Chapter 10. Access Control Policy

Question 1

1.Which of the following pages provide the option to select an action for unmatched traffic?

A. Policy editor

B. Rule editor

C. Inspection tab of the Add Rule window

D. Advanced tab of the policy editor page

Answer 1

A. On the access control’s policy editor page, you can select a default action for unmatched traffic.

Question 2

2.Which of the following choices could improve system performance?

A. Place the precisely defined rules before a broader rule.

B. Do not use access control rules to filter traffic based on 5-tuple.

C. Place the block rules at the top of the access control ruleset.

D. All of these answers are correct.

Answer 2

D. All these answers are correct. These choices could improve system performance. You should place the precisely defined rules before a broader rule. To filter traffic solely based on 5-tuple, you should consider using prefilter rules instead of access control rules. Finally, the rules with a block action should be placed at the top of the access control ruleset for faster processing.

Question 3

3.Which option or command allows you to identify the shadowed rule?

A. Firewall Engine Debug

B. Analyze Hit Counts

C. Show Rule Conflict

D. show access-list

Answer 3

C. The Show Rule Conflict option in the access control policy editor allows you to identify duplicate and overlapping rules (also known as shadowed rules).

Question 4

4.Which of the following options is false?

A. A default action can act on unmatched traffic only.

B. An interactive block with a reset action sends a response message before sending a reset packet to the requestor.

C. Do not enable logging simultaneously for both phases—beginning and end of connections—to avoid any performance issues.

D. Secure Firewall allows you to select a default action for every rule with a monitor action.

Answer 4

D. You select a default action for the entire access control policy, not for every access control rule.

Question 5

5.Which of the following commands can you use to debug the operations of a threat defense security engine?

A. system support app-id-debug

B. system support firewall-debug

C. system support firewall-engine-debug

D. system support application-identification-debug

Answer 5

C. Thesystem support firewall-engine-debugcommand enables you to debug the operation of the access control policy on a threat defense.