ACL Incident Response & Recovery 2

Question 1

After discovering a security breach caused by a misconfigured ACL, what is the FIRST remediation step an administrator should take?

Accepted Answer

Identify and isolate affected network segments

Answer

Isolating affected segments prevents further lateral movement while preserving evidence for forensic analysis.

Question 2

Which ACL log entry pattern most strongly indicates an ongoing port scan attack against a protected network?

Accepted Answer

Multiple denied TCP SYN packets to sequential ports from one source IP

Answer

Sequential port probing via SYN packets from a single source is the hallmark of an automated port scan.

Question 3

When recovering from an ACL-related incident where traffic was incorrectly permitted, which recovery action verifies the fix is effective?

Accepted Answer

Running a penetration test against the fixed ACL

Answer

A targeted penetration test confirms that previously exploited traffic paths are now correctly blocked by the corrected ACL.

Question 4

An ACL permits traffic from 10.0.0.0/24 but logs show 10.0.0.50 exfiltrating data. Which incident response action addresses the root cause?

Accepted Answer

Block 10.0.0.50 specifically with a deny ACE before the permit statement

Answer

Adding a specific deny ACE for the compromised host before the broad permit statement blocks that host while preserving access for legitimate users.

Question 5

During incident response, an analyst needs to determine which ACL rule permitted unauthorized SSH access. What is the most efficient method?

Accepted Answer

Review ACL hit counters and logs filtered for port 22 traffic

Answer

ACL hit counters combined with syslog entries filtered for destination port 22 pinpoint the permissive rule without disrupting the network.

(ACL) Access Control Lists Practice Test