ACMA Security Protocols & Network Access Control 4 — Questions and Answers
Question 1: What is the purpose of the Aruba 'captive portal' authentication method in a guest network scenario?
- Encrypts guest traffic with WPA3
- Redirects unauthenticated HTTP/HTTPS clients to a login or acceptance page (Correct answer)
- Issues digital certificates to guests
- Runs 802.1X authentication transparently
Correct answer: Redirects unauthenticated HTTP/HTTPS clients to a login or acceptance page
Captive portal intercepts web traffic from unauthenticated clients and redirects them to a login or terms-of-service page before granting internet access.
Question 2: When configuring an Aruba SSID for WPA3-Personal, which key exchange protocol replaces the traditional PSK 4-way handshake?
- Diffie-Hellman (DH)
- Simultaneous Authentication of Equals (SAE) (Correct answer)
- RSA key exchange
- Elliptic Curve Digital Signature Algorithm (ECDSA)
Correct answer: Simultaneous Authentication of Equals (SAE)
WPA3-Personal uses SAE (Dragonfly handshake) instead of the traditional PSK 4-way handshake, providing resistance to offline dictionary attacks.
Question 3: What is the default behavior of Aruba's 'deny all' implicit rule at the end of every user role's firewall policy?
- Drops traffic and sends a TCP RST to the source
- Silently drops all traffic not explicitly permitted by earlier rules (Correct answer)
- Redirects traffic to a captive portal
- Logs the traffic but allows it through
Correct answer: Silently drops all traffic not explicitly permitted by earlier rules
Aruba's implicit deny rule at the end of each role silently drops any traffic that does not match a preceding permit rule, following standard firewall best practice.
Question 4: In Aruba ClearPass, what is an 'Endpoint' context used for in an authorization policy?
- To define the RADIUS shared secret for the network device
- To query device attributes (OS, posture, MDM status) stored in the Endpoints repository (Correct answer)
- To set the VLAN for the authentication session
- To specify the EAP method the supplicant must use
Correct answer: To query device attributes (OS, posture, MDM status) stored in the Endpoints repository
The Endpoint context in ClearPass authorization policies allows rules to reference device attributes such as OS type, MDM enrollment status, or posture check results.
Question 5: Which Aruba feature prevents a wireless client from communicating directly with other clients on the same SSID at Layer 2?
- WPA2 isolation
- Client isolation (also called wireless client isolation or PSPF) (Correct answer)
- VLAN isolation
- Role-based access control
Correct answer: Client isolation (also called wireless client isolation or PSPF)
Client isolation (Publicly Secure Packet Forwarding / PSPF) blocks direct client-to-client Layer 2 forwarding on the same SSID, commonly used in guest networks.
Question 6: What RFC defines the RADIUS attribute VSA (Vendor-Specific Attribute) mechanism that Aruba uses to pass proprietary policy information?
- RFC 2865 (Correct answer)
- RFC 2866
- RFC 2868
- RFC 2548
Correct answer: RFC 2865
RFC 2865 (Remote Authentication Dial-In User Service) defines the core RADIUS protocol including Attribute 26 for Vendor-Specific Attributes (VSAs).
Question 7: Which 802.11 management frame protection feature, supported in WPA3, helps prevent deauthentication and disassociation attacks?
- 802.11w (MFP - Management Frame Protection) (Correct answer)
- 802.11r (Fast BSS Transition)
- 802.11k (Radio Resource Management)
- 802.11v (BSS Transition Management)
Correct answer: 802.11w (MFP - Management Frame Protection)
802.11w (Protected Management Frames / MFP) cryptographically protects deauthentication and disassociation frames, preventing spoofed disconnection attacks.
ACMA Security Protocols & Network Access Control 4
What is the purpose of the Aruba 'captive portal' authentication method in a guest network scenario?