module 14-18

Refer to the exhibit. An administrator has configured a standard ACL on R1 and applied it to interface serial 0/0/0 in the outbound direction. What happens to traffic leaving interface serial 0/0/0 that does not match the configured ACL statements?

• • The resulting action is determined by the destination IP address and port number.

• • The resulting action is determined by the destination IP address.

• • The traffic is dropped.

• • The source IP address is checked and, if a match is not found, traffic is routed out interface serial 0/0/1.

When an inbound Internet-traffic ACL is being implemented, what should be included to prevent the spoofing of internal networks?

• • ACEs to prevent broadcast address traffic

• • ACEs to prevent traffic from private address spaces

• • ACEs to prevent ICMP traffic

• • ACEs to prevent SNMP traffic

• • ACEs to prevent HTTP traffic

Refer to the exhibit. What is the result of adding the established argument to the end of the ACE?

• • 192.168.254.0 /23 traffic is allowed to reach any network.

• • Any IP traffic is allowed to reach the 192.168.254.0 255.255.254.0 network as long as it is in response to an originated request.

• • Any traffic is allowed to reach the 192.168.254.0 255.255.254.0 network.

• • Any TCP traffic is allowed to reach the 192.168.254.0 255.255.254.0 network if it is in response to an originated request.

What single access list statement matches all of the following networks?
192.168.16.0

• 192.168.17.0

• 192.168.18.0

• 192.168.19.0

• • access-list 10 permit 192.168.16.0 0.0.0.255

• • access-list 10 permit 192.168.16.0 0.0.3.255

• • access-list 10 permit 192.168.16.0 0.0.15.255

• • access-list 10 permit 192.168.0.0 0.0.15.255

Refer to the exhibit. The IPv6 access list LIMITED_ACCESS is applied on the S0/0/0 interface of R1 in the inbound direction. Which IPv6 packets from the ISP will be dropped by the ACL on R1?

• • neighbor advertisements that are received from the ISP router

• • HTTPS packets to PC1

• • ICMPv6 packets that are destined to PC1

• • packets that are destined to PC1 on port 80

What are two characteristics of a stateful firewall? (Choose two.)

• • uses static packet filtering techniques

• • uses connection information maintained in a state table

• • prevents Layer 7 attacks

• • analyzes traffic at Layers 3, 4 and 5 of the OSI model

• • uses complex ACLs which can be difficult to configure

How does a firewall handle traffic when it is originating from the public network and traveling to the DMZ network?

• • Traffic that is originating from the public network is inspected and selectively permitted when traveling to the DMZ network.

• • Traffic that is originating from the public network is usually forwarded without inspection when traveling to the DMZ network.

• • Traffic that is originating from the public network is usually blocked when traveling to the DMZ network.

• • Traffic that is originating from the public network is usually permitted with little or no restriction when traveling to the DMZ network.

Which type of firewall is commonly part of a router firewall and allows or blocks traffic based on Layer 3 and Layer 4 information?

• • stateless firewall

• • proxy firewall

• • stateful firewall

• • application gateway firewall

What is one limitation of a stateful firewall?

• • not as effective with UDP- or ICMP-based traffic

• • poor log information

• • cannot filter unnecessary traffic

• • weak user authentication

How does a firewall handle traffic when it is originating from the private network and traveling to the DMZ network?

• • The traffic is selectively denied based on service requirements.

• • The traffic is selectively permitted and inspected.

• • The traffic is usually blocked.

• • The traffic is usually permitted with little or no restrictions.