ACMA Network Security 3 — Questions and Answers
Question 1: Which protocol does Aruba use for centralized key management to support fast BSS transitions (802.11r)?
- RADIUS over UDP
- Opportunistic Key Caching (OKC)
- Fast BSS Transition (FT) with PMK-R0/R1 key hierarchy (Correct answer)
- LDAP key binding
Correct answer: Fast BSS Transition (FT) with PMK-R0/R1 key hierarchy
802.11r uses a PMK-R0/R1 key hierarchy managed by the mobility domain to enable fast transitions between APs.
Question 2: In Aruba's role-based access control, what happens to traffic that does not match any firewall policy rule?
- Traffic is passed to the next AP for inspection
- It is implicitly denied by the default deny rule (Correct answer)
- It is forwarded to the default VLAN
- It triggers a RADIUS re-authentication
Correct answer: It is implicitly denied by the default deny rule
Aruba firewalls have an implicit deny-all at the end of each policy, dropping unmatched traffic.
Question 3: What does Aruba's 'Client Match' feature do in a security context?
- Matches client certificates to RADIUS profiles
- Steers clients away from overloaded or poorly performing APs (Correct answer)
- Matches SSID broadcast to specific client MAC addresses
- Enforces ACLs based on client OS type
Correct answer: Steers clients away from overloaded or poorly performing APs
Client Match steers clients to the best available AP based on RF conditions and load, improving performance and security posture.
Question 4: Which encryption protocol is used by WPA3-Enterprise to provide 192-bit security mode?
- AES-128-CCMP
- GCMP-256 with SHA-384 (Correct answer)
- TKIP with SHA-256
- ChaCha20-Poly1305
Correct answer: GCMP-256 with SHA-384
WPA3-Enterprise 192-bit mode uses GCMP-256 for data encryption and SHA-384 for integrity, meeting Suite-B requirements.
Question 5: An administrator wants to prevent wireless clients from communicating directly with each other on the same SSID. Which Aruba feature accomplishes this?
- Proxy ARP
- Station Isolation (Client Isolation) (Correct answer)
- VLAN Pooling
- MAC Authentication Bypass
Correct answer: Station Isolation (Client Isolation)
Station (Client) Isolation blocks peer-to-peer traffic between clients on the same SSID, preventing lateral movement.
Question 6: Which port must be open on a firewall between an Aruba AP and its controller for PAPI control traffic?
- UDP 4500
- UDP 8211 (Correct answer)
- TCP 443
- UDP 500
Correct answer: UDP 8211
PAPI (Process Application Programming Interface) uses UDP port 8211 for control communication between APs and the Mobility Controller.
Question 7: What is the primary security benefit of Aruba's GRE tunnel mode for remote APs (RAPs)?
- It encrypts management traffic only
- It tunnels all client traffic back to the controller, bypassing untrusted local networks (Correct answer)
- It allows split tunneling for guest traffic
- It uses IPsec for data plane encryption only
Correct answer: It tunnels all client traffic back to the controller, bypassing untrusted local networks
GRE tunnel mode sends all RAP client traffic through an encrypted tunnel to the controller, ensuring it does not traverse untrusted local networks unprotected.
ACMA Network Security 3
Which protocol does Aruba use for centralized key management to support fast BSS transitions (802.11r)?