ACL Security Operations & Monitoring 3 — Questions and Answers
Question 1: A network engineer needs to verify whether ACL traffic filtering is causing an application outage. Which two tools should be used first?
- show ip access-lists and debug ip packet detail (Correct answer)
- ping and traceroute with ACL logging enabled
- show interface and show ip route
- arp and nslookup from the affected host
Correct answer: show ip access-lists and debug ip packet detail
'show ip access-lists' reveals hit counters to confirm if an ACL is matching traffic, and 'debug ip packet detail' shows real-time packet processing decisions.
Question 2: What does a zero hit count on an ACL deny rule likely indicate during troubleshooting?
- The rule is blocking all traffic effectively
- Traffic matching that rule has not been seen, or the ACL is not applied correctly (Correct answer)
- The device's TCAM is full and ignoring the rule
- The rule was recently cleared and counts are resetting
Correct answer: Traffic matching that rule has not been seen, or the ACL is not applied correctly
A zero hit count means either no traffic matching that ACE has arrived, or the ACL is not applied to the correct interface or direction.
Question 3: An administrator applies a strict ACL on a router and immediately loses SSH access to the device. What ACL design mistake most likely caused this?
- The ACL was applied in the wrong VRF
- A deny rule blocked management traffic before a permit rule allowed it (Correct answer)
- The ACL used named instead of numbered format
- The SSH service was disabled by the ACL application
Correct answer: A deny rule blocked management traffic before a permit rule allowed it
Placing a broad deny rule above the management traffic permit rule in the ACL will block SSH before it can be permitted, locking out the administrator.
Question 4: Which command clears ACL hit counters on a Cisco router without removing the ACL from the interface?
- no ip access-list extended ACL_NAME
- clear ip access-list counters ACL_NAME (Correct answer)
- clear ip interface fastethernet 0/0
- no access-group ACL_NAME in
Correct answer: clear ip access-list counters ACL_NAME
'clear ip access-list counters' resets hit counters for the specified ACL while leaving the ACL configuration and interface binding intact.
Question 5: A security team uses NetFlow data alongside ACL logs. What gap does NetFlow fill that ACL logs alone cannot provide?
- NetFlow shows which specific ACL rule matched each flow
- NetFlow captures permitted traffic volume and flow duration for baseline analysis (Correct answer)
- NetFlow logs packet payloads for DLP analysis
- NetFlow provides MAC-layer information not visible to Layer 3 ACLs
Correct answer: NetFlow captures permitted traffic volume and flow duration for baseline analysis
NetFlow records traffic statistics for all flows (including permitted ones), giving visibility into normal and abnormal traffic volumes that ACL logs (which only record matches) cannot provide alone.
Question 6: An ACL is configured to permit traffic from 10.0.0.0/8 to a server. Monitoring shows unexpected traffic from 172.16.5.10 reaching the server. What is the most likely cause?
- The ACL wildcard mask was misconfigured to also match 172.16.0.0/12 (Correct answer)
- The server's host firewall is overriding the router ACL
- The router is running asymmetric routing
- VLAN tagging is bypassing the ACL
Correct answer: The ACL wildcard mask was misconfigured to also match 172.16.0.0/12
A misconfigured wildcard mask could unintentionally match IP ranges beyond the intended 10.0.0.0/8, allowing unexpected sources through.
Question 7: What security monitoring benefit does tagging ACL log messages with unique sequence numbers provide?
- It allows the SIEM to correlate log messages to specific ACL rules without parsing rule text (Correct answer)
- It encrypts sensitive IP information in the log
- It enables log compression before syslog transmission
- It prevents duplicate log entries at the syslog server
Correct answer: It allows the SIEM to correlate log messages to specific ACL rules without parsing rule text
Sequence numbers in ACL log messages let SIEMs and analysts quickly identify which specific rule generated a log without needing to parse or know the full rule text.
ACL Security Operations & Monitoring 3
A network engineer needs to verify whether ACL traffic filtering is causing an application outage.
Which two tools should be used first?