ACP Security and Access Control 2 — Questions and Answers
Question 1: Which Aruba feature allows administrators to dynamically assign users to different VLANs based on their role after authentication?
- User-Based Tunneling
- Dynamic VLAN Assignment (Correct answer)
- Port-Based VLAN Trunking
- Static VLAN Mapping
Correct answer: Dynamic VLAN Assignment
Dynamic VLAN Assignment uses RADIUS attributes to place authenticated users into the appropriate VLAN based on their role or group membership.
Question 2: In Aruba ClearPass, what is the purpose of the 'Enforcement Policy'?
- To define which users are allowed to register devices
- To map authentication results to specific access privileges or enforcement profiles (Correct answer)
- To configure RADIUS server timeout values
- To schedule certificate renewal tasks
Correct answer: To map authentication results to specific access privileges or enforcement profiles
An Enforcement Policy in ClearPass maps the outcome of authentication and authorization checks to Enforcement Profiles that define the actual access control actions.
Question 3: Which port is used by RADIUS for authentication requests by default?
- UDP 1812 (Correct answer)
- UDP 1645
- TCP 1812
- UDP 1813
Correct answer: UDP 1812
RADIUS authentication uses UDP port 1812 per RFC 2865, though legacy implementations may use 1645.
Question 4: What does the Aruba Mobility Controller use 'user roles' for?
- Grouping APs by physical location
- Applying firewall policies, bandwidth limits, and session ACLs to authenticated wireless users (Correct answer)
- Managing administrator login credentials
- Defining SSID broadcast schedules
Correct answer: Applying firewall policies, bandwidth limits, and session ACLs to authenticated wireless users
User roles on Aruba Mobility Controllers bind a set of policies—firewall rules, QoS, and session attributes—to users after they authenticate.
Question 5: Which EAP method uses a server-side certificate and a client-side certificate for mutual authentication?
- EAP-PEAP
- EAP-TTLS
- EAP-TLS (Correct answer)
- EAP-MD5
Correct answer: EAP-TLS
EAP-TLS requires both the server and the client to present X.509 certificates, providing the strongest form of mutual authentication.
Question 6: In Aruba's Zero Trust security model, which principle ensures that a user's access is continuously verified rather than trusted after initial login?
- Implicit Trust
- Perimeter Defense
- Continuous Authentication and Authorization (Correct answer)
- Static ACL Enforcement
Correct answer: Continuous Authentication and Authorization
Zero Trust requires continuous verification of identity and device posture throughout a session, not just at initial authentication.
Question 7: What is the role of a 'downloadable ACL' (dACL) in an Aruba 802.1X deployment?
- It pre-loads ACL rules into the switch before any authentication occurs
- It allows the RADIUS server to push per-user ACL rules to the network device after authentication (Correct answer)
- It stores ACL configurations locally on each AP
- It downloads ACLs from a cloud portal on a nightly schedule
Correct answer: It allows the RADIUS server to push per-user ACL rules to the network device after authentication
A dACL is sent by the RADIUS server as a RADIUS attribute during authentication, letting the network device apply user-specific access rules without static pre-configuration.
ACP Security and Access Control 2
Which Aruba feature allows administrators to dynamically assign users to different VLANs based on their role after authentication?