AP Networking Firewall and ACL Policy Practice Test

1. The last matching entry
2. The rule with the longest name
3. The first matching entry
4. The entry with the largest port

Correct answer: C. The first matching entry

In a stated first-match model, processing stops at the first match. Later rules do not reverse that result.

1. Assign every client a lease
2. Repair physical cable damage
3. Replace DNS resolution
4. Permit or deny traffic according to defined criteria

Correct answer: D. Permit or deny traffic according to defined criteria

An ACL enforces a traffic policy. A correct route and physical path can coexist with an intentional denial.

1. Permit only the access needed for the authorized task
2. Permit every service to avoid outages
3. Use the shortest password
4. Deny every packet permanently

Correct answer: A. Permit only the access needed for the authorized task

Scope access to required sources, destinations, and services. Broad reachability is not a requirement for every task.

1. Source IP address
2. DNS TTL
3. Destination port only
4. Cable category

Correct answer: A. Source IP address

The source address describes the packet's origin as seen at the enforcement point. Translation can change what a particular device sees.

1. Source cable length
2. DHCP lease duration
3. DNS serial number
4. Destination port

Correct answer: D. Destination port

A service listener commonly uses a known destination port. The client usually uses an ephemeral source port.

1. All traffic is allowed
2. Unmatched traffic is denied
3. DNS chooses the result
4. Every matched permit is denied too

Correct answer: B. Unmatched traffic is denied

The implicit action applies only when no earlier entry matches. Explicit permits still work for their matched scope.

1. Only on private IPs
2. No
3. Yes, port numbers override protocols
4. Yes, TCP and UDP are the same

Correct answer: B. No

Protocol is part of the match. TCP and UDP using the same numeric port are distinct traffic classes.

1. Packets entering that interface
2. Only packets leaving it
3. Only server disk writes
4. Only radio signal levels

Correct answer: A. Packets entering that interface

Direction is relative to the device interface, not the user's idea of downloading or uploading.

1. Packets leaving that interface
2. Only packets entering it
3. Only DHCP lease timers
4. Only cable errors

Correct answer: A. Packets leaving that interface

Outbound policy is evaluated on the chosen outgoing interface under the stated platform model.

1. Proof of full application success
2. Proof that all return traffic passed
3. Proof that DNS was correct
4. Evidence that traffic matched that rule

Correct answer: D. Evidence that traffic matched that rule

A matching counter locates policy evaluation. It does not prove every later dependency or packet direction succeeded.

1. Only cable continuity
2. Only DNS spelling
3. Connection/session state
4. Only VLAN names

Correct answer: C. Connection/session state

State tracking can allow appropriate return traffic for permitted sessions. Actual behavior depends on policy and protocol support.

1. Assign a hostname
2. Create a route automatically
3. Record observed denied traffic for investigation
4. Increase link speed

Correct answer: C. Record observed denied traffic for investigation

A deny log helps relate a flow to an enforcement decision. It needs source, destination, protocol, time, and policy context.

1. Yes, if the IP is private
2. Yes, routing overrides policy
3. Only when DNS TTL is long
4. No

Correct answer: D. No

Routing selects a path; filtering determines whether traffic is allowed to use it. Both must be checked.

1. It changes IPv4 length
2. It allows more sources or services than the task requires
3. It always disables Ethernet
4. It prevents DNS caching

Correct answer: B. It allows more sources or services than the task requires

A broad permit can expose unintended paths. Use a scoped rule and test required and prohibited behavior.

1. DNS
2. TCP 443
3. ICMP
4. UDP 67

Correct answer: C. ICMP

ICMP policy can differ from TCP/UDP service policy. Ping results cannot stand in for every application test.

1. To change every IP automatically
2. To eliminate route lookups
3. To evaluate whether its scope and continued need are justified
4. To make the cable faster

Correct answer: C. To evaluate whether its scope and continued need are justified

A clear purpose helps review source, destination, service, owner, and removal criteria rather than keeping unexplained exceptions.

1. An entry whose intended traffic is already decided earlier
2. A physically unplugged router
3. A rule using dark text
4. A DNS alias

Correct answer: A. An entry whose intended traffic is already decided earlier

In a first-match policy, an earlier covering entry can make a later rule ineffective for that traffic.

