ACL Network Security & Traffic Filtering 2 — Questions and Answers
Question 1: Which ACL type can filter traffic based on both source and destination IP addresses as well as port numbers?
- Standard ACL
- Extended ACL (Correct answer)
- Named ACL
- Dynamic ACL
Correct answer: Extended ACL
Extended ACLs filter on source/destination IP, protocol, and port numbers, offering much more granular control than standard ACLs.
Question 2: An ACL is applied with 'ip access-group 110 in' on an interface. What does 'in' specify?
- Traffic leaving the router toward the internet
- Traffic entering the router interface from the network (Correct answer)
- Traffic that is dropped by the ACL
- Traffic that bypasses the ACL
Correct answer: Traffic entering the router interface from the network
The 'in' keyword means the ACL filters traffic as it enters the router interface from the connected network segment.
Question 3: What is the effect of the implicit 'deny all' at the end of every ACL?
- It logs all denied packets
- It drops any traffic not explicitly permitted by earlier ACE statements (Correct answer)
- It sends an ICMP unreachable message to the source
- It forwards traffic to a default route
Correct answer: It drops any traffic not explicitly permitted by earlier ACE statements
Every ACL ends with an implicit deny all entry that drops any packet not matched by a preceding permit or deny statement.
Question 4: A network administrator wants to block Telnet traffic from host 10.1.1.5 to any destination. Which ACL command is correct?
- access-list 100 deny tcp host 10.1.1.5 any eq 23 (Correct answer)
- access-list 10 deny host 10.1.1.5
- access-list 100 deny udp host 10.1.1.5 any eq 23
- access-list 100 deny ip host 10.1.1.5 any eq 23
Correct answer: access-list 100 deny tcp host 10.1.1.5 any eq 23
Telnet uses TCP port 23, so the correct command uses 'tcp' protocol and 'eq 23' to match Telnet traffic from the specific host.
Question 5: Where should an extended ACL be placed for optimal performance?
- As close to the destination as possible
- As close to the source as possible (Correct answer)
- On the core router only
- On the firewall only
Correct answer: As close to the source as possible
Extended ACLs should be placed close to the source so unwanted traffic is dropped early, reducing unnecessary bandwidth consumption.
Question 6: Which wildcard mask would match only the host 192.168.10.25?
- 0.0.0.255
- 0.0.0.0 (Correct answer)
- 255.255.255.0
- 0.255.255.255
Correct answer: 0.0.0.0
A wildcard mask of 0.0.0.0 means all bits must match exactly, which is equivalent to specifying a single host.
Question 7: What does the ACE 'permit ip any any' accomplish when placed at the end of an ACL?
- It blocks all traffic not previously matched
- It overrides all previous deny statements
- It permits all traffic not previously matched by earlier ACEs (Correct answer)
- It enables logging for all traffic
Correct answer: It permits all traffic not previously matched by earlier ACEs
Placing 'permit ip any any' at the end of an ACL allows all traffic that was not denied by previous ACEs to pass through.
ACL Network Security & Traffic Filtering 2
Which ACL type can filter traffic based on both source and destination IP addresses as well as port numbers?