ACL Security Operations & Monitoring 2

Question 1

A security analyst notices that ACL deny logs show repeated hits from internal IP 192.168.1.50 attempting to reach an external malware C2 server. What is the most likely explanation?

Accepted Answer

The host 192.168.1.50 is infected and attempting to beacon out

Answer

Repeated internal-to-external connection attempts to known C2 infrastructure strongly indicate that the internal host is compromised and beaconing.

Question 2

Which syslog severity level is typically used for ACL permit/deny log messages on Cisco IOS devices?

Accepted Answer

Level 6 – Informational

Answer

Cisco IOS ACL log messages are generated at syslog severity level 6 (Informational) by default.

Question 3

An ACL is configured with the 'log-input' keyword instead of 'log'. What additional information does 'log-input' provide?

Accepted Answer

Input interface and source MAC address

Answer

The 'log-input' keyword records the input interface and, for non-tunnel interfaces, the source MAC address in addition to standard log fields.

Question 4

A SOC team wants to detect port scanning activity using ACL logs. Which pattern in the logs would best indicate a port scan from a single source?

Accepted Answer

Many deny hits from one source IP to many different destination ports

Answer

A port scan appears in ACL logs as one source IP generating deny matches across many different destination ports in a short time.

Question 5

What is the purpose of setting an ACL log interval (log-update-threshold) on high-traffic interfaces?

Accepted Answer

To throttle duplicate log messages and reduce CPU/log volume

Answer

The log-update-threshold setting reduces log flooding by batching repeated ACL matches into periodic summary messages instead of logging every hit.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Security Operations & Monitoring 2