1. Only one successful Internet ping
2. Only looking at the cable
3. Only checking the SSID name
4. A denied guest-to-office test as well as permitted guest tasks

Correct answer: D. A denied guest-to-office test as well as permitted guest tasks

Security verification includes prohibited behavior. Permitted connectivity alone does not prove the boundary holds.

1. No
2. Yes, the label creates deny rules
3. Only if the name is uppercase
4. Yes, only VLAN 1 needs rules

Correct answer: A. No

Labels describe intended use; actual VLAN placement, routes, and policy determine enforcement.

1. DHCPv4 allocation
2. SSH access
3. Conventional DNS lookup
4. NTP synchronization

Correct answer: B. SSH access

TCP 22 commonly serves SSH. The rule still needs the appropriate client/server scope and authentication controls.

1. Only the source port
2. That exact host address, such as a /32
3. Every broadcast domain
4. Every private address automatically

Correct answer: B. That exact host address, such as a /32

A host-specific match narrows the source identity. A wider prefix denies additional devices unless that is intentional.

1. A narrow scope and planned removal/review
2. Disabled logging everywhere
3. An indefinite any-to-any permit
4. A new untracked subnet

Correct answer: A. A narrow scope and planned removal/review

A temporary change should answer a diagnostic need without becoming an unexplained permanent exposure.

1. Silent dropping versus an explicit failure response where supported
2. Fast versus slow routing
3. Fiber versus copper
4. IPv4 versus DNS

Correct answer: A. Silent dropping versus an explicit failure response where supported

Products use different action terminology, so confirm platform behavior. The key distinction is whether a response is generated.

1. One unrestricted firewall rule
2. A longer DNS TTL
3. Multiple appropriate controls across different dependencies
4. Several identical SSID names

Correct answer: C. Multiple appropriate controls across different dependencies

Layered controls can constrain access, identity, endpoints, and observation. No single label establishes the whole security posture.

1. Remove all existing permits blindly
2. Disable authentication
3. Change the WAN mask randomly
4. Confirm intended scope and a recovery/access plan

Correct answer: D. Confirm intended scope and a recovery/access plan

A mistaken management rule can lock out authorized administration. Plan the exact rule and a way to recover within the authorized workflow.

1. Permitted by rule 20
2. Selected by DNS
3. Denied by rule 10
4. Allowed because HTTPS is encrypted

Correct answer: C. Denied by rule 10

The broad earlier deny matches first and shadows the later exception. An approved exception must be placed and scoped deliberately.

1. Rule 10 permits it
2. All protocols are permitted
3. Rule 20 reverses it
4. Implicit deny wins

Correct answer: A. Rule 10 permits it

The exact source, destination, and TCP port match the earlier permit. That does not authorize unrelated services.

1. The later deny matches
2. SSH bypasses ACLs
3. The admin permit applies to every source
4. DNS selects the admin rule

Correct answer: A. The later deny matches

A source mismatch means rule 10 does not match. The broader deny then handles the guest flow.

1. Replace the cable
2. A scoped TCP 53 permit if required by the design
3. Permit all TCP everywhere
4. Disable DNS caching

Correct answer: B. A scoped TCP 53 permit if required by the design

Conventional DNS uses both transports. Fix the required resolver path rather than broadly removing filtering.

1. UDP destination 443
2. TCP source 443 only
3. UDP source 51000
4. TCP destination 443

Correct answer: D. TCP destination 443

The initiating client source is ephemeral. Match the intended server-side service and correct transport.

1. Only local frames need return permission
2. DNS reverses the rule
3. All replies are automatically state-tracked
4. Replies may be denied separately

Correct answer: D. Replies may be denied separately

A stateless packet filter evaluates directions independently. Do not assume the behavior of a stateful session policy.

1. The matched rule's order and scope
2. Only the remote cable category
3. Only DHCP lease length
4. Only DNS A record count

Correct answer: A. The matched rule's order and scope

The counters relate failure to a policy decision. Confirm exact traffic and whether the denial is intended before changing it.

