Chapter 10: Access Lists
TRUE/FALSE
1. Smart network engineers pay close attention to network traffic flow and security when they design and
manage their networks.
2. With careful planning, you can create access lists that control which traffic crosses particular links, and
which segments of your network will have access to others.
3. Access lists can take the place of more advanced security measures, such as firewalls.
4. Access lists begin working the second they are applied to an interface.
5. You can remove individual lines in an access list.
MULTIPLE CHOICE
1. When making changes, you must remove the access list, using the ____ command.
a.
no access–list [list number]
b.
access–list off [list number]
c.
off access–list [list number]
d.
access–list [list number] no
2. With the ____ command, an administrator can schedule the router to reload in a certain number of
minutes, hours, or even days.
a.
interval
c.
restart
b.
refresh
d.
reload
3. If you create and apply the lists and they have the intended results, you can cancel the scheduled reload
with the ____ command.
a.
reload 0
c.
reload cancel
b.
reload abort
d.
reload off
4. Traffic coming in to “the man in the router,” through any of the interfaces, needs to be filtered using
____ traffic filters.
a.
outgoing
c.
exterior
b.
incoming
d.
outbound
5. To apply the inbound access list 1 to an interface, you use the following command: ____.
a.
ip access–group 1 out
c.
ip access–group 1 ext
b.
ip access–group 1 int
d.
ip access–group 1 in
6. The following command sets an outbound access list filter: ____.
a.
ip access–group 1 ext
c.
ip access–group 1 int
b.
ip access–group 1 out
d.
ip access–group 1 in
7. You must use the ____ command to save the list after configuration if you want it to survive a router
reload.
a.
copy reload
c.
copy run start
b.
copy start on
d.
copy run reload
8. Routers use ____ to determine which bits in an address will be significant.
a.
wildcard masks
c.
list numbers
b.
access masks
d.
address rules
9. It is possible to replace the 0.0.0.0 255.255.255.255 entry, which represents all hosts and all networks,
with the ____ keyword.
a.
all
c.
each
b.
any
d.
none
10. To view the access lists defined on your router, use the ____ command.
a.
show access–lists
c.
display access–lists
b.
show lists
d.
access–lists show
11. To view which interfaces have IP access lists set, use the ____ command.
a.
show ip in
c.
show ip interface
b.
show ip out
d.
show ip any
12. Use the ____ command to remove the application of the list.
a.
no accessgroup [ip][list #][direction]
b.
no ip [accessgroup][list #][direction]
c.
no ip access–list [list #][direction]
d.
no ip access–group [list #][direction]
13. Regarding extended IP access lists, the ____ keyword is short for a wildcard mask of 0.0.0.0.
a.
host
c.
none
b.
any
d.
all
14. To remove an extended IP access list from an interface, you enter interface configuration mode and
use the ____ command.
a.
no ip ext access–group [list #] [in|out]
b.
extended no ip access–group [list #] [in|out]
c.
no ext access–group [list #] [in|out]
d.
no ip access–group [list #] [in|out]
15. To name a standard IP access list, use the following syntax: ____.
a.
ip access–list named [name]
b.
named access–list standard [name]
c.
ip access–list standard [name]
d.
ip named–access–list [name]
16. To name an extended IP access list, use the following syntax: ____.
a.
extended ip named–access–list [name]
b.
ip access–list extended [name]
c.
named–access–list extended [name]
d.
ip access–list named [name]
17. To apply a standard IP named list to an interface, use the following syntax: ____.
a.
ip standard access–group [name] [in | out]
b.
ip standard–group [name] [in | out]
c.
ip apply access–group [name] [in | out]
d.
ip access–group [name] [in | out]
18. ____ provides a GUI-based configuration tool for Cisco devices.
a.
CLI
c.
CCL
b.
SDM
d.
ACL
19. SDM allows you to easily create a standard or an extended access list or, as it is known in the SDM,
a(n) ____.
a.
VTY
c.
ACL
b.
TTY
d.
CLI
20. Unlike the CLI, the SDM does allow a router to be configured as a firewall. To begin this task, click
the ____ icon in the Tasks panel.
a.
Firewall and ACL
c.
Routing
b.
Security Audit
d.
NAT
21. The configuration of a(n) ____ is the main difference between the Basic and Advance firewall wizards.
a.
NAT server
c.
intranet
b.
DMZ
d.
proxy server
COMPLETION
1. ____________________ are permit or deny statements that filter traffic based on the source address,
destination address, protocol type, and port number of a packet.
2. The access list ends with an implicit ____________________ statement, which blocks all packets that
do not meet the requirements of the access list.
3. Traffic coming in to the “man in the router,” through any of the interfaces, is considered
____________________.
4. Access lists to block a router’s outward delivery must be applied as ____________________ filters.
5. ____________________ IP access lists filter network traffic based on the source IP address only.
MATCHING
Match each item with a statement below:
a.
Access lists
f.
Standard IP access lists
b.
Lack of planning
g.
Extended IP access lists
c.
no access–list [list #]
h.
Named access lists
d.
Wildcard mask
i.
Single host wildcard mask
e.
Partial masking
1. permit or deny packets based only on the source address
2. the mixing of 0s and 1s in a wildcard mask octet
3. built into the Cisco IOS; solve many problems associated with traffic flow and security
4. use names instead of numbers to identify themselves
5. one of the most common problems associated with access lists
6. filter by source IP address, destination IP address, protocol type, and application port number
7. removes an access list
8. the default for standard IP access lists
9. determines which bits of the source address are significant
SHORT ANSWER
1. Why should you use a text editor to create access lists?
2. What are the rules all access lists follow?
3. Describe each element of the standard IP access list configuration syntax.
ANS:
4. Briefly describe wildcard masks.
5. How can you monitor standard IP access lists?
6. Describe each element of the extended IP access list configuration syntax.
7. Where should you place standard and extended IP access lists?
8. How can you monitor extended IP access lists?
9. What are some of the advantages of using named access lists?
10. What kind of tasks can you perform on the SDM’s Interfaces and Connection screen?