Practice Test Geeks(ACP) Aruba Certified Professional Certification Practice Test
← All ACP Flashcard Decks

Security and Access Control Flashcards

7 cards from real ACP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Security and Access Control flashcards as text

  1. In an Aruba 802.1X deployment, what happens when a switch port's authentication fails and 'auth-fail VLAN' is configured?

    Answer: The client is placed into a restricted VLAN with limited access instead of being blocked entirely

    The auth-fail VLAN (also called restricted VLAN) allows authentication-failed devices limited connectivity, useful for remediation or guest access scenarios.

  2. Which ClearPass component allows unauthenticated users to self-register and receive temporary network credentials?

    Answer: ClearPass Guest

    ClearPass Guest provides a customizable web portal for visitor self-registration, sponsor approval workflows, and temporary credential issuance.

  3. What is OWE (Opportunistic Wireless Encryption) designed to protect against?

    Answer: Passive eavesdropping on open (unencrypted) Wi-Fi networks

    OWE (defined in RFC 8110) adds encryption to open Wi-Fi networks without requiring a passphrase, protecting against passive packet capture on public hotspots.

  4. An administrator wants to ensure that only Aruba APs with valid certificates can terminate tunnels on the Mobility Controller. Which feature accomplishes this?

    Answer: CPsec (Control Plane Security)

    CPsec uses certificates to authenticate APs to the Mobility Controller, encrypting the control plane tunnel and preventing rogue APs from joining the managed infrastructure.

  5. What does RADIUS Change of Authorization (CoA) allow a ClearPass server to do after a session is already established?

    Answer: Dynamically modify or terminate an active user session without requiring reauthentication

    RADIUS CoA (RFC 5176) lets ClearPass send a CoA-Request to the NAS to change session attributes—like re-assigning a VLAN or disconnecting a user—based on posture changes or policy events.

  6. Which attack does 'IP Source Guard' primarily protect against on an Aruba-managed switch?

    Answer: IP address spoofing by clients claiming IPs not assigned to them via DHCP

    IP Source Guard validates source IP addresses against the DHCP snooping binding table and drops packets from clients using IP addresses they were not assigned.

  7. In an Aruba Mobility Controller environment, which feature allows a RADIUS server to place a wireless user into a quarantine role when their device fails a posture check?

    Answer: RADIUS CoA with a role-change attribute

    ClearPass can send a RADIUS CoA to the Mobility Controller with an Aruba VSA specifying the new user role, instantly moving the device to a quarantine role without dropping the session.