ACL Cheat Sheet 2026

The 30 highest-yield ACL facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. An ACL is configured with the following rules in order: (1) permit 10.0.0.0/8, (2) deny 10.1.0.0/16. A packet from 10.1.1.5 arrives. What happens? → The packet is permitted by rule 1
2. In cloud ACL auditing, which approach is most effective for continuously detecting policy drift from a secure baseline? → Infrastructure-as-Code (IaC) policy scanning combined with runtime CSPM drift detection
3. In an ACL ruleset, traffic is permitted only over port 443. Which encryption protocol operates on this port by default? → HTTPS (TLS)
4. A named ACL called BLOCK_MALWARE is missing entries after an incident. Which command verifies the current contents on a Cisco device? → show ip access-lists BLOCK_MALWARE
5. What does running `getfacl -R /data` accomplish on a Linux system? → Recursively displays the ACL entries for all files and directories under /data
6. Which ACL implementation approach is required by NIST SP 800-41 (Guidelines on Firewalls and Firewall Policy) when defining rules for internet-facing systems? → Default-deny with explicit permit rules for authorized services only
7. Which of the following is a key characteristic of discretionary access control (DAC)? → Resource owners can grant or restrict access to their own resources
8. Which method is recommended for testing ACL changes in a production environment to minimize risk? → Test in a staging environment first, then deploy during a maintenance window
9. An ACL permits only encrypted DNS traffic. Which protocol encrypts DNS queries to prevent eavesdropping and manipulation? → DNS over HTTPS (DoH)
10. Which Diffie-Hellman variant provides stronger security per bit and is preferred in modern TLS implementations over classic DHE? → ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)
11. During recovery from an ACL misconfiguration that caused a network outage, which rollback strategy carries the lowest risk? → Restoring a known-good ACL from a version-controlled configuration backup
12. During threat hunting using ACL logs, an analyst discovers internal hosts connecting to multiple external IPs on port 6667. What threat does this suggest? → IRC-based botnet command-and-control communication
13. In the context of TLS, what is the role of the 'certificate chain' or 'chain of trust'? → Linking the server certificate back to a trusted root CA through intermediate CAs
14. In Azure, which resource acts as the cloud equivalent of a network ACL applied at the subnet level? → Network Security Group (NSG)
15. In Access Control Lists, what is the purpose of team-building activities? → To strengthen collaboration, trust, and communication
16. What is a fundamental principle of Incident Response & Recovery in Access Control Lists practice? → Following established standards and best practices
17. In AWS, which service acts as the central ACL enforcement point for cross-account resource access? → AWS IAM with resource-based policies
18. What is the recommended approach when decommissioning an ACL rule that was added for a temporary business need? → Remove the rule and document the change in the change management system
19. Which cloud ACL model evaluates permissions at the resource level rather than at the identity level? → Resource-Based Policy
20. An ACL entry that grants access to a specific IP range while denying all others follows which security principle? → Explicit allow with implicit deny
21. In a multi-cloud ACL strategy, which approach best ensures consistent access control enforcement across AWS, Azure, and GCP? → Implement a Cloud Security Posture Management (CSPM) tool with unified policy engine
22. What is the importance of staying current with trends in Incident Response & Recovery for Access Control Lists? → It ensures practices remain effective and relevant
23. A wildcard mask of 0.0.255.255 in a Cisco ACL matches which address range when paired with the network address 10.10.0.0? → All addresses from 10.10.0.0 through 10.10.255.255
24. In ACL threat analysis, what does a 'deny any any' log entry at the end of an ACL reveal about network activity? → Traffic that matched no earlier permit rule hit the implicit deny
25. What is the effect of the implicit 'deny all' at the end of every ACL? → It drops any traffic not explicitly permitted by earlier ACE statements
26. After an incident where ACL logging consumed all available disk space, which configuration change prevents recurrence while maintaining visibility? → Configure log rate-limiting and send logs to a remote syslog server with adequate storage
27. What is the primary purpose of an Identity Provider (IdP) in a federated identity system? → To authenticate users and assert their identity to service providers
28. During ACL review, a tester finds the rule 'permit ip any any' at the end of an extended ACL. What is the security implication? → The rule overrides all previous deny statements, allowing all traffic through
29. After an incident where ACL rules were exhausted by a DoS attack flooding the ACE table, which preventive measure is most appropriate? → Implement upstream rate-limiting and summarize ACL rules to reduce ACE count
30. What is 'privilege creep' in identity and access management? → The gradual accumulation of access rights beyond what a user currently needs