ACSP Network Security & Traffic Management 4 — Questions and Answers
Question 1: What is the purpose of Root Guard on an Aruba switch STP configuration?
- Prevent inferior BPDUs from causing port flapping
- Ensure a port does not become a root port by blocking superior BPDUs (Correct answer)
- Speed up convergence on root bridge ports
- Enable BPDU filtering on non-root ports
Correct answer: Ensure a port does not become a root port by blocking superior BPDUs
Root Guard prevents a port from becoming a root port by placing it into a root-inconsistent state if it receives a superior BPDU.
Question 2: An Aruba CX switch has an ACL applied with 'deny ip any any' as the last entry. A packet matching no other ACE arrives. What happens?
- It is forwarded due to the implicit permit
- It is dropped by the explicit deny any any rule (Correct answer)
- It is sent to the CPU for inspection
- It is rate-limited before dropping
Correct answer: It is dropped by the explicit deny any any rule
An explicit 'deny ip any any' at the end of an ACL drops all unmatched traffic, overriding no other behavior.
Question 3: Which Aruba switch feature uses a downloadable role returned by a RADIUS server to enforce per-user access policies?
- Static VLAN assignment
- Downloadable User Role (role-based access control) (Correct answer)
- MAC-based VLAN assignment
- RADIUS VSA VLAN tagging only
Correct answer: Downloadable User Role (role-based access control)
Aruba's role-based access control allows RADIUS to return a user role containing ACLs and policies applied dynamically per user.
Question 4: When configuring storm control on an ArubaOS-CX access port, which traffic types can be rate-limited?
- Unicast only
- Broadcast and multicast only
- Broadcast, multicast, and unknown unicast (Correct answer)
- All traffic including known unicast
Correct answer: Broadcast, multicast, and unknown unicast
Storm control on ArubaOS-CX can rate-limit broadcast, multicast, and unknown unicast traffic to prevent storms from overwhelming the switch.
Question 5: An administrator configures 'spanning-tree port-type admin-edge' on an ArubaOS-CX access port. What is the effect?
- The port participates in STP but never becomes root
- The port immediately transitions to forwarding without waiting for STP timers (Correct answer)
- The port sends BPDUs to all connected devices
- The port is excluded from all VLAN STP instances
Correct answer: The port immediately transitions to forwarding without waiting for STP timers
Admin-edge (equivalent to PortFast) allows the port to immediately move to forwarding state, bypassing STP listening and learning delays.
Question 6: Which mechanism on Aruba switches prevents an unauthorized host from using an IP address not assigned by DHCP?
- Dynamic ARP Inspection
- DHCP Snooping alone
- IP Source Guard (Correct answer)
- Port Security MAC limit
Correct answer: IP Source Guard
IP Source Guard filters packets based on the DHCP snooping binding table, preventing hosts from using IP addresses not assigned by DHCP.
Question 7: In ArubaOS-CX, what is the default action when a port security violation occurs (MAC limit exceeded)?
- Send an SNMP trap only and continue learning
- Restrict new MACs and send a log message
- Err-disable the port immediately (Correct answer)
- Block only the offending MAC address
Correct answer: Err-disable the port immediately
By default, when the MAC limit is exceeded on an ArubaOS-CX port, the port is placed into err-disabled state.
ACSP Network Security & Traffic Management 4
What is the purpose of Root Guard on an Aruba switch STP configuration?