ACL Network Security & Traffic Filtering 3 — Questions and Answers
Question 1: A named ACL uses 'ip access-list extended BLOCK_HTTP'. What advantage does the name provide?
- It automatically applies the ACL to all interfaces
- It allows insertion or deletion of specific ACEs without rewriting the entire ACL (Correct answer)
- It increases the number of permitted ACEs to 500
- It enables the ACL to filter Layer 2 traffic
Correct answer: It allows insertion or deletion of specific ACEs without rewriting the entire ACL
Named ACLs allow administrators to add, remove, or reorder individual ACEs using sequence numbers without deleting and recreating the entire ACL.
Question 2: Which protocol number is used in an ACL to match ICMP traffic?
- 6
- 17
- 1 (Correct answer)
- 89
Correct answer: 1
ICMP is assigned IP protocol number 1, which can be used in extended ACLs with 'permit icmp' or 'permit 1'.
Question 3: An administrator configures 'access-list 50 permit 192.168.0.0 0.0.255.255'. Which traffic is permitted?
- Only host 192.168.0.0
- All hosts in the 192.168.0.0/16 network (Correct answer)
- All hosts in the 192.168.0.0/24 network
- All IP traffic from any source
Correct answer: All hosts in the 192.168.0.0/16 network
The wildcard mask 0.0.255.255 allows the last two octets to vary freely, matching all 65,536 hosts in the 192.168.0.0/16 address space.
Question 4: What is a 'reflexive ACL' used for in network security?
- Filtering traffic based on MAC addresses
- Automatically permitting return traffic for sessions initiated from inside the network (Correct answer)
- Blocking all inbound traffic by default
- Mirroring ACL rules to a backup router
Correct answer: Automatically permitting return traffic for sessions initiated from inside the network
Reflexive ACLs dynamically create temporary entries that permit return traffic for sessions initiated from the trusted inside network, providing stateful-like behavior.
Question 5: Which command verifies which ACLs are applied to a specific router interface?
- show access-lists
- show ip interface (Correct answer)
- show running-config access-list
- debug ip access-list
Correct answer: show ip interface
'show ip interface' displays the inbound and outbound ACLs applied to each interface along with other IP interface statistics.
Question 6: A packet arrives at a router with an ACL containing 15 ACEs. The packet matches ACE #7 which denies it. What happens to ACEs 8–15?
- They are all checked in sequence before dropping the packet
- They are skipped because processing stops at the first match (Correct answer)
- They are checked only if ACE #7 has the 'continue' keyword
- They override ACE #7 if any permit the packet
Correct answer: They are skipped because processing stops at the first match
ACL processing is top-down and stops at the first matching ACE; once a packet matches ACE #7, the remaining ACEs are not evaluated.
Question 7: What is the purpose of the 'log' keyword appended to an ACL ACE?
- It stores the full packet payload in syslog
- It generates a syslog message each time a packet matches that ACE (Correct answer)
- It automatically blocks the source IP for 60 seconds
- It sends an SNMP trap to the NMS
Correct answer: It generates a syslog message each time a packet matches that ACE
The 'log' keyword causes the router to generate a syslog message with match statistics each time a packet matches that specific ACE.
ACL Network Security & Traffic Filtering 3
A named ACL uses 'ip access-list extended BLOCK_HTTP'.
What advantage does the name provide?