Security Protocols & Network Access Control Flashcards
7 cards from real ACMA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Security Protocols & Network Access Control flashcards as text
What ClearPass module performs endpoint health checks (antivirus status, OS patch level, disk encryption) before or after network admission?
Answer: ClearPass OnGuard
ClearPass OnGuard is the posture assessment agent that checks endpoint health attributes like antivirus definitions, patch level, and firewall status.
In Aruba's tunneled node architecture, client traffic from a wired port is tunneled to the Mobility Controller — what encapsulation protocol is used?
Answer: GRE (Generic Routing Encapsulation)
Aruba uses GRE tunnels to carry client traffic from APs and tunneled wired ports back to the Mobility Controller for centralized policy enforcement.
Which authentication server protocol provides command-level authorization and detailed accounting for administrator CLI access to Aruba network devices?
Answer: TACACS+
TACACS+ separates authentication, authorization, and accounting into independent functions and provides granular command-by-command authorization, making it preferred for device administration.
What happens to a wireless client's session in Aruba when ClearPass sends a RADIUS CoA Disconnect-Message (also called Packet of Disconnect)?
Answer: The client is immediately disconnected and must re-authenticate
A RADIUS Disconnect-Message (PoD) forcibly terminates the client's session on the NAS, requiring the client to re-authenticate from scratch.
In the context of Aruba firewall policies, what does the 'alias' feature allow administrators to do?
Answer: Define named groups of IP addresses, subnets, or services reusable across multiple ACL rules
Aruba firewall aliases are named objects (network aliases or service aliases) that can be referenced in multiple rules, simplifying policy management and reducing errors.
Which Aruba Instant security setting restricts management access to the Virtual Controller to only specific IP addresses or subnets?
Answer: Allowed access list (whitelist) for VC management
Aruba Instant allows configuration of an allowed IP access list that restricts which source IP addresses can reach the Virtual Controller management interface.
What is the role of the PMK (Pairwise Master Key) cache in Aruba's 802.11 fast roaming implementation (OKC)?
Answer: Caches the derived PMK at the controller so roaming clients skip the full EAP exchange
Opportunistic Key Caching (OKC) caches the PMK derived from the initial EAP authentication at the Aruba controller, allowing roaming clients to derive a new PTK without repeating the full RADIUS exchange.