ACL Rule Configuration & Permissions Management 3 — Questions and Answers
Question 1: Which ACL type can filter traffic based on both source and destination IP addresses as well as Layer 4 port numbers?
- Standard ACL
- Extended ACL (Correct answer)
- Dynamic ACL
- Reflexive ACL
Correct answer: Extended ACL
Extended ACLs can match on source/destination IP, protocol, and source/destination port numbers, offering much finer granularity than standard ACLs.
Question 2: An administrator applies the same ACL to an interface twice — once inbound and once outbound. What happens?
- The ACL is applied twice, doubling the security effect
- Cisco IOS replaces the first application with the second for that direction (Correct answer)
- Only one instance is active; the other is ignored
- An error is returned and neither is applied
Correct answer: Cisco IOS replaces the first application with the second for that direction
On Cisco IOS, only one ACL of a given type can be applied per interface per direction; applying a second ACL in the same direction overwrites the first.
Question 3: What is the purpose of the 'established' keyword in an extended ACL rule for TCP?
- It permits only new TCP SYN connections
- It permits TCP segments that have the ACK or RST flag set, indicating an established session (Correct answer)
- It applies the rule only during active business hours
- It limits the rule to connections that have been open for more than 60 seconds
Correct answer: It permits TCP segments that have the ACK or RST flag set, indicating an established session
The 'established' keyword matches TCP packets with ACK or RST flags set, which are characteristic of return traffic in an existing connection.
Question 4: An ACL is configured with the following rules in order: (1) permit 10.0.0.0/8, (2) deny 10.1.0.0/16. A packet from 10.1.1.5 arrives. What happens?
- The packet is denied by rule 2
- The packet is permitted by rule 1 (Correct answer)
- The packet is denied by the implicit deny
- The packet matches both rules and is logged
Correct answer: The packet is permitted by rule 1
ACLs are processed top-to-bottom; rule 1 matches 10.1.1.5 (which is within 10.0.0.0/8) before rule 2 is even evaluated, so the packet is permitted.
Question 5: Which command removes a specific sequence-numbered entry (e.g., sequence 30) from a named ACL on Cisco IOS?
- no access-list 30
- ip access-list extended MYACL / no 30 (Correct answer)
- delete access-list entry 30
- remove sequence 30 from MYACL
Correct answer: ip access-list extended MYACL / no 30
Entering named ACL config mode with 'ip access-list extended MYACL' and then 'no 30' removes the entry with sequence number 30.
Question 6: A DACL (Downloadable ACL) is most commonly associated with which technology?
- Static route filtering
- 802.1X port-based authentication with RADIUS (Correct answer)
- BGP route filtering
- MPLS traffic engineering
Correct answer: 802.1X port-based authentication with RADIUS
DACLs are pushed from a RADIUS server to network devices after successful 802.1X authentication, dynamically applying per-user access policies.
Question 7: What is the maximum number of ACEs (Access Control Entries) typically recommended per ACL on a performance-sensitive router interface?
- There is no limit; add as many as needed
- Fewer is better; each entry consumes TCAM or CPU cycles during lookup (Correct answer)
- Exactly 255 entries per ACL
- ACLs should have at least 100 entries to be effective
Correct answer: Fewer is better; each entry consumes TCAM or CPU cycles during lookup
Each ACE consumes hardware TCAM resources or requires a CPU lookup cycle, so minimizing ACE count improves forwarding performance.
ACL Rule Configuration & Permissions Management 3
Which ACL type can filter traffic based on both source and destination IP addresses as well as Layer 4 port numbers?