Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNA 200-301 > Access Control Lists > Flashcards

Access Control Lists Flashcards

1
Q

Access Control Lists are made up of what kind of entries?

A

Access Control Entries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does an extended ACL filter traffic based on?

A

Source IP, Destination IP, Source Port, Destination Port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is this extended ACL command doing?

access-list 100 deny tcp 10.10.30.0 0.0.0.255 gt 49151 10.10.20.1 0.0.0.0 eq 23

A

It’s an extended access control list that is denying TCP traffic to port 23 from the 10.10.30.0/24 subnet going to the destination IP of 10.10.20.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What numbers are considered standard ACL range?

A

1-99 and 1300-1999

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What numbers are considered extended ACL range?

A

100-199 and 2000-2699

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Provide an example of a standard ACL command?

A

access-list 1 permit 10.10.10.10 0.0.0.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does a wildcard mask of 0.0.0.0 mean?

A

It means the subnet mask is 255.255.255.255 and that the IP address before the mask is the only IP being targeted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Standard ACLs can have more parameters than just the source address, correct?

A

No, only Extended ACLs can have more parameters than the source address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does an Extended ACL have a default wildcard mask?

A

No, you have to specify a wildcard mask with an extended ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is this Extended ACL doing?

R1(config)#access-list 100 permit tcp 10.10.10.0 0.0.0.255 gt 49151 10.10.50.10 0.0.0.0 eq telnet

A

It’s an extended ACL that will permit telnet TCP traffic from the subnet of 10.10.10.0/24 with a source port greater than 49151 going to a destination address of 10.10.50.10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is this standard ACL doing?

R1(config)#access-list 1 deny 10.10.10.10 0.0.0.0

A

Denying the IP address of 10.10.10.10. Since it has a wildcard mask of 0.0.0.0 then it’s target that one IP Address and not the subnet range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Name the “steps” in an extended ACL statement?

A
  1. Access List Designation
  2. Access List Number
  3. Permit or Deny Designation
  4. Protocol Designation that you’re wanting to block (TCP, UDP)
  5. IP Subnet with Wildcard Mask
  6. Greater, Less than or Equal To
  7. Source Port Number
  8. Destination IP Subnet with Wildcard Mask
  9. Equal to
  10. Destination Port Number or Protocol (Telnet, SSH, etc.)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How would you configure a named ACL?

A

ip access-list extended (or standard) {name-of-list}

deny {IP network} {wildcard-mask}
deny 10.10.10.0 0.0.0.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In a standard ACL what is the only piece of information that the router or switch cares about?

A

The source address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What number range would 1-99 and 1300-1999 be considered in terms the ACL?

A

Standard Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What number range would 100-199 and 2000-2699 be considered in terms of the ACL?

A

Extended Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Syntax wise, what is the difference between a Numbered ACL and a Named ACL?

A

A numbered ACL would have a number like:
access-list 100

A named ACL would have the standard or extended designation plus a name like:
ip access-list standard Flackbox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What would be the commands to create a named ACL that would deny 10.10.10.10 and permit the 10.10.10.0/24 network?

A

ip access-list standard {name-of-ACL}
deny 10.10.10.10 0.0.0.0
permit 10.10.10.0 0.0.0.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Write an Access Control Entry for this scenario:

Access List number of 100 that permits telnet TCP traffic from the subnet of 10.10.10.0/24 with a source port greater than 49151 going to a destination address of 10.10.50.10

A

access-list 100 permit tcp 10.10.10.0 0.0.0.255 gt 49151 10.10.50.10 0.0.0.0 eq telnet

20
Q

Write an Access Control Entry for this scenario:

Access List number of 100 that denies TCP traffic from the network 10.10.10.0 going to a destination address of 10.10.50.0 that is accepting traffic on port 80

A

access-list 100 deny tcp 10.10.10.0 0.0.0.255 10.10.50.0 0.0.0.255 eq 80

21
Q

What does access-list 100 deny ip 10.10.10.0 0.0.0.255 10.10.50.0 0.0.0.255 represent?

A

This is denying ALL traffic from the source subnet of 10.10.10.0/24 to the destination network of 10.10.50.0/24

22
Q

What command in the ACE would keep you from having to provide a wildcard mask?

