Security and Access Control Flashcards
7 cards from real ACP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Security and Access Control flashcards as text
Which Aruba feature allows administrators to dynamically assign users to different VLANs based on their role after authentication?
Answer: Dynamic VLAN Assignment
Dynamic VLAN Assignment uses RADIUS attributes to place authenticated users into the appropriate VLAN based on their role or group membership.
In Aruba ClearPass, what is the purpose of the 'Enforcement Policy'?
Answer: To map authentication results to specific access privileges or enforcement profiles
An Enforcement Policy in ClearPass maps the outcome of authentication and authorization checks to Enforcement Profiles that define the actual access control actions.
Which port is used by RADIUS for authentication requests by default?
Answer: UDP 1812
RADIUS authentication uses UDP port 1812 per RFC 2865, though legacy implementations may use 1645.
What does the Aruba Mobility Controller use 'user roles' for?
Answer: Applying firewall policies, bandwidth limits, and session ACLs to authenticated wireless users
User roles on Aruba Mobility Controllers bind a set of policies—firewall rules, QoS, and session attributes—to users after they authenticate.
Which EAP method uses a server-side certificate and a client-side certificate for mutual authentication?
Answer: EAP-TLS
EAP-TLS requires both the server and the client to present X.509 certificates, providing the strongest form of mutual authentication.
In Aruba's Zero Trust security model, which principle ensures that a user's access is continuously verified rather than trusted after initial login?
Answer: Continuous Authentication and Authorization
Zero Trust requires continuous verification of identity and device posture throughout a session, not just at initial authentication.
What is the role of a 'downloadable ACL' (dACL) in an Aruba 802.1X deployment?
Answer: It allows the RADIUS server to push per-user ACL rules to the network device after authentication
A dACL is sent by the RADIUS server as a RADIUS attribute during authentication, letting the network device apply user-specific access rules without static pre-configuration.