ACMA Authentication Methods 3 — Questions and Answers
Question 1: What is the purpose of RADIUS accounting in an Aruba wireless deployment?
- To encrypt the RADIUS shared secret between AP and server
- To track session start, stop, and interim usage data for connected clients (Correct answer)
- To validate client certificates during 802.1X authentication
- To assign IP addresses to wireless clients via DHCP
Correct answer: To track session start, stop, and interim usage data for connected clients
RADIUS accounting records session events (Start, Stop, Interim-Update) including duration, bytes transferred, and termination cause for auditing and billing.
Question 2: Which protocol does Aruba use to carry EAP messages between the wireless AP and the RADIUS authentication server?
- TACACS+
- DIAMETER
- RADIUS (UDP) (Correct answer)
- LDAP over TLS
Correct answer: RADIUS (UDP)
EAP messages are encapsulated in RADIUS packets (UDP port 1812 for authentication) between the AP (authenticator) and the RADIUS server.
Question 3: In Aruba's captive portal authentication, at what point is the client's traffic allowed onto the network?
- Immediately after associating with the SSID
- After the client completes credentials entry on the portal page (Correct answer)
- Only after 802.1X supplicant negotiation completes
- After the AP issues a RADIUS CoA message
Correct answer: After the client completes credentials entry on the portal page
In captive portal authentication, the client associates and receives limited connectivity, then is fully admitted only after submitting valid credentials via the web portal.
Question 4: What is the function of the RADIUS attribute 'Class' (attribute 25) in Aruba deployments?
- Defines the QoS marking for the client session
- Carries opaque data from the authentication server that is echoed back in accounting messages (Correct answer)
- Specifies the firewall policy name to apply to the client
- Sets the maximum session timeout for the client
Correct answer: Carries opaque data from the authentication server that is echoed back in accounting messages
The Class attribute is an opaque value set by the RADIUS server that the NAS must include in all subsequent accounting messages for that session.
Question 5: Which EAP type creates an encrypted TLS tunnel first and then authenticates the user with a legacy method such as PAP inside the tunnel?
- EAP-TLS
- EAP-FAST
- EAP-TTLS (Correct answer)
- EAP-MD5
Correct answer: EAP-TTLS
EAP-TTLS (Tunneled TLS) establishes an outer TLS tunnel using a server certificate, then runs an inner authentication method (e.g., PAP, CHAP, MSCHAPv2) inside the tunnel.
Question 6: When a RADIUS server returns an Access-Reject, what does an Aruba AP typically do with the wireless client by default?
- Moves the client to a guest VLAN
- Sends an 802.11 Deauthentication frame to the client (Correct answer)
- Retransmits the authentication request to a backup RADIUS server
- Places the client in a captive portal redirection state
Correct answer: Sends an 802.11 Deauthentication frame to the client
Upon receiving an Access-Reject from the RADIUS server, the AP denies access and sends a deauthentication frame, disconnecting the client from the SSID.
Question 7: In Aruba's role-based access control, what is a 'user role' primarily used for?
- Defining the RADIUS shared secret per user group
- Applying firewall policies and bandwidth limits to authenticated clients (Correct answer)
- Selecting which EAP method is used for a given SSID
- Mapping clients to specific access points
Correct answer: Applying firewall policies and bandwidth limits to authenticated clients
A user role in Aruba defines the set of firewall policies, ACLs, and bandwidth contracts applied to a client after authentication.
ACMA Authentication Methods 3
What is the purpose of RADIUS accounting in an Aruba wireless deployment?