ACL Security Operations & Monitoring 2 — Questions and Answers
Question 1: A security analyst notices that ACL deny logs show repeated hits from internal IP 192.168.1.50 attempting to reach an external malware C2 server. What is the most likely explanation?
- The ACL is misconfigured and blocking legitimate traffic
- The host 192.168.1.50 is infected and attempting to beacon out (Correct answer)
- The external server is performing a port scan
- The ACL rule order is causing false positives
Correct answer: The host 192.168.1.50 is infected and attempting to beacon out
Repeated internal-to-external connection attempts to known C2 infrastructure strongly indicate that the internal host is compromised and beaconing.
Question 2: Which syslog severity level is typically used for ACL permit/deny log messages on Cisco IOS devices?
- Level 0 – Emergency
- Level 3 – Error
- Level 6 – Informational (Correct answer)
- Level 7 – Debug
Correct answer: Level 6 – Informational
Cisco IOS ACL log messages are generated at syslog severity level 6 (Informational) by default.
Question 3: An ACL is configured with the 'log-input' keyword instead of 'log'. What additional information does 'log-input' provide?
- Destination MAC address of matched packets
- Input interface and source MAC address (Correct answer)
- TTL value of matched packets
- TCP flags of matched packets
Correct answer: Input interface and source MAC address
The 'log-input' keyword records the input interface and, for non-tunnel interfaces, the source MAC address in addition to standard log fields.
Question 4: A SOC team wants to detect port scanning activity using ACL logs. Which pattern in the logs would best indicate a port scan from a single source?
- Many deny hits from one source IP to many different destination ports (Correct answer)
- One deny hit from many source IPs to a single destination port
- Permit hits from a single source IP to a web server
- Deny hits on ICMP from multiple sources
Correct answer: Many deny hits from one source IP to many different destination ports
A port scan appears in ACL logs as one source IP generating deny matches across many different destination ports in a short time.
Question 5: What is the purpose of setting an ACL log interval (log-update-threshold) on high-traffic interfaces?
- To encrypt log messages before sending to syslog
- To throttle duplicate log messages and reduce CPU/log volume (Correct answer)
- To increase logging verbosity for forensic detail
- To filter logs by source IP before forwarding
Correct answer: To throttle duplicate log messages and reduce CPU/log volume
The log-update-threshold setting reduces log flooding by batching repeated ACL matches into periodic summary messages instead of logging every hit.
Question 6: During a security audit, a reviewer finds an ACL with a 'permit ip any any' rule followed by several deny statements. What is the security impact?
- The deny statements override the permit for specific traffic
- All traffic is permitted and the deny statements are never reached (Correct answer)
- The deny statements still function because ACLs process all rules
- The router drops the entire ACL as invalid
Correct answer: All traffic is permitted and the deny statements are never reached
ACLs are processed top-down and stop at the first match, so a 'permit ip any any' at the top allows all traffic, making subsequent deny rules unreachable.
Question 7: Which SIEM use case directly leverages ACL hit counts to generate a security alert?
- Detecting unauthorized physical access to network closets
- Triggering an alert when deny hits on a critical server ACL exceed a threshold (Correct answer)
- Monitoring CPU utilization on routers
- Alerting on failed SSH login attempts to switches
Correct answer: Triggering an alert when deny hits on a critical server ACL exceed a threshold
SIEMs can ingest ACL hit count metrics and trigger alerts when deny counts on sensitive server ACLs spike above a defined threshold, indicating attack attempts.
ACL Security Operations & Monitoring 2
A security analyst notices that ACL deny logs show repeated hits from internal IP 192.168.1.50 attempting to reach an external malware C2 server.
What is the most likely explanation?