When creating an ACL, which keyword should be used to document and interpret the purpose of the ACL statement on a Cisco device?
a) remark
b) description
c) established
d) eq
Answer:
a) remark
Explanation:
Use remark inside ACLs to document purpose/notes. established is for TCP return traffic; eq specifies ports; description is for interfaces.
Which two pieces of information are required when creating a standard access control list? (Choose two.)
a) access list number between 1 and 99
b) source address and wildcard mask
c) destination address and wildcard mask
d) subnet mask and wildcard mask
e) access list number between 100 and 199
Answer:
a) access list number between 1 and 99; b) source address and wildcard mask
Explanation:
Standard ACLs (1–99, 1300–1999) filter only source IPs, using a wildcard mask.
What two steps provide the quickest way to completely remove an ACL from a router? (Choose two.)
a) Removal of the ACEs is the only step required.
b) Modify the number of the ACL so that it doesn’t match the ACL associated with the interface.
c) Copy the ACL into a text editor, add no before each ACE, then copy the ACL back into the router.
d) Remove the inbound/outbound reference to the ACL from the interface.
e) Use the no access-list command to remove the entire ACL.
f) Use the no keyword and the sequence number of every ACE within the named ACL to be removed.
Answer:
d) Remove the inbound/outbound reference to the ACL from the interface.; e) Use the no access-list command to remove the entire ACL.
Explanation:
First unapply the ACL from interfaces, then delete it (no access-list …).
Which two types of addresses should be denied inbound on a router interface that attaches to the Internet? (Choose two.)
a) private IP addresses
b) any IP address that starts with the number 127
c) any IP address that starts with the number 1
d) NAT translated IP addresses
e) public IP addresses
Answer:
a) private IP addresses; b) any IP address that starts with the number 127
Explanation:
Block RFC1918 and 127.0.0.0/8 inbound to mitigate spoofing; also block broadcasts/multicast as appropriate.
In the creation of an IPv6 ACL, what is the purpose of the implicit final command entries, permit icmp any any nd-na and permit icmp any any nd-ns?
a) to allow forwarding of ICMPv6 packets
b) to allow automatic address configuration
c) to allow IPv6 to MAC address resolution
d) to allow forwarding of IPv6 multicast packets
Answer:
c) to allow IPv6 to MAC address resolution
Explanation:
Neighbor Discovery (NS/NA) is used for L2 address resolution in IPv6 and must be permitted.
What two statements describe characteristics of IPv6 access control lists? (Choose two.)
a) They permit ICMPv6 router advertisements by default.
b) They can be named or numbered.
c) They include two implicit permit statements by default.
d) They are applied to an interface with the ip access-group command.
e) They use prefix lengths to indicate how much of an address to match.
Answer:
c) They include two implicit permit statements by default.;
e) They use prefix lengths to indicate how much of an address to match.
Explanation:
IPv6 ACLs are named, applied with ipv6 traffic-filter, use prefix-lengths, and implicitly permit ND (NS/NA).
(IPv6 ACL) Allow only host 2001:DB8:CAFE:10::A to Telnet to 2001:DB8:CAFE:30::/64 (place before existing ACEs). Which command?
a) permit tcp 2001:DB8:CAFE:10::A/64 2001:DB8:CAFE:30::/64 eq 23
b) permit tcp 2001:DB8:CAFE:10::A/64 eq 23 2001:DB8:CAFE:30::/64
c) permit tcp host 2001:DB8:CAFE:10::A eq 23 2001:DB8:CAFE:30::/64
d) permit tcp host 2001:DB8:CAFE:10::A 2001:DB8:CAFE:30::/64 eq 23 sequence 5
Answer:
d) permit tcp host 2001:DB8:CAFE:10::A 2001:DB8:CAFE:30::/64 eq 23 sequence 5
Explanation:
Use host for a single source and a lower sequence to insert before existing entries.
