ACSP Access Control Lists (ACLs) 4 — Questions and Answers
Question 1: In Aruba AOS-CX, which command correctly creates a named IPv4 ACL called 'RESTRICT_GUEST'?
- ip access-list RESTRICT_GUEST (Correct answer)
- access-list ip RESTRICT_GUEST extended
- ip acl RESTRICT_GUEST standard
- create acl ipv4 RESTRICT_GUEST
Correct answer: ip access-list RESTRICT_GUEST
On Aruba AOS-CX, 'ip access-list <name>' enters ACL configuration mode to define an IPv4 named ACL.
Question 2: On an Aruba AOS-CX switch, how is an ACL applied to a VLAN interface in the inbound direction?
- Under the VLAN interface: 'ip access-group <name> in' (Correct answer)
- Under the VLAN interface: 'access-class <name> in'
- Under the physical port: 'ip acl <name> vlan inbound'
- Globally: 'acl vlan <id> in <name>'
Correct answer: Under the VLAN interface: 'ip access-group <name> in'
On AOS-CX, you navigate to the VLAN interface and use 'ip access-group <name> in' to apply an IPv4 ACL inbound.
Question 3: What is the effect of adding the 'log' action to an ACE on an Aruba switch?
- Matching packets are forwarded with a syslog entry generated (Correct answer)
- Matching packets are dropped and logged
- All traffic to the CPU is logged regardless of ACL
- Logging disables the permit/deny action of the ACE
Correct answer: Matching packets are forwarded with a syslog entry generated
The 'log' keyword generates a syslog message for each matching packet but does not change the permit or deny action of the ACE.
Question 4: Which Aruba ACL type is specifically designed to filter traffic based on EtherType values such as ARP or IPv6?
- Standard IP ACL
- Extended IP ACL
- MAC ACL with EtherType matching (Correct answer)
- VLAN ACL
Correct answer: MAC ACL with EtherType matching
MAC ACLs on Aruba switches support EtherType matching, enabling filtering of specific Layer 2 protocols like ARP (0x0806) or IPv6 (0x86DD).
Question 5: On an Aruba switch, an ACL applied to a LAG (Link Aggregation Group) is enforced on which ports?
- Only the primary member port
- All member ports of the LAG simultaneously (Correct answer)
- Only the port that is currently active in the LAG
- Only on uplink member ports, not downlink
Correct answer: All member ports of the LAG simultaneously
An ACL applied to a LAG interface is enforced on all member ports simultaneously, ensuring consistent filtering across the aggregated link.
Question 6: A security engineer wants to block ICMP echo requests (ping) from host 10.1.1.5 to the server farm 172.31.0.0/16. Which ACE is correct?
- deny icmp host 10.1.1.5 172.31.0.0/16 echo (Correct answer)
- deny ip host 10.1.1.5 172.31.0.0/16
- deny icmp 172.31.0.0/16 host 10.1.1.5 echo
- deny udp host 10.1.1.5 172.31.0.0/16 eq echo
Correct answer: deny icmp host 10.1.1.5 172.31.0.0/16 echo
ICMP type 'echo' (ping request) is correctly denied from the specific source host to the destination subnet using the icmp protocol keyword.
Question 7: When troubleshooting an ACL on an Aruba AOS-Switch, which command clears the ACE hit counters so you can observe fresh traffic patterns?
- clear access-list <name> statistics (Correct answer)
- reset acl counters <name>
- no access-list <name> statistics
- debug acl clear <name>
Correct answer: clear access-list <name> statistics
'clear access-list <name> statistics' resets all hit counters for the specified ACL, allowing fresh observation of traffic matching each ACE.
ACSP Access Control Lists (ACLs) 4
In Aruba AOS-CX, which command correctly creates a named IPv4 ACL called 'RESTRICT_GUEST'?