ACSP Access Control Lists (ACLs) 2

Question 1

On an Aruba switch, which ACL type can match traffic based on both source and destination MAC addresses?

Accepted Answer

Extended MAC ACL

Answer

Extended MAC ACLs on Aruba switches allow matching on both source and destination MAC addresses, EtherType, and VLAN.

Question 2

When applying an ACL to a VLAN interface on an Aruba switch, what does the 'in' direction filter?

Accepted Answer

Traffic entering the switch from hosts in that VLAN

Answer

Applying an ACL 'in' on a VLAN interface filters traffic as it ingresses from hosts in that VLAN toward the switch.

Question 3

An administrator wants to permit SSH (port 22) from a management subnet 10.0.0.0/24 only. Which ACL entry accomplishes this?

Accepted Answer

permit tcp 10.0.0.0/24 any eq 22

Answer

SSH uses TCP port 22; permitting tcp from the source subnet to any destination on port 22 correctly scopes the rule.

Question 4

In Aruba AOS-Switch ACL processing, what happens to a packet that does not match any explicit ACE?

Accepted Answer

It is dropped by the implicit deny all

Answer

All Aruba switch ACLs end with an implicit 'deny any' that drops packets not matching any configured ACE.

Question 5

Which command on an Aruba AOS-Switch shows how many packets have matched each ACE in an ACL named 'BLOCK_WEB'?

Accepted Answer

show access-list BLOCK_WEB statistics

Answer

The 'show access-list <name> statistics' command displays per-ACE hit counters for traffic matching that ACL.

(ACSP) Aruba Certified Switching Professional Practice Test