ACSP Network Security & Traffic Management 2 — Questions and Answers
Question 1: An Aruba switch is configured with Port Access Control (PAC). A device fails 802.1X authentication but succeeds with MAC authentication. Which role will the device receive?
- The 802.1X-authenticated role
- The MAC-authenticated role (Correct answer)
- The default unauthenticated role
- The critical role
Correct answer: The MAC-authenticated role
When 802.1X fails and MAC authentication succeeds, the switch assigns the role associated with the MAC-auth success.
Question 2: Which ArubaOS-CX command enables DHCP snooping on a specific VLAN?
- ip dhcp snooping enable vlan <id>
- dhcp-snooping vlan <id>
- ip dhcp snooping vlan <id> (Correct answer)
- set dhcp-snooping vlan <id>
Correct answer: ip dhcp snooping vlan <id>
The correct ArubaOS-CX syntax to enable DHCP snooping on a VLAN is 'ip dhcp snooping vlan <id>' entered in global configuration mode.
Question 3: What is the primary function of Dynamic ARP Inspection (DAI) on an Aruba switch?
- Prevent unauthorized DHCP servers from responding
- Validate ARP packets against the DHCP snooping binding table (Correct answer)
- Block flooding of ARP broadcasts on access ports
- Rate-limit ARP requests from untrusted ports only
Correct answer: Validate ARP packets against the DHCP snooping binding table
DAI intercepts ARP packets on untrusted ports and validates them against the DHCP snooping binding table to prevent ARP spoofing.
Question 4: An administrator wants to prevent a rogue DHCP server on an access port. Which Aruba switch feature should be enabled, and how should the uplink be configured?
- Enable DHCP snooping; configure uplink as trusted (Correct answer)
- Enable DAI; configure uplink as untrusted
- Enable IP Source Guard; configure uplink as trusted
- Enable port security; configure uplink as restricted
Correct answer: Enable DHCP snooping; configure uplink as trusted
DHCP snooping prevents rogue DHCP servers by marking only trusted ports (uplinks) as allowed to send DHCP offers.
Question 5: When configuring Control Plane Policing (CoPP) on ArubaOS-CX, what is the main goal?
- Limit bandwidth on uplink ports
- Protect the switch CPU from excessive protocol traffic (Correct answer)
- Prioritize voice traffic in the data plane
- Enforce QoS policies on end-user ports
Correct answer: Protect the switch CPU from excessive protocol traffic
CoPP protects the switch control plane (CPU) by rate-limiting traffic destined to the processor, preventing DoS attacks.
Question 6: Which statement best describes IP Source Guard on an Aruba switch?
- It blocks all non-IP traffic on a port
- It filters traffic based on IP and MAC from the DHCP snooping table (Correct answer)
- It validates IP addresses against a static ACL
- It prevents IP fragmentation attacks
Correct answer: It filters traffic based on IP and MAC from the DHCP snooping table
IP Source Guard uses the DHCP snooping binding table to permit only traffic whose source IP and MAC match a valid binding.
Question 7: A network engineer must limit the number of MAC addresses learned on an access port to 5. Which ArubaOS-CX feature accomplishes this?
- Dynamic ARP Inspection
- Port security with a MAC limit (Correct answer)
- DHCP snooping binding limit
- IP Source Guard address filter
Correct answer: Port security with a MAC limit
Port security on ArubaOS-CX allows limiting MAC addresses per port and defining violation actions when the limit is exceeded.
ACSP Network Security & Traffic Management 2
An Aruba switch is configured with Port Access Control (PAC).
A device fails 802.1X authentication but succeeds with MAC authentication.
Which role will the device receive?