ACSP Network Security & Traffic Management 3 — Questions and Answers
Question 1: On an Aruba CX switch, which protocol detects and prevents loops on ports where STP is disabled, typically access ports connected to end devices?
- MSTP
- BPDU Guard
- Loop Protect (Correct answer)
- Root Guard
Correct answer: Loop Protect
Loop Protect detects loops on ports not participating in STP by sending periodic PDUs and blocking the port if a loop is detected.
Question 2: What action does BPDU Guard take when it receives a BPDU on a protected PortFast-enabled access port?
- Transitions the port to the STP root state
- Places the port into an err-disabled state (Correct answer)
- Sends a BPDU trap to the NMS and continues
- Increases the STP bridge priority
Correct answer: Places the port into an err-disabled state
BPDU Guard immediately disables (err-disables) a PortFast port upon receiving any BPDU, protecting the STP topology.
Question 3: An Aruba switch uses 802.1X with multi-domain authentication. In which scenario are both a phone and a PC authenticated on the same port?
- Voice VLAN assigns the phone, 802.1X assigns the PC to data VLAN
- Both devices share a single 802.1X session
- The phone uses MAB and the PC uses 802.1X in separate domains (Correct answer)
- CDP negotiates VLAN assignment for the phone
Correct answer: The phone uses MAB and the PC uses 802.1X in separate domains
Multi-domain authentication allows one device (commonly a phone via MAB) and another (PC via 802.1X) to authenticate independently on the same port.
Question 4: What does the 'critical' authentication role provide on an Aruba switch when the RADIUS server is unreachable?
- It denies all access until the RADIUS server recovers
- It grants limited, pre-defined access to keep the network functional (Correct answer)
- It falls back to local 802.1X authentication
- It disables the authenticator port
Correct answer: It grants limited, pre-defined access to keep the network functional
The critical role provides a fallback access level when the RADIUS server is unavailable, preventing complete loss of access.
Question 5: Which QoS scheduling mechanism guarantees a minimum bandwidth percentage for each traffic class on an ArubaOS-CX switch?
- Strict Priority Queuing (SPQ)
- Deficit Weighted Round Robin (DWRR) (Correct answer)
- First-In First-Out (FIFO)
- Deficit Round Robin with no weights
Correct answer: Deficit Weighted Round Robin (DWRR)
DWRR allocates bandwidth to queues proportionally based on assigned weights, guaranteeing minimums for each class.
Question 6: On an Aruba switch, which DSCP value is typically used to mark voice bearer (RTP) traffic per Aruba QoS best practices?
- DSCP 0 (Best Effort)
- DSCP 26 (AF31)
- DSCP 46 (EF) (Correct answer)
- DSCP 34 (AF41)
Correct answer: DSCP 46 (EF)
DSCP EF (Expedited Forwarding, value 46) is the standard marking for real-time voice traffic requiring low latency and jitter.
Question 7: A trunk port on an Aruba CX switch is receiving frames tagged with VLAN 10, but VLAN 10 is not in the allowed VLAN list. What happens to these frames?
- They are forwarded in the native VLAN
- They are dropped by the switch (Correct answer)
- They trigger a VLAN mismatch SNMP trap
- They are forwarded to the management VLAN
Correct answer: They are dropped by the switch
Frames tagged with a VLAN not in the trunk's allowed VLAN list are dropped at ingress on the trunk port.
ACSP Network Security & Traffic Management 3
On an Aruba CX switch, which protocol detects and prevents loops on ports where STP is disabled, typically access ports connected to end devices?