A

host

Example: access-list 100 permit tcp host 10.10.10.10

The host command essentially tells the router or switch that’s a single IP you’re targeting

23
Q

What does #access-list 100 permit tcp 0.0.0.0 255.255.255.255 tell us?

A

Permit literally any traffic that is TCP on this port or VLAN

24
Q

What is another way to write #access-list 100 permit tcp 0.0.0.0 255.255.255.255 and still allow all TCP traffic?

A

access-list 100 permit tcp any

25
Q

What is this ACE telling us:

access-list 100 deny tcp host 10.10.10.10 10.10.20.0 0.0.0.255 eq www log

A

It’s an extended Access Control Entry with a number of 100
Deny TCP traffic from 10.10.10.10 that is going TO the destination network of 10.10.20.0/24 with a destination port of 80(www) and we want log it to the console or an external monitoring service

26
Q

What command would you use to verifiy ACLs?

A

show access-lists {acl-number}

27
Q

What will the command show access-lists {acl-number} tell you?

A

It will show you all of the Access Control Entries for that ACL and if it’s matching for any traffic

28
Q

If you’ve created your ACL with the Access Control Entries, what do you need to do to actually get them to work?

A

You need to enable it on the interface or VLAN with the access-group command

29
Q

How many ACLs can you have on one interface per direction?

A

1

30
Q

Why can you only have 1 ACL per direction on an interface?

A

Because if you have multiple ACLs going outbound or inbound then the router will not know one to actually apply

31
Q

What is a good way to think about which direction to apply the ACL?

A

Think about the way traffic flows.

32
Q

How would you configure an access group on an interface or VLAN?

A

int {int} or int {vlan}
ip access-group {number} {direction}

Example:
int fa0/1
ip access-group 100 in

or

int vlan 10
ip access-group 100 out

33
Q

What is a command to show which access groups are applied to an interface?

A

show ip int {int} | include access-list

34
Q

True or False: Precedence for ACLs goes from Bottom to Top

A

False. They go from top to bottom

35
Q

Why is it important for ACLs importance to go from Top to Bottom?

A

Because if a more targeted ACE was put AFTER a broader one, then the broader one would take precedence because it came first and the router would stop at the first match

36
Q

In this scenario:

access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 deny host 10.10.10.10

Would 10.10.10.10 be denied or permitted?

A

It would be permitted because the permit entry for 10.10.10.0/24 came first and the router would process that and then stop processing anything after it

37
Q

What increments are ACLs numbered in?

A

Increments of 10

38
Q

Why is the numbered increments on the entries important?

A

In case you need to inject another entry in the future

39
Q

How would you inject another entry into an already established ACL with numbers 10,20,30 and 40 but you need it to take second priority?

The scenario is you want to deny TCP traffic from host 10.10.10.11 to destination host 10.10.50.10 on the destination telnet port

A

ip access-list extended {number}
15 deny tcp host 10.10.10.11 host 10.10.50.10 eq telnet

40
Q

True or False: there is an implicit deny any any rule at the bottom of every ACL

A

True

41
Q

True or False: If an ACL is not applied to an interface, all traffic is denied

A

False, all traffic is allowed at that point

42
Q

True or False: All traffic is denied except what is explicitly allowed due to the implied deny any any rule at the bottom the of ALL ACLs

A

True

43
Q

What can we infer from this ACE in terms of permit rules?

access-list 1 permit 10.10.10.0 0.0.0.255

A

All traffic will be denied except traffic from 10.10.10.0 0.0.0.255

44
Q

What are these ACE’s doing?

access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 deny any log

A

Permitting any traffic from 10.10.10.0/24
Denying all other traffic and logging any illegal traffic

45
Q

If you want to reverse the implicit deny any any rule so that ALL traffic is permitted except what is explicitly denied, how would you achieve this?

A

Add a permit any rule at the bottom of your entries

46
Q

Which would have precedence? An explicit permit any rule at the bottom of an ACL or an implicit deny any any at the bottom of the ACL?

A

The permit any rule would take precedence because it would be above the deny any any rule implicitly at the bottom

CCNA 200-301 (25 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions