ACL Threat Intelligence & Analysis 3

Question 1

A network defender uses a threat intelligence platform to enrich ACL log data. Which enrichment action provides the most context for a suspicious source IP?

Accepted Answer

WHOIS, ASN, geolocation, and reputation scoring

Answer

Combining WHOIS registration data, ASN ownership, geolocation, and threat reputation scoring gives a comprehensive picture of a suspicious IP's risk profile.

Question 2

An ACL is configured to block traffic from a known botnet IP range. After 24 hours, the blocked IPs change and the attacks continue. What concept does this illustrate?

Accepted Answer

Infrastructure agility or fast-flux used by threat actors

Answer

Fast-flux and bulletproof hosting allow threat actors to rapidly rotate IP addresses, making static IP-based ACL blocking less effective over time.

Question 3

Which ACL log field is most useful when correlating threat intelligence to identify whether a connection used an encrypted exfiltration channel?

Accepted Answer

Destination port number

Answer

The destination port number indicates the protocol in use; unusual encrypted ports (e.g., 8443, 4433) may reveal covert exfiltration channels masquerading as HTTPS.

Question 4

A SOC analyst identifies that an internal host is sending DNS queries to an IP known for DNS tunneling. Which ACL strategy best mitigates this threat?

Accepted Answer

Restrict outbound DNS to only authorized internal DNS resolvers

Answer

Forcing all DNS queries through internal, monitored resolvers prevents endpoints from bypassing controls and reaching malicious external DNS servers used for tunneling.

Question 5

In the Diamond Model of intrusion analysis, which element corresponds to the ACL rules that block specific attacker IPs or ports?

Accepted Answer

Infrastructure

Answer

The Infrastructure element of the Diamond Model refers to IP addresses, domains, and services the adversary uses, which are what IP/port-based ACL rules target.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Threat Intelligence & Analysis 3