on port 3389. What post-incident change control practice prevents recurrence?
- Store ACL backups only on the affected device
- Require multi-person authorization and audit logging for ACL changes (Correct answer)
- Allow any administrator to modify ACLs without approval
- Disable remote management protocols entirely
Correct answer: Require multi-person authorization and audit logging for ACL changes
Dual-authorization and immutable audit logs for ACL changes create accountability and detect unauthorized modifications early.
Question 7: Which forensic artifact is most valuable when reconstructing the timeline of an ACL-bypass incident?
- The current running configuration only
- Syslog timestamps of ACL deny/permit events correlated with NetFlow data (Correct answer)
- SNMP polling statistics from before the incident
- Physical access logs to the data center
Correct answer: Syslog timestamps of ACL deny/permit events correlated with NetFlow data
Syslog ACL events with timestamps correlated against NetFlow provide a precise traffic timeline to reconstruct the attack sequence.
ACL Incident Response & Recovery 2
After discovering a security breach caused by a misconfigured ACL, what is the FIRST remediation step an administrator should take?