SECURITY IN NETWORK DESIGN CHAPTER 10
COMPREHENSIVE STUDY GUIDE 2026
◉ Defense in Depth.
Answer: employing multiple layers of controls to avoid a single
point-of-failure
◉ ACL.
Answer: access control list, a list of statements used by a router or
other device to permit or deny the forwarding of traffic on a network
based on one or more criteria
- routers can also decline to forward certain packets depending on
their content
- An ACL acts like a filter to instruct the router to permit or deny
traffic according to one or more of the following variables:
- Network layer protocol (IP or ICMP)
- Transport Layer protocol (TCP or UDP)
- Source IP address
- Destination IP address (which can restrict or allow certain
websites)
- TCP or UDP port number
,◉ Implicit deny rule.
Answer: An ACL (access control list) rule that ensures that any
traffic the ACL does not explicitly permit is denied by default.
- if the packet does not match any criteria given in the statements in
the ACL, the packet is dropped
- On most routers, each interface must be assigned a separate ACL
and different ACLs may be associated with inbound and outbound
traffic
◉ What command is used to assign a statement to an ACL on Cisco
routers and similar routers?.
Answer: access-list
- the command must identify the ACL and include a permit or deny
argument
- statements can also specify network segments by using a network
address for the segment and a wildcard mask
Example: to permit ICMP traffic from any IP address or network to
any IP address or network:
access-list acl_2 permit icmp any any
, To deny ICMP traffic from any IP address or network to any IP
address or network:
access-list acl_2 deny icmp any any
◉ T/F: an access list is not automatically installed on a router.
Answer: true
if you don't configure an ACL, the router allows all traffic through
- the more statements or tests a router must scan, the more time it
takes a router to act and the slower the router's overall preformance
◉ CoPP.
Answer: Control Plane Policing, the control plane is the decision-
making layer of connected networking devices
- An adaptation of QoS (quality of service) filters used to rate-limit
traffic on the control plane and management plane of routers and
switches.
control plane functionality can become overwhelmed in times of
high traffic or during an attack
COMPREHENSIVE STUDY GUIDE 2026
◉ Defense in Depth.
Answer: employing multiple layers of controls to avoid a single
point-of-failure
◉ ACL.
Answer: access control list, a list of statements used by a router or
other device to permit or deny the forwarding of traffic on a network
based on one or more criteria
- routers can also decline to forward certain packets depending on
their content
- An ACL acts like a filter to instruct the router to permit or deny
traffic according to one or more of the following variables:
- Network layer protocol (IP or ICMP)
- Transport Layer protocol (TCP or UDP)
- Source IP address
- Destination IP address (which can restrict or allow certain
websites)
- TCP or UDP port number
,◉ Implicit deny rule.
Answer: An ACL (access control list) rule that ensures that any
traffic the ACL does not explicitly permit is denied by default.
- if the packet does not match any criteria given in the statements in
the ACL, the packet is dropped
- On most routers, each interface must be assigned a separate ACL
and different ACLs may be associated with inbound and outbound
traffic
◉ What command is used to assign a statement to an ACL on Cisco
routers and similar routers?.
Answer: access-list
- the command must identify the ACL and include a permit or deny
argument
- statements can also specify network segments by using a network
address for the segment and a wildcard mask
Example: to permit ICMP traffic from any IP address or network to
any IP address or network:
access-list acl_2 permit icmp any any
, To deny ICMP traffic from any IP address or network to any IP
address or network:
access-list acl_2 deny icmp any any
◉ T/F: an access list is not automatically installed on a router.
Answer: true
if you don't configure an ACL, the router allows all traffic through
- the more statements or tests a router must scan, the more time it
takes a router to act and the slower the router's overall preformance
◉ CoPP.
Answer: Control Plane Policing, the control plane is the decision-
making layer of connected networking devices
- An adaptation of QoS (quality of service) filters used to rate-limit
traffic on the control plane and management plane of routers and
switches.
control plane functionality can become overwhelmed in times of
high traffic or during an attack
