ACSP Switch Security Features 3 — Questions and Answers
Question 1: What is the function of DHCP snooping on an ArubaOS-CX switch?
- Filter rogue DHCP server responses on untrusted ports (Correct answer)
- Encrypt DHCP traffic between client and server
- Rate-limit DHCP requests to prevent DoS attacks only
- Log all DHCP transactions to syslog
Correct answer: Filter rogue DHCP server responses on untrusted ports
DHCP snooping validates DHCP messages and drops DHCP server responses (OFFER/ACK) arriving on untrusted ports, preventing rogue DHCP servers.
Question 2: Which type of port should be configured as 'trusted' in a DHCP snooping deployment?
- The uplink port connected to the legitimate DHCP server (Correct answer)
- All access ports connecting to end users
- All ports in the management VLAN
- Ports with port security enabled
Correct answer: The uplink port connected to the legitimate DHCP server
Uplink ports toward the legitimate DHCP server must be trusted so DHCP server responses are allowed; all other ports default to untrusted.
Question 3: What does Dynamic ARP Inspection (DAI) use to validate ARP packets on ArubaOS-CX switches?
- The DHCP snooping binding database (Correct answer)
- The MAC address table
- Static ARP entries configured on the switch
- 802.1X authentication state
Correct answer: The DHCP snooping binding database
DAI checks ARP packets against the DHCP snooping binding table to verify that IP-to-MAC mappings are legitimate before forwarding.
Question 4: On an ArubaOS-CX switch, which ports are exempt from DAI validation by default?
- Trusted ports (Correct answer)
- Ports with port security enabled
- Trunk ports only
- Ports in the default VLAN
Correct answer: Trusted ports
DAI trusted ports (typically uplinks) bypass ARP inspection, while all untrusted ports have their ARP packets validated against the binding database.
Question 5: What is the purpose of IP Source Guard (IPSG) on ArubaOS-CX switches?
- Prevent IP spoofing by validating source IP against the DHCP snooping binding table (Correct answer)
- Block unauthorized IP addresses from being assigned by DHCP
- Encrypt IP packets on untrusted ports
- Prevent IP address conflicts in the same subnet
Correct answer: Prevent IP spoofing by validating source IP against the DHCP snooping binding table
IP Source Guard filters traffic on untrusted ports, dropping frames whose source IP does not match the IP-MAC-port binding in the DHCP snooping table.
Question 6: Which ArubaOS-CX feature can detect and disable ports receiving their own BPDUs (indicating a potential loop or rogue switch)?
- BPDU Guard (Correct answer)
- Root Guard
- Loop Guard
- BPDU Filter
Correct answer: BPDU Guard
BPDU Guard err-disables a port configured as an edge port when it receives any BPDU, protecting against rogue switches being connected to access ports.
Question 7: What is the difference between BPDU Guard and BPDU Filter on ArubaOS-CX switches?
- BPDU Guard disables the port on receipt; BPDU Filter silently drops BPDUs in both directions (Correct answer)
- BPDU Guard drops inbound BPDUs; BPDU Filter drops outbound BPDUs only
- BPDU Guard logs violations; BPDU Filter shuts the port down
- BPDU Guard is for access ports; BPDU Filter is for trunk ports only
Correct answer: BPDU Guard disables the port on receipt; BPDU Filter silently drops BPDUs in both directions
BPDU Guard err-disables the port if any BPDU is received, while BPDU Filter suppresses sending and receiving BPDUs without shutting down the port.
ACSP Switch Security Features 3
What is the function of DHCP snooping on an ArubaOS-CX switch?