ACL Incident Response & Recovery 4

Question 1

During a post-incident review, analysts find that an ACL had an implicit 'permit ip any any' instead of the expected 'deny ip any any'. What risk does this represent?

Accepted Answer

All unmatched traffic was allowed, potentially permitting attacker traffic through the device

Answer

A missing or incorrect implicit deny means all traffic not explicitly matched by earlier ACEs passes through unchecked, nullifying the ACL's security purpose.

Question 2

An organization detects lateral movement between VLANs despite inter-VLAN ACLs being in place. Which explanation is most likely?

Accepted Answer

An ACL is applied in the wrong direction on the Layer 3 SVI

Answer

ACLs applied in the wrong direction on an SVI (e.g., inbound instead of outbound or vice versa) fail to inspect the traffic in the intended flow path.

Question 3

What is the purpose of the 'established' keyword in an extended ACL during incident recovery for TCP traffic?

Accepted Answer

It allows inbound TCP packets that have the ACK or RST bit set, indicating an existing session

Answer

The 'established' keyword permits inbound TCP replies (ACK/RST set) while blocking unsolicited inbound SYN packets that initiate new connections.

Question 4

Which incident scenario requires an object-group ACL rather than a traditional ACL for efficient management?

Accepted Answer

Permitting access from 50 different source IPs to 20 different destination services

Answer

Object-group ACLs consolidate many IPs and services into named groups, drastically reducing the number of ACEs needed compared to individual entries for each combination.

Question 5

After an insider threat incident, an administrator audits ACLs and finds overly permissive rules violating least privilege. Which remediation approach is best practice?

Accepted Answer

Replace all ACLs with a single deny-all rule and gradually add permit rules based on verified business need

Answer

Starting with deny-all and adding only verified permit rules implements the principle of least privilege and ensures no unintended access remains.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Incident Response & Recovery 4