ACMA Configuration & Troubleshooting of Aruba Solutions 4 — Questions and Answers
Question 1: An admin wants to configure port-based 802.1X authentication on an Aruba switch uplink port. Which port mode should be avoided for this configuration?
- Trunk mode (Correct answer)
- Access mode
- Hybrid mode
- Monitor mode
Correct answer: Trunk mode
802.1X port-based authentication is not applicable to trunk ports, which carry multiple VLANs between infrastructure devices and do not authenticate end users.
Question 2: In ArubaOS, what does the 'aaa profile' bind together for a given SSID?
- Authentication method, server group, and default user role (Correct answer)
- VLAN assignment and QoS policy
- AP group and RF profile
- Firewall policy and bandwidth contract
Correct answer: Authentication method, server group, and default user role
An AAA profile links the authentication method (802.1X, MAC, captive portal), the RADIUS server group, and the default role assigned to authenticated users.
Question 3: A client successfully connects to an Aruba SSID but cannot reach the internet. The 'show user' command shows the client in the 'logon' role. What does this indicate?
- Authentication has not completed; the client is in the pre-authentication role (Correct answer)
- The client has been blacklisted by the controller
- The SSID is configured in bridge mode without VLAN
- The client's IP address conflicts with another device
Correct answer: Authentication has not completed; the client is in the pre-authentication role
The 'logon' role is the default pre-authentication role; if a client remains there, it means authentication (802.1X, captive portal, or MAC auth) has not succeeded.
Question 4: When deploying Aruba Central for cloud management, which protocol does the AP use to establish its management tunnel to Aruba Central?
- HTTPS over port 443 (Correct answer)
- PAPI over UDP 8211
- CAPWAP over UDP 5246/5247
- SSH over port 22
Correct answer: HTTPS over port 443
Aruba APs managed by Aruba Central use HTTPS (port 443) to establish the management connection to the cloud platform.
Question 5: An Aruba controller shows high CPU utilization. An admin suspects rogue AP processing is consuming resources. Which command would help identify the number of rogues being tracked?
- show ap monitor ap-list | count (Correct answer)
- show process cpu | include rogue
- show ids rogue-ap table count
- show wids stats rogue
Correct answer: show ap monitor ap-list | count
Piping 'show ap monitor ap-list' through count reveals how many neighboring APs are being tracked, which directly impacts CPU load from rogue processing.
Question 6: An administrator needs to ensure that traffic from IoT devices on VLAN 40 cannot communicate with corporate devices on VLAN 10. What Aruba feature enforces this segmentation?
- Firewall policies within user roles assigned to each VLAN (Correct answer)
- VLAN ACLs applied to the switch trunk port
- RF containment on the IoT SSID
- Client isolation on the IoT SSID only
Correct answer: Firewall policies within user roles assigned to each VLAN
ArubaOS stateful firewall policies within user roles can deny inter-VLAN traffic, providing role-based network segmentation between IoT and corporate devices.
Question 7: After upgrading ArubaOS on a Mobility Controller, some APs remain on the previous firmware version. What is the correct way to upgrade AP firmware?
- Use the 'upgrade-firmware' option in the AP image management section of the controller
- Manually TFTP the firmware to each AP's console port
- Re-provision each AP from scratch using ZTP
- AP firmware upgrades automatically when the AP reboots after controller upgrade (Correct answer)
Correct answer: AP firmware upgrades automatically when the AP reboots after controller upgrade
Aruba APs automatically download and install the firmware image from the controller the next time they reboot or reconnect, so a controller upgrade triggers AP firmware updates on reconnection.
ACMA Configuration & Troubleshooting of Aruba Solutions 4
An admin wants to configure port-based 802.1X authentication on an Aruba switch uplink port.
Which port mode should be avoided for this configuration?