ACL Types & Classification 2 — Questions and Answers
Question 1: Which ACL type filters traffic based solely on source IP address?
- Extended ACL
- Standard ACL (Correct answer)
- Named ACL
- Dynamic ACL
Correct answer: Standard ACL
Standard ACLs filter traffic using only the source IP address as the matching criterion.
Question 2: What is the number range for Cisco extended IP ACLs?
- 1–99
- 100–199 (Correct answer)
- 200–299
- 300–399
Correct answer: 100–199
Cisco extended IP ACLs use numbers in the range 100–199 (and 2000–2699 for expanded range).
Question 3: A reflexive ACL is best described as which type?
- A static ACL that blocks all return traffic
- A dynamic ACL requiring authentication
- A stateful ACL that automatically permits return traffic for established sessions (Correct answer)
- An ACL applied only on inbound interfaces
Correct answer: A stateful ACL that automatically permits return traffic for established sessions
Reflexive ACLs create temporary dynamic entries that allow return traffic matching an established outbound session.
Question 4: Which classification describes an ACL that uses a name string instead of a number?
- Extended ACL
- Standard ACL
- Named ACL (Correct answer)
- Time-based ACL
Correct answer: Named ACL
Named ACLs allow administrators to assign a descriptive string identifier rather than a numeric ID.
Question 5: Dynamic ACLs (lock-and-key) differ from standard ACLs because they:
- Match on destination IP only
- Require user authentication before opening a temporary access hole (Correct answer)
- Are applied only in the outbound direction
- Cannot be used with extended match criteria
Correct answer: Require user authentication before opening a temporary access hole
Dynamic (lock-and-key) ACLs open a temporary permit entry only after a user authenticates, typically via Telnet.
Question 6: Which ACL type is most appropriate for filtering traffic close to the destination host?
- Standard ACL
- Extended ACL (Correct answer)
- Reflexive ACL
- Named standard ACL
Correct answer: Extended ACL
Extended ACLs should be placed close to the source, but their granular matching (source, destination, port) makes them ideal for precise destination-side filtering when needed.
Question 7: Time-based ACLs add which dimension to standard ACL filtering?
- VLAN membership
- Active hours or day-of-week schedules (Correct answer)
- User authentication requirements
- Quality of Service markings
Correct answer: Active hours or day-of-week schedules
Time-based ACLs use time-range objects to activate or deactivate permit/deny rules during specified hours or days.
ACL Types & Classification 2
Which ACL type filters traffic based solely on source IP address?