ACSP Switch Security Features 4 — Questions and Answers
Question 1: What is the role of Root Guard in ArubaOS-CX Spanning Tree security?
- Prevent a connected switch from becoming the STP root bridge (Correct answer)
- Block all BPDUs on an edge port
- Enable rapid convergence on access ports
- Restrict trunk formation on unauthorized ports
Correct answer: Prevent a connected switch from becoming the STP root bridge
Root Guard places a port in root-inconsistent state if it receives a superior BPDU, preventing external devices from taking over the root bridge role.
Question 2: Which ArubaOS-CX MAC authentication method allows a device that fails 802.1X to fall back to authenticating by its MAC address?
- MAC Authentication Bypass (MAB) (Correct answer)
- Multi-domain authentication
- Guest VLAN assignment
- Critical authentication
Correct answer: MAC Authentication Bypass (MAB)
MAC Authentication Bypass (MAB) allows non-802.1X-capable devices to authenticate using their MAC address as both the username and password sent to RADIUS.
Question 3: In ArubaOS-CX, what is a 'critical authentication VLAN' used for in 802.1X deployments?
- Place clients in a designated VLAN when the RADIUS server is unreachable (Correct answer)
- Provide elevated access to administrators during outages
- Isolate unauthenticated clients from all other traffic
- Authenticate clients using a local database when RADIUS fails
Correct answer: Place clients in a designated VLAN when the RADIUS server is unreachable
The critical authentication VLAN ensures that when the RADIUS server is down, clients are placed in a predefined VLAN allowing limited access rather than being denied completely.
Question 4: Which ArubaOS-CX feature prevents unauthorized devices from connecting to a switch port by storing specific allowed MAC addresses?
- Sticky MAC (port security with sticky learning) (Correct answer)
- Dynamic ARP Inspection
- 802.1X multi-host mode
- DHCP snooping rate limiting
Correct answer: Sticky MAC (port security with sticky learning)
Sticky MAC learning allows port security to dynamically learn and permanently save MAC addresses to the running configuration, locking those addresses to the port.
Question 5: What does the ArubaOS-CX 'auth-priority' setting control in port-access configurations?
- The order in which authentication methods (802.1X, MAB) are attempted (Correct answer)
- The VLAN priority assigned after authentication
- The RADIUS server selection order
- The CoS value applied to authenticated traffic
Correct answer: The order in which authentication methods (802.1X, MAB) are attempted
Auth-priority defines the sequence in which authentication methods are tried on a port, such as trying 802.1X first and falling back to MAB if it times out.
Question 6: Which security feature on ArubaOS-CX switches monitors and rate-limits control plane traffic to protect the switch CPU?
- Control Plane Policing (CoPP) (Correct answer)
- Access Control Lists (ACL)
- Port security violation rate-limiting
- DHCP snooping rate limiting
Correct answer: Control Plane Policing (CoPP)
Control Plane Policing (CoPP) protects the switch CPU from DoS attacks by rate-limiting or dropping excessive control plane traffic destined for the CPU.
Question 7: In ArubaOS-CX, what is the purpose of configuring a 'guest VLAN' in 802.1X port-access settings?
- Provide limited network access to clients that do not respond to 802.1X EAP requests (Correct answer)
- Isolate guest users who fail authentication
- Allow unauthenticated traffic while authentication is in progress
- Assign a VLAN to clients that fail RADIUS authentication
Correct answer: Provide limited network access to clients that do not respond to 802.1X EAP requests
The guest VLAN places clients that send no EAP response (non-802.1X-capable devices) into a restricted VLAN with limited network access.
ACSP Switch Security Features 4
What is the role of Root Guard in ArubaOS-CX Spanning Tree security?