ACSP Access Control Lists (ACLs) 3 — Questions and Answers
Question 1: Which Aruba switch ACL feature allows you to assign a QoS priority to packets matching a specific ACE?
- ACL remarking with DSCP set action (Correct answer)
- ACL logging action
- ACL rate-limit action only
- ACL mirroring action
Correct answer: ACL remarking with DSCP set action
Aruba AOS-Switch ACEs support a 'set dscp' or priority action that remarks the DSCP value of matching packets for QoS treatment.
Question 2: On an Aruba switch, what is the maximum number of ACLs that can be simultaneously applied to a single port?
- One per direction per traffic type (e.g., one IPv4 in, one IPv4 out) (Correct answer)
- Unlimited ACLs per port
- Only one ACL total per port
- Two ACLs inbound and two outbound regardless of type
Correct answer: One per direction per traffic type (e.g., one IPv4 in, one IPv4 out)
Aruba switches allow one ACL per direction per type (IPv4, IPv6, MAC) on a port, so multiple ACLs can coexist if they are different types or directions.
Question 3: An extended ACL entry reads: 'deny tcp 192.168.10.0/24 172.16.0.0/16 eq 80'. Which traffic does this block?
- TCP port 80 from 192.168.10.0/24 to 172.16.0.0/16 (Correct answer)
- TCP port 80 from 172.16.0.0/16 to 192.168.10.0/24
- All TCP from 192.168.10.0/24
- UDP port 80 from 192.168.10.0/24
Correct answer: TCP port 80 from 192.168.10.0/24 to 172.16.0.0/16
The ACE matches TCP traffic sourced from 192.168.10.0/24 destined for port 80 on any host in 172.16.0.0/16.
Question 4: What does the 'established' keyword do when used in an Aruba extended IP ACL entry for TCP?
- Matches only TCP segments with ACK or RST flags set (Correct answer)
- Matches only SYN packets initiating new connections
- Matches all TCP traffic regardless of state
- Matches only FIN-flagged TCP packets
Correct answer: Matches only TCP segments with ACK or RST flags set
The 'established' keyword matches TCP packets with the ACK or RST bit set, indicating they belong to an existing connection rather than initiating a new one.
Question 5: An Aruba switch ACL is applied outbound on a routed VLAN interface. Which traffic does it inspect?
- Traffic being routed out of that VLAN toward other networks (Correct answer)
- Traffic entering the VLAN from hosts
- Only broadcast traffic
- Only inter-VLAN routing traffic sourced within the VLAN
Correct answer: Traffic being routed out of that VLAN toward other networks
An outbound ACL on a routed VLAN interface inspects traffic that has been routed and is exiting through that interface toward its destination.
Question 6: Which of the following is a valid reason to place an extended ACL close to the traffic source on an Aruba switch?
- To save ACL TCAM resources on core switches
- To drop unwanted traffic early and reduce unnecessary transit (Correct answer)
- Because standard ACLs cannot be applied near the source
- Extended ACLs only function correctly near the source
Correct answer: To drop unwanted traffic early and reduce unnecessary transit
Placing extended ACLs near the source drops unwanted traffic before it traverses the network, reducing bandwidth consumption on transit links.
Question 7: On an Aruba switch, what happens if you attempt to apply an ACL that references a non-existent ACL name to an interface?
- The switch creates an empty ACL with that name automatically
- The switch rejects the command with an error (Correct answer)
- Traffic is permitted by default until the ACL is created
- The interface is shut down until the ACL is defined
Correct answer: The switch rejects the command with an error
Aruba AOS-Switch returns an error if you try to apply an ACL name that has not been defined, preventing misconfiguration.
ACSP Access Control Lists (ACLs) 3
Which Aruba switch ACL feature allows you to assign a QoS priority to packets matching a specific ACE?