When implementing components into an enterprise network, what is the purpose of a firewall?
a) Inspects traffic and makes decisions based solely on Layer 2 MAC addresses.
b) Secures, monitors, and manages mobile devices.
c) Stores sensitive business data.
d) Enforces an access control policy between internal and external networks.
Answer:
d) Enforces an access control policy between internal and external networks.
Explanation:
A firewall enforces policy to protect internal hosts/resources from untrusted networks.
What are two possible limitations of using a firewall in a network? (Choose two.)
a) It provides accessibility of applications and sensitive resources to external untrusted users.
b) It increases security management complexity by requiring off-loading network access control to the device.
c) A misconfigured firewall can create a single point of failure.
d) Network performance can slow down.
e) It cannot sanitize protocol flows.
Answer:
c) A misconfigured firewall can create a single point of failure.; d) Network performance can slow down.
Explanation:
Firewalls may bottleneck performance and, if misconfigured, become a single point of failure.
Which type of firewall makes use of a proxy server to connect to remote servers on behalf of clients?
a) stateful firewall
b) stateless firewall
c) packet filtering firewall
d) application gateway firewall
Answer:
d) application gateway firewall
Explanation:
A proxy/application gateway operates up to Layer 7 and proxies client connections.
How does a firewall handle traffic from the public network to the private network?
a) Not inspected when traveling to the private network.
b) Usually blocked when traveling to the private network.
c) Usually permitted with little/no restrictions.
d) Selectively permitted when traveling to the private network.
Answer:
b) Usually blocked when traveling to the private network.
Explanation:
Default posture is restrictive for outside → inside traffic.
Which two statements describe the two configuration models for Cisco IOS firewalls? (Choose two.)
a) ZPF must be enabled before enabling an IOS Classic Firewall.
b) The IOS Classic Firewall and ZPF cannot be combined on a single interface.
c) IOS Classic Firewalls and ZPF models can be enabled on a router concurrently.
d) Both IOS Classic Firewall and ZPF require ACLs to define policies.
e) IOS Classic Firewalls must be enabled before enabling ZPF.
Answer:
b) The IOS Classic Firewall and ZPF cannot be combined on a single interface.; c) IOS Classic Firewalls and ZPF models can be enabled on a router concurrently.
Explanation:
Both can coexist on a router, but not on the same interface. ZPF isn’t ACL-dependent.
Designing a ZPF: which step includes dictating devices between most-secure/least-secure zones and redundancy?
a) determine the zones
b) design the physical infrastructure
c) establish policies between zones
d) identify subsets within zones and merge traffic requirements
Answer:
b) design the physical infrastructure
Explanation:
After zones and policies, design physical topology including redundancy and device placement.
When a Cisco IOS ZPF is configured, which three actions can be applied to a traffic class? (Choose three.)
a) pass
b) shape
c) reroute
d) queue
e) inspect
f) drop
Answer:
a) pass;
e) inspect
f) drop
Explanation:
ZPF actions: inspect (stateful), pass (permit), drop (deny).
When using Cisco IOS ZPF, where is the inspection policy applied?
a) to a global service policy
b) to a zone
c) to an interface
d) to a zone pair
Answer:
d) to a zone pair
Explanation:
Policies are applied between zones via zone-pairs.
What is the first step in configuring a Cisco IOS ZPF via the CLI?
a) Define traffic classes.
b) Assign router interfaces to zones.
c) Define firewall policies.
d) Assign policy maps to zone pairs.
e) Create zones.
Answer:
e) Create zones.
Explanation:
Order: create zones → classes → policies → zone-pairs → assign interfaces.
What is one benefit of using a stateful firewall instead of a proxy server?
a) ability to perform user authentication
b) better performance
c) ability to perform packet filtering
d) prevention of Layer 7 attacks
Answer:
b) better performance
Explanation:
Stateful firewalls generally outperform proxies; both can filter packets.
Which statement describes a typical security policy for a DMZ firewall configuration?
a) Traffic that originates from the DMZ interface is selectively permitted to the outside interface.
b) Return traffic from the inside associated with outside-originated traffic is permitted from inside to outside.
c) Return traffic from the outside associated with inside-originated traffic is permitted from outside to the DMZ.
d) Traffic from the inside interface is generally blocked or very selectively permitted to the outside.
e) Traffic from the outside is permitted to the inside with few/no restrictions.
