ACL Rule Configuration & Permissions Management 2 — Questions and Answers
Question 1: Which ACL rule action causes the router to silently discard a packet without sending any notification to the source?
- permit
- deny (Correct answer)
- reject
- drop
Correct answer: deny
The 'deny' action silently discards the packet, while 'reject' (used in some implementations) sends an ICMP unreachable message back to the source.
Question 2: When configuring a named extended ACL on a Cisco router, which command enters the ACL configuration mode?
- access-list 101 permit ip any any
- ip access-list extended MYACL (Correct answer)
- permit ip access-list MYACL
- access-list extended name MYACL
Correct answer: ip access-list extended MYACL
'ip access-list extended MYACL' is the correct command to create and enter named extended ACL configuration mode on Cisco IOS.
Question 3: An administrator needs to permit only HTTPS traffic from a specific subnet. Which port number must be specified in the ACL rule?
- 80
- 443 (Correct answer)
- 8080
- 22
Correct answer: 443
HTTPS uses TCP port 443, so the ACL rule must specify destination port 443 to permit only encrypted web traffic.
Question 4: What does the wildcard mask 0.0.0.255 represent when used in an ACL?
- Match only the host address
- Match all addresses in a /24 subnet (Correct answer)
- Match no addresses
- Match all addresses in a /16 subnet
Correct answer: Match all addresses in a /24 subnet
A wildcard mask of 0.0.0.255 means the last octet is irrelevant, so all 256 host addresses in a /24 subnet are matched.
Question 5: An ACL rule reads: 'deny tcp 192.168.1.0 0.0.0.255 any eq 23'. What traffic does this block?
- All traffic from any source to 192.168.1.0/24
- Telnet traffic originating from the 192.168.1.0/24 subnet (Correct answer)
- SSH traffic from 192.168.1.0/24 to any destination
- HTTP traffic to port 23 on any host
Correct answer: Telnet traffic originating from the 192.168.1.0/24 subnet
Port 23 is Telnet; this rule denies TCP connections from any host in 192.168.1.0/24 to port 23 on any destination.
Question 6: Which of the following best describes a 'reflexive ACL'?
- An ACL applied on both inbound and outbound interfaces simultaneously
- An ACL that automatically creates temporary permit entries for return traffic of established sessions (Correct answer)
- An ACL that mirrors rules from one interface to another
- An ACL that applies only to multicast traffic
Correct answer: An ACL that automatically creates temporary permit entries for return traffic of established sessions
Reflexive ACLs dynamically create temporary entries to allow return traffic for outbound sessions, providing basic stateful filtering.
Question 7: When adding a new rule to a numbered standard ACL on a Cisco router that already has entries, where is the new rule inserted by default?
- At the beginning of the ACL
- At the end of the ACL before the implicit deny (Correct answer)
- After the first permit statement
- In numerical sequence based on the rule number
Correct answer: At the end of the ACL before the implicit deny
New entries added to a numbered ACL are appended at the end of the list; to insert rules in a specific position, a named ACL with sequence numbers must be used.
ACL Rule Configuration & Permissions Management 2
Which ACL rule action causes the router to silently discard a packet without sending any notification to the source?