ACMA Authentication Methods 4 — Questions and Answers
Question 1: What is Aruba's Downloadable User Roles (DUR) feature designed to accomplish?
- Push role configurations from ClearPass to APs at authentication time, eliminating pre-configuration on the AP (Correct answer)
- Download RADIUS certificates automatically to APs during provisioning
- Sync user role definitions across multiple Aruba Mobility Controllers
- Allow clients to select their own network role via a web portal
Correct answer: Push role configurations from ClearPass to APs at authentication time, eliminating pre-configuration on the AP
Downloadable User Roles allow ClearPass to dynamically push complete role definitions (ACLs, policies) to Aruba APs via RADIUS VSAs, so roles don't need to be pre-configured on each AP.
Question 2: Which Aruba VSA (Vendor-Specific Attribute) is commonly used to assign a user role upon successful RADIUS authentication?
- Aruba-User-Role (Aruba VSA 1) (Correct answer)
- Tunnel-Private-Group-ID (RFC 2868)
- Class (RFC 2865 Attribute 25)
- Aruba-AP-Group (Aruba VSA 10)
Correct answer: Aruba-User-Role (Aruba VSA 1)
Aruba-User-Role (VSA attribute 1, vendor ID 14823) is returned in the RADIUS Access-Accept to specify the role the client should be placed in.
Question 3: What distinguishes WPA3-Enterprise from WPA2-Enterprise in terms of authentication security?
- WPA3-Enterprise uses PSK instead of 802.1X
- WPA3-Enterprise mandates 192-bit cryptographic suite and requires PMF (Correct answer)
- WPA3-Enterprise replaces EAP with SAE for credential exchange
- WPA3-Enterprise removes the requirement for a RADIUS server
Correct answer: WPA3-Enterprise mandates 192-bit cryptographic suite and requires PMF
WPA3-Enterprise (192-bit mode) mandates the use of GCMP-256/CCMP-256 encryption and requires Protected Management Frames (PMF/802.11w) to be mandatory.
Question 4: In ClearPass, what is the 'Authentication Method' configuration item used for?
- Specifying which SSID profile triggers the policy
- Defining which EAP types and inner methods the policy will accept (Correct answer)
- Setting the RADIUS shared secret for each NAS device
- Configuring the IP address of the backend LDAP server
Correct answer: Defining which EAP types and inner methods the policy will accept
An Authentication Method in ClearPass defines acceptable EAP types (e.g., PEAP, EAP-TLS, TTLS) and their inner methods, controlling how credentials are exchanged.
Question 5: What happens during RADIUS Change of Authorization (CoA) in an Aruba deployment?
- The RADIUS server proactively sends a new policy to the AP to modify or terminate an active session (Correct answer)
- The AP re-authenticates the client using a new EAP exchange
- The client requests a new IP address after a role change
- ClearPass rotates the RADIUS shared secret automatically
Correct answer: The RADIUS server proactively sends a new policy to the AP to modify or terminate an active session
RADIUS CoA (RFC 5176) allows the RADIUS server to send unsolicited messages to the AP to change session attributes (e.g., role, VLAN) or disconnect a client mid-session.
Question 6: Which authentication scenario would most benefit from using EAP-FAST over EAP-PEAP?
- Environments where clients have pre-installed X.509 certificates
- Environments where server certificate deployment is impractical but strong mutual auth is needed (Correct answer)
- Environments using only MAC address authentication
- Environments requiring LDAP as the only identity source
Correct answer: Environments where server certificate deployment is impractical but strong mutual auth is needed
EAP-FAST uses Protected Access Credentials (PACs) instead of server certificates to establish the TLS tunnel, making it suitable when PKI infrastructure is unavailable.
Question 7: When an Aruba AP operates in 'bridge mode', where does 802.1X authentication processing occur?
- On the Aruba Mobility Controller centrally
- On the AP itself using a local RADIUS configuration (Correct answer)
- On the ClearPass server without AP involvement
- Authentication is not supported in bridge mode
Correct answer: On the AP itself using a local RADIUS configuration
In bridge mode (also called local forwarding), the AP handles 802.1X authentication locally and communicates directly with the configured RADIUS server without relaying through a controller.
ACMA Authentication Methods 4
What is Aruba's Downloadable User Roles (DUR) feature designed to accomplish?