ACSP Switch Security Features 5

Question 1

What does the ArubaOS-CX 'port-access authenticator' command with 'reauthenticate' enforce?

Accepted Answer

Clients must re-authenticate after a configured time interval

Answer

The reauthentication timer forces clients to periodically re-authenticate with the RADIUS server, ensuring continued authorization validity.

Question 2

Which ArubaOS-CX feature allows a downloadable ACL (dACL) to be applied to a port after successful 802.1X authentication?

Accepted Answer

RADIUS-assigned ACL via Filter-Id or Aruba VSA

Answer

After 802.1X authentication, RADIUS can return a Filter-Id or Aruba VSA attribute containing an ACL name, which the switch applies to the authenticated port.

Question 3

What is the effect of enabling 'loop protection' on an ArubaOS-CX access port?

Accepted Answer

Detect and disable ports that create Layer 2 loops by sending probe frames

Answer

Loop protection sends probe frames and disables a port if it receives its own probes back, detecting loops even on ports where STP BPDUs are filtered.

Question 4

In ArubaOS-CX, which command applies a previously defined user-role to an authenticated port-access session?

Accepted Answer

aaa authentication port-access dot1x authenticator role

Answer

User-roles in ArubaOS-CX define access policies (ACLs, QoS, VLAN) that can be assigned dynamically to ports after 802.1X or MAB authentication.

Question 5

Which ArubaOS-CX switch security feature prevents rogue devices from sending gratuitous ARP replies to poison ARP caches?

Accepted Answer

Dynamic ARP Inspection (DAI)

Answer

DAI validates all ARP packets including gratuitous ARPs against the DHCP snooping binding table, dropping those with mismatched IP-to-MAC bindings.

(ACSP) Aruba Certified Switching Professional Practice Test

(ACSP) Aruba Certified Switching Professional Practice Test

ACSP Switch Security Features 5