ACSP Access Control Lists (ACLs) 2 — Questions and Answers
Question 1: On an Aruba switch, which ACL type can match traffic based on both source and destination MAC addresses?
- Extended IP ACL
- Standard IP ACL
- Extended MAC ACL (Correct answer)
- VLAN ACL
Correct answer: Extended MAC ACL
Extended MAC ACLs on Aruba switches allow matching on both source and destination MAC addresses, EtherType, and VLAN.
Question 2: When applying an ACL to a VLAN interface on an Aruba switch, what does the 'in' direction filter?
- Traffic leaving the VLAN
- Traffic entering the switch from hosts in that VLAN (Correct answer)
- Traffic between VLANs only
- Traffic from the uplink port only
Correct answer: Traffic entering the switch from hosts in that VLAN
Applying an ACL 'in' on a VLAN interface filters traffic as it ingresses from hosts in that VLAN toward the switch.
Question 3: An administrator wants to permit SSH (port 22) from a management subnet 10.0.0.0/24 only. Which ACL entry accomplishes this?
- permit tcp 10.0.0.0/24 any eq 22 (Correct answer)
- permit ip 10.0.0.0/24 any
- permit tcp any 10.0.0.0/24 eq 22
- permit udp 10.0.0.0/24 any eq 22
Correct answer: permit tcp 10.0.0.0/24 any eq 22
SSH uses TCP port 22; permitting tcp from the source subnet to any destination on port 22 correctly scopes the rule.
Question 4: In Aruba AOS-Switch ACL processing, what happens to a packet that does not match any explicit ACE?
- It is forwarded with a log entry
- It is rate-limited
- It is dropped by the implicit deny all (Correct answer)
- It is sent to the CPU for inspection
Correct answer: It is dropped by the implicit deny all
All Aruba switch ACLs end with an implicit 'deny any' that drops packets not matching any configured ACE.
Question 5: Which command on an Aruba AOS-Switch shows how many packets have matched each ACE in an ACL named 'BLOCK_WEB'?
- show access-list BLOCK_WEB statistics (Correct answer)
- show ip access-list BLOCK_WEB counters
- show access-list resources BLOCK_WEB
- debug acl BLOCK_WEB hits
Correct answer: show access-list BLOCK_WEB statistics
The 'show access-list <name> statistics' command displays per-ACE hit counters for traffic matching that ACL.
Question 6: A named ACL on an Aruba switch is applied to port 1/1 inbound. The ACL permits ICMP but has no other permit statements. What happens to TCP traffic arriving on port 1/1?
- TCP traffic is forwarded normally
- TCP traffic is rate-limited to 1 Mbps
- TCP traffic is dropped by the implicit deny (Correct answer)
- TCP traffic is redirected to VLAN 1
Correct answer: TCP traffic is dropped by the implicit deny
Only ICMP is explicitly permitted; all other protocols including TCP are dropped by the implicit deny all at the end of the ACL.
Question 7: When configuring a mirror (SPAN) ACL on an Aruba switch, what is the primary purpose of the 'mirror' action keyword?
- Block and copy traffic to a CPU port
- Copy matching traffic to a designated mirror port without dropping the original (Correct answer)
- Redirect traffic to a sniffer VLAN only
- Rate-limit and log the mirrored traffic
Correct answer: Copy matching traffic to a designated mirror port without dropping the original
The 'mirror' action copies matched packets to a configured mirror port while allowing the original traffic to continue forwarding.
ACSP Access Control Lists (ACLs) 2
On an Aruba switch, which ACL type can match traffic based on both source and destination MAC addresses?