ACL Threat Intelligence & Analysis 3 — Questions and Answers
Question 1: A network defender uses a threat intelligence platform to enrich ACL log data. Which enrichment action provides the most context for a suspicious source IP?
- Reverse DNS lookup only
- WHOIS, ASN, geolocation, and reputation scoring (Correct answer)
- Ping latency measurement
- ARP table lookup on the local switch
Correct answer: WHOIS, ASN, geolocation, and reputation scoring
Combining WHOIS registration data, ASN ownership, geolocation, and threat reputation scoring gives a comprehensive picture of a suspicious IP's risk profile.
Question 2: An ACL is configured to block traffic from a known botnet IP range. After 24 hours, the blocked IPs change and the attacks continue. What concept does this illustrate?
- IP spoofing
- Infrastructure agility or fast-flux used by threat actors (Correct answer)
- BGP hijacking
- MAC address cloning
Correct answer: Infrastructure agility or fast-flux used by threat actors
Fast-flux and bulletproof hosting allow threat actors to rapidly rotate IP addresses, making static IP-based ACL blocking less effective over time.
Question 3: Which ACL log field is most useful when correlating threat intelligence to identify whether a connection used an encrypted exfiltration channel?
- Source MAC address
- Destination port number (Correct answer)
- TTL value
- DSCP marking
Correct answer: Destination port number
The destination port number indicates the protocol in use; unusual encrypted ports (e.g., 8443, 4433) may reveal covert exfiltration channels masquerading as HTTPS.
Question 4: A SOC analyst identifies that an internal host is sending DNS queries to an IP known for DNS tunneling. Which ACL strategy best mitigates this threat?
- Block all outbound TCP port 80
- Restrict outbound DNS to only authorized internal DNS resolvers (Correct answer)
- Deny all inbound ICMP traffic
- Block outbound SMTP from end-user hosts
Correct answer: Restrict outbound DNS to only authorized internal DNS resolvers
Forcing all DNS queries through internal, monitored resolvers prevents endpoints from bypassing controls and reaching malicious external DNS servers used for tunneling.
Question 5: In the Diamond Model of intrusion analysis, which element corresponds to the ACL rules that block specific attacker IPs or ports?
- Adversary
- Capability
- Infrastructure (Correct answer)
- Victim
Correct answer: Infrastructure
The Infrastructure element of the Diamond Model refers to IP addresses, domains, and services the adversary uses, which are what IP/port-based ACL rules target.
Question 6: What is the advantage of using geolocation-based ACL rules during a targeted attack originating from a specific foreign country?
- They guarantee zero false positives
- They can quickly reduce attack surface by blocking entire geographic IP ranges (Correct answer)
- They decrypt TLS traffic for inspection
- They prevent insider threats
Correct answer: They can quickly reduce attack surface by blocking entire geographic IP ranges
Geolocation-based ACL rules allow rapid reduction of inbound attack traffic by blocking IP ranges associated with specific countries, though with risk of some false positives.
Question 7: An analyst finds ACL permit entries allowing inbound traffic on TCP port 23 from any source. From a threat intelligence perspective, why is this critical?
- Telnet transmits credentials in plaintext and is targeted by credential-harvesting attackers (Correct answer)
- Port 23 is used for encrypted SSH tunneling
- Telnet traffic consumes excessive bandwidth
- Port 23 bypasses firewall stateful inspection
Correct answer: Telnet transmits credentials in plaintext and is targeted by credential-harvesting attackers
Telnet on port 23 sends all data including usernames and passwords in cleartext, making it a prime target for man-in-the-middle attacks and credential theft.
ACL Threat Intelligence & Analysis 3
A network defender uses a threat intelligence platform to enrich ACL log data.
Which enrichment action provides the most context for a suspicious source IP?