ACMA Mobility Solutions 4 — Questions and Answers
Question 1: Which Aruba feature provides automated RF neighbor list management to improve 802.11k roaming assistance?
- AirMatch
- Neighbor AP Discovery
- ARM (Adaptive Radio Management) (Correct answer)
- Band Steering
Correct answer: ARM (Adaptive Radio Management)
ARM (Adaptive Radio Management) manages transmit power, channel selection, and also coordinates neighbor reports used in 802.11k roaming optimization.
Question 2: In Aruba's Mobility Controller architecture, what is the purpose of a 'mobility domain'?
- A security zone for guest traffic
- A group of controllers that share roaming context so clients roam without re-authentication (Correct answer)
- A VLAN segmentation boundary
- A geographic region for regional management
Correct answer: A group of controllers that share roaming context so clients roam without re-authentication
A mobility domain groups Aruba controllers together so that client roaming context (keys, IP address) is shared, enabling seamless Layer 2 and Layer 3 roaming.
Question 3: What Aruba solution is specifically designed to detect and contain rogue APs on the network?
- AirMatch
- RFProtect (Correct answer)
- AppRF
- ClientMatch
Correct answer: RFProtect
RFProtect is Aruba's WIDS/WIPS solution that detects, classifies, and contains rogue APs and wireless threats.
Question 4: Which authentication method does WPA3-Personal use to replace the traditional PSK handshake and resist offline dictionary attacks?
- PEAP
- SAE (Simultaneous Authentication of Equals) (Correct answer)
- EAP-TLS
- TKIP
Correct answer: SAE (Simultaneous Authentication of Equals)
WPA3-Personal replaces PSK with SAE, a password-authenticated key exchange that prevents offline dictionary attacks even if the handshake is captured.
Question 5: In Aruba, what does 'tunnel mode' for an AP's SSID mean for client traffic?
- Client traffic is encrypted with WPA2 only
- Client traffic is encapsulated and forwarded to the Mobility Controller for processing (Correct answer)
- Client traffic is bridged directly to the local wired VLAN
- Client traffic bypasses the firewall
Correct answer: Client traffic is encapsulated and forwarded to the Mobility Controller for processing
In tunnel mode, all client traffic is encapsulated (via GRE or CAPWAP) and sent to the Mobility Controller, which applies firewall policies and forwards it appropriately.
Question 6: What Aruba feature allows administrators to set per-user or per-role bandwidth contracts?
- QoS DSCP marking
- Bandwidth Contracts (Correct answer)
- AppRF traffic shaping
- WMM prioritization
Correct answer: Bandwidth Contracts
Aruba Bandwidth Contracts define upstream and downstream rate limits that are applied per-user or per-role directly on the Mobility Controller.
Question 7: Which layer does Aruba Dynamic Segmentation operate at to enforce policy on wired clients connected to Aruba switches?
- Layer 1 (Physical)
- Layer 2 (Data Link)
- Layer 3 (Network) via the Mobility Controller (Correct answer)
- Layer 7 (Application) using DPI only
Correct answer: Layer 3 (Network) via the Mobility Controller
Dynamic Segmentation tunnels wired client traffic to the Mobility Controller, which enforces Layer 3 user-role policies regardless of the client's physical port.
ACMA Mobility Solutions 4
Which Aruba feature provides automated RF neighbor list management to improve 802.11k roaming assistance?