ACL Threat Intelligence & Analysis 2

Question 1

An ACL log shows repeated permit hits on port 443 from a single external IP at 3-second intervals over 6 hours. What threat does this most likely indicate?

Accepted Answer

Automated beacon or C2 check-in traffic

Answer

Regular, timed connections from a single host are a hallmark of malware beaconing to a command-and-control server.

Question 2

Which threat intelligence feed format is most commonly used to share ACL-relevant indicators such as malicious IP ranges and domain lists in a machine-readable way?

Accepted Answer

STIX/TAXII

Answer

STIX defines the structured format for threat indicators, and TAXII is the transport protocol used to share them automatically.

Question 3

A threat analyst wants to add ACL deny rules based on IPs listed in a threat intelligence feed. What risk must be evaluated before applying the rules to a production router?

Accepted Answer

False positives blocking legitimate business traffic

Answer

Threat feeds can contain inaccurate or outdated entries that may match legitimate IP addresses, causing unintended traffic drops.

Question 4

In ACL threat analysis, what does a 'deny any any' log entry at the end of an ACL reveal about network activity?

Accepted Answer

Traffic that matched no earlier permit rule hit the implicit deny

Answer

The implicit or explicit 'deny any any' at the end catches and logs all traffic that did not match any preceding permit statement.

Question 5

Which type of threat actor is most likely to conduct slow, low-volume port scans that attempt to evade ACL-based detection?

Accepted Answer

Advanced Persistent Threat (APT) actors

Answer

APT actors deliberately use slow, distributed scanning techniques to avoid triggering rate-based ACL logging thresholds.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Threat Intelligence & Analysis 2