ACSP Network Security & Traffic Management 5 — Questions and Answers
Question 1: An Aruba CX switch administrator needs to prioritize voice traffic end-to-end. At the ingress access port, which action should be taken to trust the phone's DSCP markings?
- Apply 'qos trust dscp' on the access port (Correct answer)
- Apply 'qos trust cos' on the uplink port only
- Use a policy map to remark all traffic to DSCP 0
- Enable LLDP-MED to automatically trust all QoS markings
Correct answer: Apply 'qos trust dscp' on the access port
'qos trust dscp' on the access port instructs the switch to honor the DSCP markings applied by the IP phone.
Question 2: What is the role of LLDP-MED on Aruba switches in a voice deployment?
- It dynamically assigns an 802.1X role to IP phones
- It advertises voice VLAN and QoS policy to IP phones (Correct answer)
- It encrypts traffic between the phone and the switch
- It replaces 802.1X for phone authentication
Correct answer: It advertises voice VLAN and QoS policy to IP phones
LLDP-MED allows the switch to advertise the voice VLAN ID and QoS (CoS/DSCP) parameters to connected IP phones automatically.
Question 3: On an Aruba CX switch, a security policy requires that all RADIUS packets use a specific source IP. Which configuration achieves this?
- Set the RADIUS server IP as the source address
- Configure 'radius-server host <ip> source-interface <intf>' (Correct answer)
- Apply an outbound ACL on the management port
- Use a loopback interface as the default route next-hop
Correct answer: Configure 'radius-server host <ip> source-interface <intf>'
The 'source-interface' option on the RADIUS server configuration forces all RADIUS packets to use the IP of the specified interface.
Question 4: Which Aruba switch feature detects when a port connected to another switch is sending BPDUs and automatically moves it from an edge state to a non-edge STP state?
- Root Guard
- BPDU Guard
- Loop Protect
- Admin-edge with automatic BPDU detection (Correct answer)
Correct answer: Admin-edge with automatic BPDU detection
ArubaOS-CX admin-edge ports automatically revert to a non-edge state if a BPDU is received, protecting STP topology.
Question 5: When applying an IPv4 ACL on an ArubaOS-CX interface, which direction applies the ACL to traffic entering the switch from a host?
- Outbound (egress)
- Inbound (ingress) (Correct answer)
- Both directions simultaneously
- Management plane direction
Correct answer: Inbound (ingress)
Ingress (inbound) ACLs are applied to traffic arriving at the switch interface from an external host before it is forwarded.
Question 6: A network engineer wants to ensure that only one specific MAC address is allowed on an access port. Which combination of features is most appropriate on an Aruba CX switch?
- DHCP snooping with binding limit of 1
- Port security with a static allowed MAC and MAC limit of 1 (Correct answer)
- IP Source Guard with a single static entry
- 802.1X with MAC authentication bypass only
Correct answer: Port security with a static allowed MAC and MAC limit of 1
Port security with a static allowed MAC and a limit of 1 ensures only that single device can communicate on the port.
Question 7: An Aruba switch is part of a VSX pair. How is MSTP handled across the VSX active and standby switches?
- Each VSX peer runs an independent MSTP instance
- VSX synchronizes MSTP state so both peers appear as a single logical switch to STP (Correct answer)
- Only the VSX active peer participates in MSTP
- MSTP is disabled on VSX pairs by default
Correct answer: VSX synchronizes MSTP state so both peers appear as a single logical switch to STP
VSX synchronizes MSTP across both peers, presenting a single bridge identity to the network to prevent loops and ensure consistent STP topology.
ACSP Network Security & Traffic Management 5
An Aruba CX switch administrator needs to prioritize voice traffic end-to-end.
At the ingress access port, which action should be taken to trust the phone's DSCP markings?