ACL Threat Intelligence & Analysis 2 — Questions and Answers
Question 1: An ACL log shows repeated permit hits on port 443 from a single external IP at 3-second intervals over 6 hours. What threat does this most likely indicate?
- Distributed denial-of-service attack
- Automated beacon or C2 check-in traffic (Correct answer)
- Legitimate user session with keep-alive
- BGP route injection attempt
Correct answer: Automated beacon or C2 check-in traffic
Regular, timed connections from a single host are a hallmark of malware beaconing to a command-and-control server.
Question 2: Which threat intelligence feed format is most commonly used to share ACL-relevant indicators such as malicious IP ranges and domain lists in a machine-readable way?
- CSV flat file
- STIX/TAXII (Correct answer)
- Syslog CEF
- SNMP trap
Correct answer: STIX/TAXII
STIX defines the structured format for threat indicators, and TAXII is the transport protocol used to share them automatically.
Question 3: A threat analyst wants to add ACL deny rules based on IPs listed in a threat intelligence feed. What risk must be evaluated before applying the rules to a production router?
- False positives blocking legitimate business traffic (Correct answer)
- OSPF neighbor adjacency dropping
- STP topology changes
- NTP drift on the router clock
Correct answer: False positives blocking legitimate business traffic
Threat feeds can contain inaccurate or outdated entries that may match legitimate IP addresses, causing unintended traffic drops.
Question 4: In ACL threat analysis, what does a 'deny any any' log entry at the end of an ACL reveal about network activity?
- All traffic is being blocked by default
- Traffic that matched no earlier permit rule hit the implicit deny (Correct answer)
- The ACL is misconfigured and needs repair
- The router is dropping routing protocol updates
Correct answer: Traffic that matched no earlier permit rule hit the implicit deny
The implicit or explicit 'deny any any' at the end catches and logs all traffic that did not match any preceding permit statement.
Question 5: Which type of threat actor is most likely to conduct slow, low-volume port scans that attempt to evade ACL-based detection?
- Script kiddies using automated scanners
- Advanced Persistent Threat (APT) actors (Correct answer)
- Opportunistic ransomware operators
- Insider threats with physical access
Correct answer: Advanced Persistent Threat (APT) actors
APT actors deliberately use slow, distributed scanning techniques to avoid triggering rate-based ACL logging thresholds.
Question 6: An analyst reviews ACL logs and notices permit hits on TCP port 4444 to an internal server from an external IP. What threat is most associated with this port?
- DNS zone transfer
- Metasploit default reverse shell listener (Correct answer)
- LDAP enumeration
- NFS file share access
Correct answer: Metasploit default reverse shell listener
TCP port 4444 is the default listener port for Metasploit reverse shells and is commonly associated with post-exploitation activity.
Question 7: What is the primary purpose of analyzing ACL hit counts over time when performing threat intelligence analysis?
- To verify that the ACL syntax is correct
- To identify traffic baseline deviations that may indicate attacks (Correct answer)
- To measure router CPU utilization
- To confirm VLAN membership of hosts
Correct answer: To identify traffic baseline deviations that may indicate attacks
Comparing current hit counts against established baselines helps analysts detect anomalous spikes that may indicate scanning, flooding, or exfiltration attempts.
ACL Threat Intelligence & Analysis 2
An ACL log shows repeated permit hits on port 443 from a single external IP at 3-second intervals over 6 hours.
What threat does this most likely indicate?