Answer:
a) Traffic that originates from the DMZ interface is selectively permitted to the outside interface.
Explanation:
Typical DMZ policy: DMZ → outside selectively allowed; outside → DMZ specific services; outside → inside restricted.
What is one limitation of a stateful firewall?
a) weak user authentication
b) cannot filter unnecessary traffic
c) not as effective with UDP- or ICMP-based traffic
d) poor log information
Answer:
c) not as effective with UDP- or ICMP-based traffic
Explanation:
Statefulness relies on connection tracking, which is weaker for connectionless protocols.
Which statement describes Cisco IOS ZPF operation?
a) The pass action works in only one direction.
b) Router management interfaces must be manually assigned to the self zone.
c) A router interface can belong to multiple zones.
d) Service policies are applied in interface configuration mode.
Answer:
a) The pass action works in only one direction.
Explanation:
pass is unidirectional; interfaces are automatically in self; policies applied via zone-pairs (global config).
What is the result in the self zone if a router is the source or destination of traffic?
a) No traffic is permitted.
b) All traffic is permitted.
c) Only traffic that originates in the router is permitted.
d) Only traffic destined for the router is permitted.
Answer:
b) All traffic is permitted. ✔
Explanation:
The self zone allows all traffic to/from the router by default.
What are two characteristics of ACLs? (Choose two.)
a) Extended ACLs can filter on destination TCP and UDP ports.
b) Standard ACLs can filter on source TCP and UDP ports.
c) Extended ACLs can filter on source and destination IP addresses.
d) Standard ACLs can filter on source and destination IP addresses.
e) Standard ACLs can filter on source and destination TCP and UDP ports.
Answer:
a) Extended ACLs can filter on destination TCP and UDP ports.
c) Extended ACLs can filter on source and destination IP addresses.
Explanation:
Extended ACLs filter by IP, protocol, and ports; standard ACLs filter source IP only.
Which three statements describe ACL processing of packets? (Choose three.)
a) An implicit deny any rejects any packet that does not match any ACE.
b) A packet can either be rejected or forwarded as directed by the ACE that is matched.
c) A packet that has been denied by one ACE can be permitted by a subsequent ACE.
d) A packet that does not match the conditions of any ACE will be forwarded by default.
e) Each statement is checked only until a match is detected or until the end of the ACE list.
f) Each packet is compared to the conditions of every ACE in the ACL before a decision is made.
Answer:
a) An implicit deny any rejects any packet that does not match any ACE.
b) A packet can either be rejected or forwarded as directed by the ACE that is matched.
e) Each statement is checked only until a match is detected or until the end of the ACE list.
Explanation:
ACLs are evaluated top-down until a match; no match hits the implicit deny.
access-list 1 permit 172.16.0.0 0.0.15.255 — which two IPs match? (Choose two.)
a) 172.16.0.255
b) 172.16.15.36
c) 172.16.16.12
d) 172.16.31.24
e) 172.16.65.21
Answer:
a) 172.16.0.255
b) 172.16.15.36
Explanation:
Wildcard 0.0.15.255 matches 172.16.0.0–172.16.15.255.
-
Questions58
-
Chapter 1 Questions24
-
Chapter 2 Questions25
-
Chapter 3 Questions23
-
Chapter 4 Questions25
-
Module 1-4 Questions73
-
Modules 5-765
-
Modules 8-1049
-
Modules 13-1452
-
Firewalls47
-
Tutorial 611
-
Modules 11-1222
-
Modules 15-1724
-
Modules 18-1922
-
Modules 20-2221
-
Network Security Practice Final64
-
Tutorial Week 913
-
Tutorial 824
-
Tutorial 710
-
Mock Theory A14
-
Internet Security Theory Exam 22/2315
-
Internet Secuirty Theory Exam 25-2615
