ACL Incident Response & Recovery 3 — Questions and Answers
Question 1: A wildcard mask of 0.0.0.255 in an ACL entry on a Cisco router matches which range of addresses when paired with 192.168.1.0?
- Only 192.168.1.0 exactly
- 192.168.1.0 through 192.168.1.255 (Correct answer)
- 192.168.0.0 through 192.168.255.255
- All IPv4 addresses
Correct answer: 192.168.1.0 through 192.168.1.255
A wildcard mask of 0.0.0.255 ignores the last octet, matching all 256 host addresses in the 192.168.1.0 /24 network.
Question 2: During recovery from an ACL misconfiguration that caused a network outage, which rollback strategy carries the lowest risk?
- Manually retyping the previous ACL from memory
- Restoring a known-good ACL from a version-controlled configuration backup (Correct answer)
- Removing all ACLs until the network stabilizes
- Applying a template ACL from the vendor's website
Correct answer: Restoring a known-good ACL from a version-controlled configuration backup
Version-controlled backups provide verified, tested configurations that can be restored quickly and accurately without introducing new errors.
Question 3: An IDS alert indicates ACL-permitted traffic is being used for command-and-control (C2) over port 443. Which containment action is most targeted?
- Block all HTTPS traffic at the perimeter
- Add a deny ACE for the specific C2 destination IP before the permit HTTPS rule (Correct answer)
- Shut down all external-facing interfaces
- Migrate to a next-generation firewall immediately
Correct answer: Add a deny ACE for the specific C2 destination IP before the permit HTTPS rule
Inserting a deny ACE for the known C2 IP before the broad HTTPS permit rule surgically blocks C2 while preserving legitimate HTTPS traffic.
Question 4: What does a reflexive ACL (IP session filtering) do that a standard ACL cannot during incident recovery?
- Permits inbound traffic only for established outbound sessions (Correct answer)
- Blocks all ICMP traffic by default
- Filters traffic based on Layer 7 application signatures
- Applies rules only to named interfaces
Correct answer: Permits inbound traffic only for established outbound sessions
Reflexive ACLs dynamically create temporary permit entries for return traffic matching established outbound sessions, blocking unsolicited inbound connections.
Question 5: After an incident where ACL rules were exhausted by a DoS attack flooding the ACE table, which preventive measure is most appropriate?
- Increase the number of VLANs on the network
- Implement upstream rate-limiting and summarize ACL rules to reduce ACE count (Correct answer)
- Disable all extended ACLs and use standard ACLs only
- Replace all Layer 3 switches with Layer 2 switches
Correct answer: Implement upstream rate-limiting and summarize ACL rules to reduce ACE count
Upstream rate-limiting reduces attack volume, while ACL summarization decreases table size, preventing TCAM exhaustion.
Question 6: Which ACL placement rule is critical during incident recovery to stop an internal host from communicating with a known malicious external IP?
- Place an extended ACL on the internal interface in the outbound direction (Correct answer)
- Place a standard ACL on the external interface in the inbound direction
- Place an extended ACL on the external interface in the outbound direction
- Place a standard ACL on the loopback interface
Correct answer: Place an extended ACL on the internal interface in the outbound direction
An extended ACL on the internal (LAN-facing) interface in the outbound direction blocks traffic as it leaves the internal network toward the malicious IP.
Question 7: A security team discovers that a time-based ACL was incorrectly configured, allowing unauthorized access during off-hours. Which recovery action directly addresses this?
- Remove all time-based ACLs from the network
- Correct the time-range definition and verify NTP synchronization on all devices (Correct answer)
- Replace time-based ACLs with static permit rules
- Disable the network during off-hours
Correct answer: Correct the time-range definition and verify NTP synchronization on all devices
Fixing the time-range definition and ensuring NTP accuracy guarantees the time-based ACL enforces the correct schedule.
ACL Incident Response & Recovery 3
A wildcard mask of 0.0.0.255 in an ACL entry on a Cisco router matches which range of addresses when paired with 192.168.1.0?