ACL Incident Response & Recovery 3

Question 1

A wildcard mask of 0.0.0.255 in an ACL entry on a Cisco router matches which range of addresses when paired with 192.168.1.0?

Accepted Answer

192.168.1.0 through 192.168.1.255

Answer

Only 192.168.1.0 exactly

Answer

192.168.0.0 through 192.168.255.255

Answer

All IPv4 addresses

Question 2

During recovery from an ACL misconfiguration that caused a network outage, which rollback strategy carries the lowest risk?

Accepted Answer

Restoring a known-good ACL from a version-controlled configuration backup

Answer

Manually retyping the previous ACL from memory

Answer

Removing all ACLs until the network stabilizes

Answer

Applying a template ACL from the vendor's website

Question 3

An IDS alert indicates ACL-permitted traffic is being used for command-and-control (C2) over port 443. Which containment action is most targeted?

Accepted Answer

Add a deny ACE for the specific C2 destination IP before the permit HTTPS rule

Answer

Block all HTTPS traffic at the perimeter

Answer

Shut down all external-facing interfaces

Answer

Migrate to a next-generation firewall immediately

Question 4

What does a reflexive ACL (IP session filtering) do that a standard ACL cannot during incident recovery?

Accepted Answer

Permits inbound traffic only for established outbound sessions

Answer

Blocks all ICMP traffic by default

Answer

Filters traffic based on Layer 7 application signatures

Answer

Applies rules only to named interfaces

Question 5

After an incident where ACL rules were exhausted by a DoS attack flooding the ACE table, which preventive measure is most appropriate?

Accepted Answer

Implement upstream rate-limiting and summarize ACL rules to reduce ACE count

Answer

Increase the number of VLANs on the network

Answer

Disable all extended ACLs and use standard ACLs only

Answer

Replace all Layer 3 switches with Layer 2 switches

Question 6

Which ACL placement rule is critical during incident recovery to stop an internal host from communicating with a known malicious external IP?

Accepted Answer

Place an extended ACL on the internal interface in the outbound direction

Answer

Place a standard ACL on the external interface in the inbound direction

Answer

Place an extended ACL on the external interface in the outbound direction

Answer

Place a standard ACL on the loopback interface

Question 7

A security team discovers that a time-based ACL was incorrectly configured, allowing unauthorized access during off-hours. Which recovery action directly addresses this?

Accepted Answer

Correct the time-range definition and verify NTP synchronization on all devices

Answer

Remove all time-based ACLs from the network

Answer

Replace time-based ACLs with static permit rules

Answer

Disable the network during off-hours