ACSP Switch Security Features 3

Question 1

What is the function of DHCP snooping on an ArubaOS-CX switch?

Accepted Answer

Filter rogue DHCP server responses on untrusted ports

Answer

DHCP snooping validates DHCP messages and drops DHCP server responses (OFFER/ACK) arriving on untrusted ports, preventing rogue DHCP servers.

Question 2

Which type of port should be configured as 'trusted' in a DHCP snooping deployment?

Accepted Answer

The uplink port connected to the legitimate DHCP server

Answer

Uplink ports toward the legitimate DHCP server must be trusted so DHCP server responses are allowed; all other ports default to untrusted.

Question 3

What does Dynamic ARP Inspection (DAI) use to validate ARP packets on ArubaOS-CX switches?

Accepted Answer

The DHCP snooping binding database

Answer

DAI checks ARP packets against the DHCP snooping binding table to verify that IP-to-MAC mappings are legitimate before forwarding.

Question 4

On an ArubaOS-CX switch, which ports are exempt from DAI validation by default?

Accepted Answer

Trusted ports

Answer

DAI trusted ports (typically uplinks) bypass ARP inspection, while all untrusted ports have their ARP packets validated against the binding database.

Question 5

What is the purpose of IP Source Guard (IPSG) on ArubaOS-CX switches?

Accepted Answer

Prevent IP spoofing by validating source IP against the DHCP snooping binding table

Answer

IP Source Guard filters traffic on untrusted ports, dropping frames whose source IP does not match the IP-MAC-port binding in the DHCP snooping table.

(ACSP) Aruba Certified Switching Professional Practice Test

(ACSP) Aruba Certified Switching Professional Practice Test

ACSP Switch Security Features 3