ACL Incident Response & Recovery 3

Question 1

A wildcard mask of 0.0.0.255 in an ACL entry on a Cisco router matches which range of addresses when paired with 192.168.1.0?

Accepted Answer

192.168.1.0 through 192.168.1.255

Answer

A wildcard mask of 0.0.0.255 ignores the last octet, matching all 256 host addresses in the 192.168.1.0 /24 network.

Question 2

During recovery from an ACL misconfiguration that caused a network outage, which rollback strategy carries the lowest risk?

Accepted Answer

Restoring a known-good ACL from a version-controlled configuration backup

Answer

Version-controlled backups provide verified, tested configurations that can be restored quickly and accurately without introducing new errors.

Question 3

An IDS alert indicates ACL-permitted traffic is being used for command-and-control (C2) over port 443. Which containment action is most targeted?

Accepted Answer

Add a deny ACE for the specific C2 destination IP before the permit HTTPS rule

Answer

Inserting a deny ACE for the known C2 IP before the broad HTTPS permit rule surgically blocks C2 while preserving legitimate HTTPS traffic.

Question 4

What does a reflexive ACL (IP session filtering) do that a standard ACL cannot during incident recovery?

Accepted Answer

Permits inbound traffic only for established outbound sessions

Answer

Reflexive ACLs dynamically create temporary permit entries for return traffic matching established outbound sessions, blocking unsolicited inbound connections.

Question 5

After an incident where ACL rules were exhausted by a DoS attack flooding the ACE table, which preventive measure is most appropriate?

Accepted Answer

Implement upstream rate-limiting and summarize ACL rules to reduce ACE count

Answer

Upstream rate-limiting reduces attack volume, while ACL summarization decreases table size, preventing TCAM exhaustion.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Incident Response & Recovery 3