1. Both rules combine into a deny
2. The narrower /24 wins automatically like a route
3. The last rule always wins
4. The earlier permit wins in this first-match policy

Correct answer: D. The earlier permit wins in this first-match policy

ACL order differs from longest-prefix route selection. The first covering match decides under the stated model.

1. ACLs apply globally regardless of attachment
2. DNS must refresh the ACL
3. The tested flow does not traverse the edited enforcement point
4. The endpoint needs a longer hostname

Correct answer: C. The tested flow does not traverse the edited enforcement point

Rule content matters only where the policy is actually applied. Trace the packet's interface and direction.

1. All routing is down
2. DNS removes all restrictions
3. Scoped access may be working as designed
4. The guest is in the office VLAN necessarily

Correct answer: C. Scoped access may be working as designed

Selective permitted and denied results can validate policy. Confirm both against intended scope.

1. Only client cable length
2. Only the server TTL
3. Only DHCP port numbers
4. Whether the approved source scope needs updating

Correct answer: D. Whether the approved source scope needs updating

An address-plan change can leave source rules mismatched. Update intentionally and test for overbroad coverage.

1. No; a listening service is a separate dependency
2. Only DNS can start the service
3. Yes; encryption creates a socket
4. Yes; permits create listeners

Correct answer: A. No; a listening service is a separate dependency

Policy permits a path; the endpoint must still accept and process the connection. Use listener and traffic evidence together.

1. Only DNS MX records
2. Only the router's rack position
3. The exception's order and exact match
4. Only AP channel width

Correct answer: C. The exception's order and exact match

In a first-match policy, the earlier deny can prevent the later permit from being reached.

1. The same any-to-any rule forever
2. Disabling the firewall
3. Only a vague rule name
4. Approved test source, specific destination, required service, limited duration

Correct answer: D. Approved test source, specific destination, required service, limited duration

A narrow diagnostic exception limits exposure and produces more useful causal evidence.

1. The corresponding IPv6 path and enforcement
2. Only IPv4 lease duration
3. Only TCP source-port range
4. Only the SSID text

Correct answer: A. The corresponding IPv6 path and enforcement

An IPv4 rule does not inherently filter IPv6. Assess both active address families.

1. The log's observation point relative to NAT
2. The private subnet cannot exist
3. The client must be spoofing
4. The server has no route

Correct answer: A. The log's observation point relative to NAT

Translation changes the addresses seen at different points. Interpret the rule and log in the correct processing context.

1. DNS chooses interface direction
2. All inbound means downloaded traffic
3. Direction or attachment does not cover the request as intended
4. TCP has no direction

Correct answer: C. Direction or attachment does not cover the request as intended

Client requests may be outbound on that interface. Determine entry/exit relative to the firewall/router itself.

1. Delete every route
2. Declare the server dead
3. Confirm the tested flow traverses that rule's attachment and matches its criteria
4. Assume logging proves the rule worked

Correct answer: C. Confirm the tested flow traverses that rule's attachment and matches its criteria

Zero hits may mean no matching traffic arrived there. Trace placement, source, destination, protocol, and rule ordering.

1. DNS must fail
2. The physical link must be down
3. Ping can work while SSH fails
4. Ping proves SSH must work

Correct answer: C. Ping can work while SSH fails

Different protocols can have different actions. Test the required application port directly.

1. A new IPv4 standard
2. Application authentication/authorization
3. A larger broadcast address
4. A cable category change

Correct answer: B. Application authentication/authorization

Network authorization and application identity are separate controls. Permitting packets is not granting every application privilege.

1. No; all private traffic is denied universally
2. Yes; neighboring IPs always share permits
3. Yes; /32 means 32 hosts
4. No; the permit is host-specific

Correct answer: D. No; the permit is host-specific

A host match is exact. Determine whether the second device is authorized before widening the source scope.

1. A new DNS alias only
2. A larger subnet only
3. The specific necessary permit
4. The broad allow back without review

Correct answer: C. The specific necessary permit

Removing unnecessary exposure should preserve explicitly justified access. Use observed required flows to define the narrow permit.

