ACMA Authentication Methods 4

Question 1

What is Aruba's Downloadable User Roles (DUR) feature designed to accomplish?

Accepted Answer

Push role configurations from ClearPass to APs at authentication time, eliminating pre-configuration on the AP

Answer

Downloadable User Roles allow ClearPass to dynamically push complete role definitions (ACLs, policies) to Aruba APs via RADIUS VSAs, so roles don't need to be pre-configured on each AP.

Question 2

Which Aruba VSA (Vendor-Specific Attribute) is commonly used to assign a user role upon successful RADIUS authentication?

Accepted Answer

Aruba-User-Role (Aruba VSA 1)

Answer

Aruba-User-Role (VSA attribute 1, vendor ID 14823) is returned in the RADIUS Access-Accept to specify the role the client should be placed in.

Question 3

What distinguishes WPA3-Enterprise from WPA2-Enterprise in terms of authentication security?

Accepted Answer

WPA3-Enterprise mandates 192-bit cryptographic suite and requires PMF

Answer

WPA3-Enterprise (192-bit mode) mandates the use of GCMP-256/CCMP-256 encryption and requires Protected Management Frames (PMF/802.11w) to be mandatory.

Question 4

In ClearPass, what is the 'Authentication Method' configuration item used for?

Accepted Answer

Defining which EAP types and inner methods the policy will accept

Answer

An Authentication Method in ClearPass defines acceptable EAP types (e.g., PEAP, EAP-TLS, TTLS) and their inner methods, controlling how credentials are exchanged.

Question 5

What happens during RADIUS Change of Authorization (CoA) in an Aruba deployment?

Accepted Answer

The RADIUS server proactively sends a new policy to the AP to modify or terminate an active session

Answer

RADIUS CoA (RFC 5176) allows the RADIUS server to send unsolicited messages to the AP to change session attributes (e.g., role, VLAN) or disconnect a client mid-session.

(ACMA) Aruba Certified Mobility Associate Practice Test

(ACMA) Aruba Certified Mobility Associate Practice Test

ACMA Authentication Methods 4