ACL Network Security & Traffic Filtering 2

Question 1

Which ACL type can filter traffic based on both source and destination IP addresses as well as port numbers?

Accepted Answer

Extended ACL

Answer

Extended ACLs filter on source/destination IP, protocol, and port numbers, offering much more granular control than standard ACLs.

Question 2

An ACL is applied with 'ip access-group 110 in' on an interface. What does 'in' specify?

Accepted Answer

Traffic entering the router interface from the network

Answer

The 'in' keyword means the ACL filters traffic as it enters the router interface from the connected network segment.

Question 3

What is the effect of the implicit 'deny all' at the end of every ACL?

Accepted Answer

It drops any traffic not explicitly permitted by earlier ACE statements

Answer

Every ACL ends with an implicit deny all entry that drops any packet not matched by a preceding permit or deny statement.

Question 4

A network administrator wants to block Telnet traffic from host 10.1.1.5 to any destination. Which ACL command is correct?

Accepted Answer

access-list 100 deny tcp host 10.1.1.5 any eq 23

Answer

Telnet uses TCP port 23, so the correct command uses 'tcp' protocol and 'eq 23' to match Telnet traffic from the specific host.

Question 5

Where should an extended ACL be placed for optimal performance?

Accepted Answer

As close to the source as possible

Answer

Extended ACLs should be placed close to the source so unwanted traffic is dropped early, reducing unnecessary bandwidth consumption.

(ACL) Access Control Lists Practice Test