1. Every packet is filtered automatically
2. Configured text alone does not enforce the intended path
3. The route table attaches every ACL
4. DNS activates it

Correct answer: B. Configured text alone does not enforce the intended path

An unused rule set may have no effect. Verify operational attachment as well as contents.

1. Only PoE load
2. Only MAC vendor names
3. Current resolution/service destination and authorized policy scope
4. Only packet TTL

Correct answer: C. Current resolution/service destination and authorized policy scope

A name can resolve correctly to a new host that the old rule excludes. Review the migration's intended access changes.

1. The default route exists
2. Only the test succeeded once
3. Unintended sources/services remain denied and the exception lifecycle is controlled
4. The rule name is long

Correct answer: C. Unintended sources/services remain denied and the exception lifecycle is controlled

A security change needs positive and negative verification. Diagnostic success alone does not prove acceptable exposure.

1. Place permit any any at the top
2. Keep the exception below deny and increase its prefix length
3. Place the narrow host TCP 443 permit before the broad deny
4. Change the route metric

Correct answer: C. Place the narrow host TCP 443 permit before the broad deny

The broad deny already decides this flow. Reordering a precisely scoped authorized exception preserves the wider restriction.

1. Only the AP frequency
2. Only DHCP lease length
3. Only port 443 encryption
4. The destination object overlap and first-match order

Correct answer: D. The destination object overlap and first-match order

A broad earlier destination definition can permit internal HTTPS unintentionally. Verify the actual object contents and intended exclusions.

1. DNS changes the transport
2. TCP swaps IP addresses but not ports
3. The server reply source is 443 and destination is 52000
4. The server reply has destination 443

Correct answer: C. The server reply source is 443 and destination is 52000

Reverse traffic swaps source/destination roles. Match the observed reply tuple and the correct direction.

1. Return routing and session-state expectations at both enforcement paths
2. Only the initiating permit name
3. Only the client's lease age
4. Only the switch power supply

Correct answer: A. Return routing and session-state expectations at both enforcement paths

A stateful path may fail when the reverse flow bypasses it or hits a device without state. Inspect routing and policy together.

1. The client must change MAC
2. The allow needs a longer hostname
3. The lower metric deny wins
4. The earlier first-match deny shadows the allow

Correct answer: D. The earlier first-match deny shadows the allow

The flow is observed at the policy and matches the earlier deny. This is direct order evidence rather than a route or DNS problem.

1. That the forwarded client's source/path is permitted
2. That the remote service accepted some test traffic
3. That TCP can work for one source
4. That the router can originate traffic

Correct answer: A. That the forwarded client's source/path is permitted

Local and transit traffic can use different sources and policy paths. Validate the actual client flow.

1. DNS corrects object scope
2. A wider source can only deny more
3. It may grant the same access to many additional source subnets
4. A /16 identifies one host

Correct answer: C. It may grant the same access to many additional source subnets

An allow matching a wider prefix admits more sources. Compare object expansion with the stated authorization.

1. Only fiber connector shape
2. Only DNS cache size
3. The platform's actual address/policy processing stage
4. Only the TCP sequence number

Correct answer: C. The platform's actual address/policy processing stage

Different devices evaluate rules at different translation stages. Align policy criteria with the addresses actually seen there.

1. The later guest rule always overrides
2. Guest SSH may match the broad permit first
3. SSH cannot cross VLANs
4. Encryption automatically makes guest SSH authorized

Correct answer: B. Guest SSH may match the broad permit first

Secure transport does not authorize all sources. First-match scope must preserve the guest restriction.

1. TCP 22 is harmless because encrypted
2. The desired app success proves safety
3. Only DNS needs changing
4. The change fails the negative-access requirement despite positive success

Correct answer: D. The change fails the negative-access requirement despite positive success

Security verification checks both required service and prohibited paths. Narrow or reorder the rule according to intended access.

1. Only the server subnet mask
2. Only DHCP option 3
3. Every numeric 443 rule covers both transports
4. Whether both authorized transport variants are needed and scoped

Correct answer: D. Whether both authorized transport variants are needed and scoped

Transport matches are distinct. Define the required application behavior and validate its allowed variants without permitting everything.

