Ch25 Basic IPv4 Access Control Lists

Question 1

The mask used in Cisco IOS ACL commands (and OSPF and EIGRP network commands). Also referred to as an inverse mask. Used to match (or ignore) parts of an an address when making comparisons

Answer 1

wildcard mask

Question 2

A list of IOS global configuration commands that can match only the source address of a packet, for the purpose of deciding which packets to discard and which packets to allow through a router

Answer 2

standard access list

Question 3

Command reference:

Global command for standard numbered access lists. Uses numbers between 1-99 and 1300-1999, inclusive

Answer 3

access-list <i>list-number</i> [deny | permit] <i>source-addr</i> [<i>source-wildcard</i>] [log]

Question 4

Command reference:

defines a descriptive remark indicating what the access list is supposed to do

Answer 4

access-list <i>list-number</i> remark <i>text</i>

Question 5

Command reference:

Interface subcommand to enable access lists and bind them to the interface.

Answer 5

ip access-group <i>[number | name</i> [in | out]

Question 6

Command reference:

This show command reveals the presence or absence of access lists in and/or out of an interface

Answer 6

show ip interface <i>int</i>

Question 7

Command reference

Lists details of configured access lists for all protocols

Answer 7

show access-lists

Question 8

Command reference:

Shows IP access lists

Answer 8

show ip access-lists

Question 9

When preparing to create an access list, what must be considered prior to applying it to an interface?

Answer 9

ACLs must be enabled on an interface that will process the packet, in the direction of traffic flow.

Question 10

What packet header(s) are standard access lists capable of inspecting and matching?

Answer 10

Source address

Question 11

What packet header(s) are extended access list capable of inspecting and matching?

Answer 11

Source address, destination address, protocol, source port, destination port, etc (any L3 or L4 header)

Question 12

Standard access lists filter at which layer(s)?

Answer 12

Layer 3 only

Question 13

Extended access lists filter at which layer(s)?

Answer 13

L3 and L4

Question 14

When configuring standard numbered access lists, what ranges are available to identify the ACL?

Answer 14

1-99, 1300-1999

Question 15

When configuring extended numbered access lists, what ranges are available to identify the ACL?

Answer 15

100-199, 2000-2699

Question 16

On which interface should a standard ACL be placed?

Answer 16

Standard ACLs should be placed closest to their destination.

Question 17

What search logic is implemented by ACLs?

Answer 17

First-match logic The router will take the listed action on the first ACE that matches the packet.