ACSP - Aruba Certified Switching Professional Switch Security Features Questions and Answers

Question 1

A network administrator wants to prevent man-in-the-middle attacks that leverage ARP spoofing.
They have already enabled DHCP Snooping on the user access VLANs.
Which additional security feature must be enabled to validate ARP packets against the DHCP Snooping binding database?

Accepted Answer

Dynamic ARP Inspection (DAI)

Answer

Port Security

Answer

Control Plane Policing (CoPP)

Answer

RA Guard

Question 2

An administrator configures port security on an ArubaOS-CX switch interface connected to a public kiosk. The requirement is to allow only the first device that connects to the port. If an unauthorized user unplugs the kiosk and connects their own laptop, the port should immediately be disabled and a log message generated. Which violation action should be configured?

Accepted Answer

shutdown

Answer

notify

Answer

restrict

Answer

protect

Question 3

In a network using 802.1X for port-based access control, what is the role of the ArubaOS-CX switch?

Accepted Answer

Authenticator

Answer

Supplicant

Answer

Authentication Server

Answer

RADIUS Client

Question 4

A network is experiencing performance degradation on a core switch. The administrator suspects a denial-of-service (DoS) attack using a high volume of broadcast traffic is overwhelming the switch's processor. Which security feature is specifically designed to protect the switch's CPU by rate-limiting traffic destined for the control plane?

Accepted Answer

Control Plane Policing (CoPP)

Answer

Access Control Lists (ACLs)

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection (DAI)

Question 5

An administrator is configuring DHCP Snooping on an ArubaOS-CX switch to mitigate rogue DHCP server attacks. What is the default state of all switch ports when DHCP Snooping is first enabled on a VLAN?

Accepted Answer

Untrusted

Answer

Trusted

Answer

Forwarding

Answer

Disabled

Question 6

A company is implementing IPv6 and is concerned about rogue devices sending Router Advertisement (RA) messages to redirect client traffic. Which ArubaOS-CX feature should be enabled on client-facing ports to inspect and drop unauthorized RA packets?

Accepted Answer

RA Guard

Answer

IP Source Guard

Answer

DHCPv6 Guard

Answer

Control Plane Policing (CoPP)

A network administrator wants to prevent man-in-the-middle attacks that leverage ARP spoofing.They have already enabled DHCP Snooping on the user access VLANs.Which additional security feature must be enabled to validate ARP packets against the DHCP Snooping binding database?

A network administrator wants to prevent man-in-the-middle attacks that leverage ARP spoofing.
They have already enabled DHCP Snooping on the user access VLANs.
Which additional security feature must be enabled to validate ARP packets against the DHCP Snooping binding database?