ACL Incident Response & Recovery 5

Question 1

Which NIST incident response phase involves analyzing ACL logs to determine the scope and impact of a network security breach?

Accepted Answer

Detection and Analysis

Answer

The Detection and Analysis phase involves collecting and examining logs—including ACL logs—to characterize the incident's scope, source, and impact.

Question 2

An attacker used IP spoofing to bypass an ACL that permits traffic from 10.0.0.0/8. Which ACL technique mitigates this attack vector?

Accepted Answer

Implementing ingress filtering (anti-spoofing ACLs) that deny RFC 1918 addresses arriving on external interfaces

Answer

Anti-spoofing ACLs on external interfaces deny private IP addresses that should never arrive from the internet, blocking IP spoofing attempts.

Question 3

During incident recovery, a team must restore ACL configurations across 200 routers quickly. Which approach is most efficient and least error-prone?

Accepted Answer

Use a network automation tool (e.g., Ansible or NAPALM) to push verified ACL templates to all devices

Answer

Automation tools push pre-tested ACL configurations consistently to all devices simultaneously, eliminating human typing errors and drastically reducing recovery time.

Question 4

A named ACL called BLOCK_MALWARE is missing entries after an incident. Which command verifies the current contents on a Cisco device?

Accepted Answer

show ip access-lists BLOCK_MALWARE

Answer

The 'show ip access-lists <name>' command displays all ACEs in the named ACL along with hit counts, confirming current content.

Question 5

Which lesson-learned action best improves ACL resilience after repeated incidents caused by human configuration errors?

Accepted Answer

Implement ACL syntax validation and peer review in a change management pipeline before deployment

Answer

Pre-deployment syntax validation and peer review catch errors before they reach production, directly addressing the root cause of configuration-related incidents.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Incident Response & Recovery 5