ACSP Switch Security Features 5 — Questions and Answers
Question 1: What does the ArubaOS-CX 'port-access authenticator' command with 'reauthenticate' enforce?
- Clients must re-authenticate after a configured time interval (Correct answer)
- All ports must re-authenticate simultaneously after a reboot
- RADIUS must re-validate credentials on every frame
- Clients must re-authenticate when their IP address changes
Correct answer: Clients must re-authenticate after a configured time interval
The reauthentication timer forces clients to periodically re-authenticate with the RADIUS server, ensuring continued authorization validity.
Question 2: Which ArubaOS-CX feature allows a downloadable ACL (dACL) to be applied to a port after successful 802.1X authentication?
- RADIUS-assigned ACL via Filter-Id or Aruba VSA (Correct answer)
- Dynamic ARP Inspection policy
- Port security ACL binding
- Local authorization policy
Correct answer: RADIUS-assigned ACL via Filter-Id or Aruba VSA
After 802.1X authentication, RADIUS can return a Filter-Id or Aruba VSA attribute containing an ACL name, which the switch applies to the authenticated port.
Question 3: What is the effect of enabling 'loop protection' on an ArubaOS-CX access port?
- Detect and disable ports that create Layer 2 loops by sending probe frames (Correct answer)
- Block all BPDU traffic on the port
- Prevent VLAN loops by disabling trunk negotiation
- Shut down the port if STP topology changes occur
Correct answer: Detect and disable ports that create Layer 2 loops by sending probe frames
Loop protection sends probe frames and disables a port if it receives its own probes back, detecting loops even on ports where STP BPDUs are filtered.
Question 4: In ArubaOS-CX, which command applies a previously defined user-role to an authenticated port-access session?
- aaa authentication port-access dot1x authenticator role (Correct answer)
- port-access role apply
- user-role assign port
- aaa authorization user-role
Correct answer: aaa authentication port-access dot1x authenticator role
User-roles in ArubaOS-CX define access policies (ACLs, QoS, VLAN) that can be assigned dynamically to ports after 802.1X or MAB authentication.
Question 5: Which ArubaOS-CX switch security feature prevents rogue devices from sending gratuitous ARP replies to poison ARP caches?
- Dynamic ARP Inspection (DAI) (Correct answer)
- IP Source Guard
- DHCP snooping
- Port security
Correct answer: Dynamic ARP Inspection (DAI)
DAI validates all ARP packets including gratuitous ARPs against the DHCP snooping binding table, dropping those with mismatched IP-to-MAC bindings.
Question 6: What is the recommended ArubaOS-CX configuration to secure the management access interface against brute force login attacks?
- Configure login delay and maximum login attempts with lockout (Correct answer)
- Enable DHCP snooping on the management VLAN
- Apply a VLAN ACL to the management interface
- Enable 802.1X on the management port
Correct answer: Configure login delay and maximum login attempts with lockout
Configuring login delay and lockout thresholds (maximum failed attempts before lockout) directly mitigates brute force attacks on management interfaces.
Question 7: On ArubaOS-CX, which feature ensures that only traffic from authenticated clients is forwarded while traffic from unauthenticated clients is dropped or redirected?
- Port-access authentication with client roles (Correct answer)
- Private VLAN isolation
- MAC-based VLAN assignment
- DHCP snooping trusted port configuration
Correct answer: Port-access authentication with client roles
Port-access authentication with client roles enforces that unauthenticated clients have no forwarding access or are placed in a restricted VLAN until they complete authentication.
ACSP Switch Security Features 5
What does the ArubaOS-CX 'port-access authenticator' command with 'reauthenticate' enforce?