1. The SSID has no encryption
2. The hostname must be invalid
3. The IPv4 deny was necessarily ineffective
4. The active IPv6 path lacks equivalent intended enforcement

Correct answer: D. The active IPv6 path lacks equivalent intended enforcement

A successful IPv6 exchange demonstrates a separate policy path. Review family-specific rules and routes.

1. Immediately authorize the unfamiliar source broadly
2. Correlate source identity, translation, proxying, and capture location
3. Replace every endpoint cable
4. Assume all logs name original clients

Correct answer: B. Correlate source identity, translation, proxying, and capture location

Logs must be mapped to the real flow at that stage. An address may belong to a proxy or NAT boundary rather than the user device.

1. The observation window was short
2. Usage can be periodic
3. Ownership should be checked
4. The rule has no legitimate purpose and can be deleted from that short sample

Correct answer: D. The rule has no legitimate purpose and can be deleted from that short sample

A short counter sample does not capture every authorized workload. Review purpose and representative activity before removal.

1. Use a test matching the required service rather than equating ping failure with outage
2. Increase DNS TTL
3. Remove all security
4. Declare HTTPS impossible

Correct answer: A. Use a test matching the required service rather than equating ping failure with outage

Protocol-specific filtering makes ICMP a poor universal application-health proxy. Monitor the actual permitted service path.

1. Whether that path ever sees guest-to-office packets
2. Only the rule's description
3. Only the WAN speed
4. Only the TLS version

Correct answer: A. Whether that path ever sees guest-to-office packets

Attachment controls which traffic is evaluated. Local routed office traffic may never leave the WAN interface.

1. Only server disk speed
2. Only radio RSSI
3. Only the default route length
4. Authorized identity/address allocation and the rule's source criteria

Correct answer: D. Authorized identity/address allocation and the rule's source criteria

IP-based policy can depend on stable assignment. Coordinate reservation/address design or an appropriate supported identity-based policy.

1. All guest VLANs to all servers
2. Approved vendor source to that server TCP 8443 for the diagnostic window
3. All traffic permanently
4. All UDP because the service is TCP

Correct answer: B. Approved vendor source to that server TCP 8443 for the diagnostic window

The stated task supplies source, destination, service, and duration boundaries. A broader permit is not justified by that one requirement.

1. Application authentication
2. Physical cable continuity
3. DNS transport
4. Initial TCP routing

Correct answer: A. Application authentication

An application response means earlier stages reached the service. Network permits cannot supply missing application credentials.

1. The first matching rule for each required and prohibited flow
2. Only route prefix lengths
3. Only total rule count
4. Only rule-name spelling

Correct answer: A. The first matching rule for each required and prohibited flow

Equivalent lists are not equivalent ordered policies. Trace representative tuples through the actual order.

1. Allowed because both start with 10.8
2. Allowed if DNS resolves
3. Allowed because /24 means the whole /16
4. Denied, unless a different applicable permit exists

Correct answer: D. Denied, unless a different applicable permit exists

The /24 fixes the third octet at 4. Source .5 does not match; the default policy then applies.

1. Only the new rule name
2. Only the old deny
3. Current effective rules, attachment, and time-correlated test logs
4. Only the server model

Correct answer: C. Current effective rules, attachment, and time-correlated test logs

Historical logs cannot establish the current action. Correlate the actual test with current operational policy.

1. Replace DNS immediately
2. Assume direct A-to-B policy validates C-to-B
3. The actual proxy flow and authorized source/destination policy at each stage
4. Increase the subnet size

Correct answer: C. The actual proxy flow and authorized source/destination policy at each stage

A proxy introduces different connection endpoints. Verify the flows the enforcement device actually evaluates.

1. Unapproved private sources gained the same access
2. All private networks are one VLAN
3. Private addresses prove trust
4. HTTPS eliminates source restrictions

Correct answer: A. Unapproved private sources gained the same access

Private addressing is not an authorization label. Scope the permit to the approved identity/path.

1. The firewall alone was proven responsible
2. The route was proven wrong
3. The listener was proven healthy before
4. The combined changes restored service without isolating one cause

Correct answer: D. The combined changes restored service without isolating one cause

Simultaneous changes affect separate dependencies. Record each final setting and verify intended allowed and denied behavior.