ACL Incident Response & Recovery 2

Question 1

After discovering a security breach caused by a misconfigured ACL, what is the FIRST remediation step an administrator should take?

Accepted Answer

Identify and isolate affected network segments

Answer

Delete all existing ACLs and start fresh

Answer

Notify all users of the breach immediately

Answer

Upgrade all network hardware

Question 2

Which ACL log entry pattern most strongly indicates an ongoing port scan attack against a protected network?

Accepted Answer

Multiple denied TCP SYN packets to sequential ports from one source IP

Answer

Repeated denied ICMP echo requests from one source

Answer

A single denied TCP connection to port 80

Answer

Allowed UDP traffic on port 53

Question 3

When recovering from an ACL-related incident where traffic was incorrectly permitted, which recovery action verifies the fix is effective?

Accepted Answer

Running a penetration test against the fixed ACL

Answer

Rebooting all routers and switches

Answer

Reviewing only outbound traffic logs post-fix

Answer

Disabling logging temporarily to reduce noise

Question 4

An ACL permits traffic from 10.0.0.0/24 but logs show 10.0.0.50 exfiltrating data. Which incident response action addresses the root cause?

Accepted Answer

Block 10.0.0.50 specifically with a deny ACE before the permit statement

Answer

Expand the ACL to allow all RFC 1918 space

Answer

Remove the entire ACL and rebuild from scratch

Answer

Increase bandwidth on the egress interface

Question 5

During incident response, an analyst needs to determine which ACL rule permitted unauthorized SSH access. What is the most efficient method?

Accepted Answer

Review ACL hit counters and logs filtered for port 22 traffic

Answer

Disable SSH globally and observe service interruptions

Answer

Replace all permit any rules with deny any

Answer

Capture full packet payloads on all interfaces

Question 6

A company's ACL was modified by an attacker to allow inbound traffic on port 3389. What post-incident change control practice prevents recurrence?

Accepted Answer

Require multi-person authorization and audit logging for ACL changes

Answer

Store ACL backups only on the affected device

Answer

Allow any administrator to modify ACLs without approval

Answer

Disable remote management protocols entirely

Question 7

Which forensic artifact is most valuable when reconstructing the timeline of an ACL-bypass incident?

Accepted Answer

Syslog timestamps of ACL deny/permit events correlated with NetFlow data

Answer

The current running configuration only

Answer

SNMP polling statistics from before the incident

Answer

Physical access logs to the data center