Module 8-10

When creating an ACL, which keyword should be used to document and interpret the purpose of the ACL statement on a Cisco device?

• remark

• description

• established

• eq

Which two pieces of information are required when creating a standard access control list? (Choose two.)

• access list number between 1 and 99

• source address and wildcard mask

• destination address and wildcard mask

• subnet mask and wildcard mask

• access list number between 100 and 199

What two steps provide the quickest way to completely remove an ACL from a router? (Choose two.)

• Remove the inbound/outbound reference to the ACL from the interface

• Modify the number of the ACL so that it doesn't match the ACL associated with the interface.

• Use the no access-list command to remove the entire ACL.

• Use the no keyword and the sequence number of every ACE within the named ACL to be removed.

• Removal of the ACEs is the only step required.

Which two types of addresses should be denied inbound on a router interface that attaches to the Internet? (Choose two.)

• private IP addresses

• any IP address that starts with the number 127

• any IP address that starts with the number 1

• NAT translated IP addresses

• public IP addresses

In the creation of an IPv6 ACL, what is the purpose of the implicit final command entries, permit icmp any any nd-na and permit icmp any any nd-ns ?

• to allow forwarding of ICMPv6 packets

• to allow automatic address configuration

• to allow IPv6 to MAC address resolution

• to allow forwarding of IPv6 multicast packets

What two statements describe characteristics of IPv6 access control lists? (Choose two.)

• They permit ICMPv6 router advertisements by default.

• They can be named or numbered.

• They include two implicit permit statements by default.

• They are applied to an interface with the ip access-group command.

• They use prefix lengths to indicate how much of an address to match.

Refer to the exhibit. A network administrator created an IPv6 ACL to block the Telnet traffic from the 2001:DB8:CAFE:10::/64 network to the 2001:DB8:CAFE:30::/64 network. What is a command the administrator could use to allow only a single host 2001:DB8:CAFE:10::A/64 to telnet to the 2001:DB8:CAFE:30::/64 network?

• permit tcp 2001:DB8:CAFE:10::A/64 2001:DB8:CAFE:30::/64 eq 23

• permit tcp 2001:DB8:CAFE:10::A/64 eq 23 2001:DB8:CAFE:30::/64

• permit tcp host 2001:DB8:CAFE:10::A eq 23 2001:DB8:CAFE:30::/64

• permit tcp host 2001:DB8:CAFE:10::A 2001:DB8:CAFE:30::/64 eq 23 sequence 5

When implementing components into an enterprise network, what is the purpose of a firewall?

• A firewall is a system that inspects network traffic and makes forwarding decisions based solely on Layer 2 Ethernet MAC addresses.

• A firewall is a system that is designed to secure, monitor, and manage mobile devices, including corporate-owned devices and employee-owned devices.

• A firewall is a system that stores vast quantities of sensitive and business-critical information.

• A firewall is a system that enforces an access control policy between internal corporate networks and external networks.

What are two possible limitations of using a firewall in a network? (Choose two.)

• It provides accessibility of applications and sensitive resources to external untrusted users.

• It increases security management complexity by requiring off-loading network access control to the device.

• A misconfigured firewall can create a single point of failure.

• Network performance can slow down.

• It cannot sanitize protocol flows.

Which type of firewall makes use of a proxy server to connect to remote servers on behalf of clients?

• stateful firewall

• stateless firewall

• packet filtering firewall

• application gateway firewall