ACSP Access Control Lists (ACLs) 5 — Questions and Answers
Question 1: Which Aruba AOS-CX ACL feature allows an ACE to redirect matching traffic to a specified next-hop IP address instead of normal routing?
- ACE redirect action with a nexthop parameter (Correct answer)
- Policy-based routing via standard ACL
- ACL mirroring to a route table
- VLAN redirect via MAC ACL
Correct answer: ACE redirect action with a nexthop parameter
AOS-CX ACEs support a 'redirect' action that policy-routes matching packets to a specified next-hop, bypassing the normal routing table.
Question 2: On an Aruba switch, what is the primary purpose of a 'remark' entry in an ACL configuration?
- To add a human-readable comment to the ACL without affecting traffic (Correct answer)
- To mark DSCP bits in packet headers
- To log remarks to a syslog server
- To temporarily disable the ACL entry below it
Correct answer: To add a human-readable comment to the ACL without affecting traffic
A 'remark' is a comment line in an ACL that is visible in the configuration for documentation purposes but has no effect on packet processing.
Question 3: An ACL contains these sequential ACEs: (1) permit tcp any any eq 443, (2) deny ip 10.0.0.0/8 any, (3) permit ip any any. What happens to HTTPS traffic from 10.5.5.5?
- It is denied by ACE 2
- It is permitted by ACE 1 before reaching ACE 2 (Correct answer)
- It is dropped by the implicit deny
- It is permitted by ACE 3
Correct answer: It is permitted by ACE 1 before reaching ACE 2
ACL processing is top-down and stops at the first match; TCP port 443 from any source matches ACE 1 and is permitted before ACE 2 is evaluated.
Question 4: In Aruba AOS-CX, which ACL type uses 'ipv6 access-list' to filter IPv6 traffic on an interface?
- IPv6 ACL (Correct answer)
- Extended IP ACL with IPv6 option
- MAC ACL with EtherType 0x86DD
- Standard IP ACL with IPv6 prefix
Correct answer: IPv6 ACL
AOS-CX uses 'ipv6 access-list <name>' to create dedicated IPv6 ACLs that match on IPv6 source/destination addresses and upper-layer protocols.
Question 5: What is the recommended best practice for ACL sequence numbers on Aruba switches to allow future ACE insertions?
- Number ACEs in increments of 10 (10, 20, 30…) to leave gaps for insertion (Correct answer)
- Use sequential numbering (1, 2, 3…) for clarity
- Use only even numbers for permits and odd for denies
- Sequence numbers are not supported; ACEs are appended only
Correct answer: Number ACEs in increments of 10 (10, 20, 30…) to leave gaps for insertion
Numbering ACEs in increments of 10 leaves room to insert new entries between existing ones without resequencing the entire ACL.
Question 6: On an Aruba switch, which ACL application scenario would require a VLAN ACL (VACL) rather than an interface ACL?
- Filtering traffic between two hosts within the same VLAN (Correct answer)
- Filtering traffic between two different VLANs
- Blocking traffic from an uplink to a server port
- Rate-limiting traffic on a specific uplink port
Correct answer: Filtering traffic between two hosts within the same VLAN
VACLs filter traffic within a VLAN (intra-VLAN), including host-to-host traffic that never leaves the VLAN and would not traverse a routed interface.
Question 7: After configuring an ACL on an Aruba AOS-Switch, the administrator notices traffic that should be blocked is still passing. Which of the following is the most likely cause?
- The ACL was not applied to the correct interface or direction (Correct answer)
- ACLs require a switch reboot to take effect
- The implicit permit at the end is overriding the deny
- ACLs only work on routed interfaces, not switched ports
Correct answer: The ACL was not applied to the correct interface or direction
A common misconfiguration is creating an ACL correctly but forgetting to apply it to the specific interface and direction where the traffic should be filtered.
ACSP Access Control Lists (ACLs) 5
Which Aruba AOS-CX ACL feature allows an ACE to redirect matching traffic to a specified next-hop IP address instead of normal routing?