ACL Rule Configuration & Permissions Management 3

Question 1

Which ACL type can filter traffic based on both source and destination IP addresses as well as Layer 4 port numbers?

Accepted Answer

Extended ACL

Answer

Extended ACLs can match on source/destination IP, protocol, and source/destination port numbers, offering much finer granularity than standard ACLs.

Question 2

An administrator applies the same ACL to an interface twice — once inbound and once outbound. What happens?

Accepted Answer

Cisco IOS replaces the first application with the second for that direction

Answer

On Cisco IOS, only one ACL of a given type can be applied per interface per direction; applying a second ACL in the same direction overwrites the first.

Question 3

What is the purpose of the 'established' keyword in an extended ACL rule for TCP?

Accepted Answer

It permits TCP segments that have the ACK or RST flag set, indicating an established session

Answer

The 'established' keyword matches TCP packets with ACK or RST flags set, which are characteristic of return traffic in an existing connection.

Question 4

An ACL is configured with the following rules in order: (1) permit 10.0.0.0/8, (2) deny 10.1.0.0/16. A packet from 10.1.1.5 arrives. What happens?

Accepted Answer

The packet is permitted by rule 1

Answer

ACLs are processed top-to-bottom; rule 1 matches 10.1.1.5 (which is within 10.0.0.0/8) before rule 2 is even evaluated, so the packet is permitted.

Question 5

Which command removes a specific sequence-numbered entry (e.g., sequence 30) from a named ACL on Cisco IOS?

Accepted Answer

ip access-list extended MYACL / no 30

Answer

Entering named ACL config mode with 'ip access-list extended MYACL' and then 'no 30' removes the entry with sequence number 30.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Rule Configuration & Permissions Management 3