ACMA Security Protocols & Network Access Control 5 — Questions and Answers
Question 1: What ClearPass module performs endpoint health checks (antivirus status, OS patch level, disk encryption) before or after network admission?
- ClearPass Guest
- ClearPass Onboard
- ClearPass OnGuard (Correct answer)
- ClearPass Device Insight
Correct answer: ClearPass OnGuard
ClearPass OnGuard is the posture assessment agent that checks endpoint health attributes like antivirus definitions, patch level, and firewall status.
Question 2: In Aruba's tunneled node architecture, client traffic from a wired port is tunneled to the Mobility Controller — what encapsulation protocol is used?
- IPsec ESP
- GRE (Generic Routing Encapsulation) (Correct answer)
- VXLAN
- L2TP
Correct answer: GRE (Generic Routing Encapsulation)
Aruba uses GRE tunnels to carry client traffic from APs and tunneled wired ports back to the Mobility Controller for centralized policy enforcement.
Question 3: Which authentication server protocol provides command-level authorization and detailed accounting for administrator CLI access to Aruba network devices?
- RADIUS
- TACACS+ (Correct answer)
- LDAP
- Kerberos
Correct answer: TACACS+
TACACS+ separates authentication, authorization, and accounting into independent functions and provides granular command-by-command authorization, making it preferred for device administration.
Question 4: What happens to a wireless client's session in Aruba when ClearPass sends a RADIUS CoA Disconnect-Message (also called Packet of Disconnect)?
- The client's VLAN is changed without re-authentication
- The client is immediately disconnected and must re-authenticate (Correct answer)
- The client is quarantined to a restricted VLAN
- The client's bandwidth is throttled
Correct answer: The client is immediately disconnected and must re-authenticate
A RADIUS Disconnect-Message (PoD) forcibly terminates the client's session on the NAS, requiring the client to re-authenticate from scratch.
Question 5: In the context of Aruba firewall policies, what does the 'alias' feature allow administrators to do?
- Create shortcut commands for the CLI
- Define named groups of IP addresses, subnets, or services reusable across multiple ACL rules (Correct answer)
- Rename SSIDs without reconfiguring policies
- Create backup names for Mobility Controllers
Correct answer: Define named groups of IP addresses, subnets, or services reusable across multiple ACL rules
Aruba firewall aliases are named objects (network aliases or service aliases) that can be referenced in multiple rules, simplifying policy management and reducing errors.
Question 6: Which Aruba Instant security setting restricts management access to the Virtual Controller to only specific IP addresses or subnets?
- Management VLAN restriction
- Allowed access list (whitelist) for VC management (Correct answer)
- 802.1X for management plane
- SNMP community string filtering
Correct answer: Allowed access list (whitelist) for VC management
Aruba Instant allows configuration of an allowed IP access list that restricts which source IP addresses can reach the Virtual Controller management interface.
Question 7: What is the role of the PMK (Pairwise Master Key) cache in Aruba's 802.11 fast roaming implementation (OKC)?
- Stores the GTK for multicast decryption across APs
- Caches the derived PMK at the controller so roaming clients skip the full EAP exchange (Correct answer)
- Holds pre-downloaded firmware for fast AP boot
- Saves DHCP leases to avoid renewal delays on roam
Correct answer: Caches the derived PMK at the controller so roaming clients skip the full EAP exchange
Opportunistic Key Caching (OKC) caches the PMK derived from the initial EAP authentication at the Aruba controller, allowing roaming clients to derive a new PTK without repeating the full RADIUS exchange.
ACMA Security Protocols & Network Access Control 5
What ClearPass module performs endpoint health checks (antivirus status, OS patch level, disk encryption) before or after network admission?