ACL Knowledge
What pair of actions is used by ACL filtering logic?
Permit and deny
What numbered range are used for standard numbered IPv4 ACLs?
1-99 and 1300-1999
What ACL number ranges are valid for an extended numbered ACL?
100-199 and 2000-2699
In wildcard mask logic, what does a 1 bit mean?
The bit is ignored
What ACL direction evaluates traffic as it enters a router interface?
Inbound
What is an Access Control Entry (ACE)?
A single rule inside an ACL that defines match conditions and an action
Why are standard ACLs applied closest to the destination?
Since they filter only by source address, putting them near the source might block traffic to other good networks
Why are extended ACLs usually placed closet to the source?
They can stop unwanted traffic before it is routed across the network
In a wildcard mask, what does a 0 bit mean?
This bit must match exactly
What ACL keyword matches every possible source or destination address?
Any
What happens if a packet does not match any ACE in an IPv4 ACL?
It is dropped by the implicit deny rule
What does a standard IPv4 ACL check when filtering traffic?
Source IP address only
When does an Inbound ACL evaluate a packet?
Before the router decides where to route the packet.
When does an outbound ACL evaluate a packet?
After the router decides the exit interface
What command attaches an ACL to an interface for packet filtering?
ip access-group
What is the result of the hidden implicit deny at the end of an ACL?
Unmatched packets are blocked
How many ACLs in total can be applied to a single interface?
Two ACLs. One for inbound traffic and one for outbound traffic.
Where should extended ACLs be placed?
As close to the source as possible
What is the name of the network device whose sole purpose is to permit or deny traffic?
Firewall
What command is used to protect VTY remote management access with an ACL?
access-class
What is one benefit of named ACLs compared to numbered ACLs?
They can use descriptive names and are easier to edit
Where should standard ACLs be placed?
As close to the destination as possible
What can an extended IPv4 ACL filter that a standard ACL cannot?
TCP or UDP port numbers and destination addresses
What does a wildcard mask identify in an ACL?
Which IP address bits must match and which bits can be ignored
How does Cisco IOS process ACL entries after a match is found?
It stops processing and applies the matching ACE action