C3 - Quiz

What are two characteristics of ACLs? (Choose two.)

• Extended ACLs can filter on destination TCP and UDP ports.

• Standard ACLs can filter on source TCP and UDP ports.

• Extended ACLs can filter on source and destination IP addresses.

• 
  Standard ACLs can filter on source and destination IP addresses.

• Standard ACLs can filter on source and destination TCP and UDP ports.

Answer explanation

• Standard ACLs can only filter on source addresses. That is why they are normally placed closest to the destination. Extended ACLs can filter on source and destination IP addresses, port numbers, and specific message types within a particular protocol such as echo request within the ICMP protocol.

Which three statements describe ACL processing of packets? (Choose three.)

• 
  An implicit deny any rejects any packet that does not match any ACE.

• A packet can either be rejected or forwarded as directed by the ACE that is matched.

• A packet that has been denied by one ACE can be permitted by a subsequent ACE.

• 
  A packet that does not match the conditions of any ACE will be forwarded by default.

• 
  Each statement is checked only until a match is detected or until the end of the ACE list.

Answer explanation

• When a packet comes into a router that has an ACL configured on the interface, the router compares the condition of each ACE to determine if the defined criteria has been met. If met, the router takes the action defined in the ACE (allows the packet through or discards it). If the defined criteria has not been met, the router proceeds to the next ACE. An implicit deny any statement is at the end of every standard ACL.

A network administrator configures an ACL with the command R1(config)# access-list 1 permit 172.16.0.0 0.0.15.255 . Which two IP addresses will match this ACL statement? (Choose two.)

• 172.16.0.255

• 172.16.15.36

• 172.16.16.12

• 172.16.34.24

• 172.16.65.21

Answer explanation

• The wildcard mask indicates that any IP address within the range of 172.16.0.0 to 172.16.15.255 matches.

What single access list statement matches all of the following networks?
192.168.16.0
192.168.17.0
192.168.18.0
192.168.19.0

• access-list 10 permit 192.168.16.0 0.0.3.255

• 
  access-list 10 permit 192.168.16.0 0.0.0.255

• access-list 10 permit 192.168.16.0 0.0.15.255

• access-list 10 permit 192.168.0.0 0.0.15.255

Answer explanation

• The ACL statement access-list 10 permit 192.168.16.0 0.0.3.255 will match all four network prefixes. All four prefixes have the same 22 high order bits. These 22 high order bits are matched by the network prefix and wildcard mask of 192.168.16.0 0.0.3.255.

When creating an ACL, which keyword should be used to document and interpret the purpose of the ACL statement on a Cisco device?​

• eq

• established

• remark

• description

Answer explanation

• In order to document the purpose of an ACL and identify its function more easily, the remark keyword is used when building the ACL. The established keyword is used to allow connections that were initially sourced from the current device. The eq operator is used to specify a port number for denying or permitting traffic. The description keyword is used when configuring and documenting interfaces.

Which two characteristics are shared by both standard and extended ACLs? (Choose two.)

• 
  Both kinds of ACLs can filter based on protocol type.

• 
  Both can permit or deny specific services by port number.

• Both include an implicit deny as a final statement.

• 
  Both filter packets for a specific destination host IP address.

• Both can be created by using either a descriptive name or number.

Answer explanation

• Standard ACLs filter traffic based solely on a specified source IP address. Extended ACLs can filter by source or destination, protocol, or port. Both standard and extended ACLs contain an implicit deny as a final statement. Standard and extended ACLs can be identified by either names or numbers.

Refer to the exhibit. What is the result of adding the established argument to the end of the ACE?

• 
  Any traffic is allowed to reach the 192.168.254.0 255.255.254.0 network.

• 
  Any IP traffic is allowed to reach the 192.168.254.0 255.255.254.0 network as long as it is in response to an originated request.

• 192.168.254.0 /23 traffic is allowed to reach any network.

• Any TCP traffic is allowed to reach the 192.168.254.0 255.255.254.0 network if it is in response to an originated request.

Answer explanation

• The established argument allows TCP return traffic from established connections to be sent on an outgoing interface to a network.

Which two keywords can be used in an access control list to replace a wildcard mask or address and wildcard mask pair? (Choose two.)

• most

• host

• all

• any

• gt

Answer explanation

• The host keyword is used when using a specific device IP address in an ACL. For example, the deny host 192.168.5.5 command is the same is the deny 192.168.5.5 0.0.0.0 command. The any keyword is used to allow any mask through that meets the criteria. For example, the permit any command is the same as permit 0.0.0.0 255.255.255.255 command.

Which two pieces of information are required when creating a standard access control list? (Choose two.)

• destination address and wildcard mask

• source address and wildcard mask

• subnet mask and wildcard mask

• 
  access list number between 100 and 199

• 
  access list number between 1 and 99

Answer explanation

• Standard ACLs can be numbered 1 to 99 and 1300 to 1999. Standard IP ACLs filter only on the source IP address.

What two steps provide the quickest way to completely remove an ACL from a router? (Choose two.)

• Use the no keyword and the sequence number of every ACE within the named ACL to be removed.

• 
  Use the no access-list command to remove the entire ACL.

• 
  Copy the ACL into a text editor, add no before each ACE, then copy the ACL back into the router.

• 
  Modify the number of the ACL so that it doesn't match the ACL associated with the interface.

• Remove the inbound/outbound reference to the ACL from the interface.

Answer explanation

• To completely remove an ACL from a router requires two steps. Removing the actual ACL with the no access-list command and removing the association of the ACL from the appropriate interface.