ACL Types & Classification 3 — Questions and Answers
Question 1: Which ACL classification operates at Layer 3 and Layer 4 of the OSI model?
- Standard ACL
- Extended ACL (Correct answer)
- MAC ACL
- VLAN ACL
Correct answer: Extended ACL
Extended ACLs examine Layer 3 fields (IP addresses) and Layer 4 fields (TCP/UDP ports and flags) for filtering decisions.
Question 2: A VACL (VLAN Access Control List) differs from a router ACL in that it:
- Filters only routed traffic between VLANs
- Can filter traffic within the same VLAN on a switch (Correct answer)
- Only supports inbound filtering
- Cannot match on IP addresses
Correct answer: Can filter traffic within the same VLAN on a switch
VACLs (also called VLAN maps) can filter all traffic within a VLAN, including traffic that is switched and never routed.
Question 3: Which statement correctly distinguishes numbered from named ACLs?
- Named ACLs support only standard filtering; numbered ACLs support extended filtering
- Named ACLs allow individual entry deletion and descriptive labels; numbered ACLs traditionally require full replacement (Correct answer)
- Numbered ACLs support more match criteria than named ACLs
- Named ACLs cannot be applied to interfaces
Correct answer: Named ACLs allow individual entry deletion and descriptive labels; numbered ACLs traditionally require full replacement
Named ACLs allow you to delete individual sequence-numbered entries and use meaningful names, advantages not available in traditional numbered ACLs.
Question 4: An infrastructure ACL (iACL) is primarily used to:
- Filter traffic between end-user VLANs
- Protect the network device's control plane from unauthorized access (Correct answer)
- Manage QoS markings on WAN links
- Permit only OSPF neighbor adjacencies
Correct answer: Protect the network device's control plane from unauthorized access
Infrastructure ACLs protect router and switch management planes by permitting only legitimate management and routing protocol traffic to the device itself.
Question 5: Which ACL type would you use to filter Ethernet frames based on MAC address?
- Standard IP ACL
- Extended IP ACL
- MAC ACL (EtherType ACL) (Correct answer)
- Reflexive ACL
Correct answer: MAC ACL (EtherType ACL)
MAC ACLs (EtherType ACLs) operate at Layer 2 and match traffic based on source or destination MAC addresses.
Question 6: What distinguishes a 'receive ACL' (rACL) from a standard interface ACL on Cisco platforms?
- rACLs filter traffic destined for the router's own IP addresses specifically (Correct answer)
- rACLs only work on outbound interfaces
- rACLs cannot use extended match criteria
- rACLs are applied per-VLAN rather than per-interface
Correct answer: rACLs filter traffic destined for the router's own IP addresses specifically
A receive ACL (rACL) filters packets destined for the router's own processor, protecting the control plane from traffic addressed directly to the device.
Question 7: IPv6 ACLs differ from IPv4 ACLs in that they:
- Only support permit statements, not deny
- Automatically include implicit permits for neighbor discovery messages (Correct answer)
- Cannot be named; only numbered entries are supported
- Do not support port-based filtering
Correct answer: Automatically include implicit permits for neighbor discovery messages
IPv6 ACLs automatically include implicit permit entries for ICMPv6 Neighbor Discovery messages required for normal IPv6 operation.
ACL Types & Classification 3
Which ACL classification operates at Layer 3 and Layer 4 of the OSI model?