ACSP Switch Security Features 2 — Questions and Answers
Question 1: Which ArubaOS-CX feature limits the number of MAC addresses learned on a port to prevent MAC flooding attacks?
- Port security (Correct answer)
- Dynamic ARP Inspection
- IP Source Guard
- DHCP snooping
Correct answer: Port security
Port security restricts the number of MAC addresses allowed on a switch port, mitigating MAC flooding attacks that overflow the CAM table.
Question 2: On an ArubaOS-CX switch, what action does port security take by default when a violation is detected?
- Shutdown the port (Correct answer)
- Send an SNMP trap only
- Drop the offending frame silently
- Generate a syslog alert only
Correct answer: Shutdown the port
The default port security violation action is to shut down the port (err-disable state), requiring manual intervention to restore connectivity.
Question 3: What is the primary purpose of 802.1X port-based authentication on ArubaOS-CX switches?
- Authenticate devices before granting network access (Correct answer)
- Encrypt all frames traversing the port
- Prevent VLAN hopping attacks
- Limit broadcast domain size
Correct answer: Authenticate devices before granting network access
802.1X enforces authentication via EAP between a supplicant, authenticator (switch), and authentication server before allowing network access.
Question 4: In an ArubaOS-CX 802.1X deployment, which role does the switch play?
- Authenticator (Correct answer)
- Supplicant
- Authentication server
- Certificate authority
Correct answer: Authenticator
The switch acts as the authenticator, relaying EAP messages between the supplicant (client device) and the RADIUS authentication server.
Question 5: Which ArubaOS-CX feature assigns a VLAN dynamically based on RADIUS-returned attributes after 802.1X authentication?
- Dynamic VLAN assignment (Correct answer)
- Voice VLAN
- Private VLAN
- VLAN translation
Correct answer: Dynamic VLAN assignment
Dynamic VLAN assignment uses RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) to place authenticated clients into the correct VLAN.
Question 6: What does the 'auth-mode' setting 'multi-auth' allow in ArubaOS-CX 802.1X configurations?
- Multiple devices to authenticate independently on the same port (Correct answer)
- A single device to use multiple authentication methods simultaneously
- RADIUS and TACACS+ to be used together
- Authentication bypass for trusted MACs
Correct answer: Multiple devices to authenticate independently on the same port
Multi-auth mode allows each device connected through a hub or unmanaged switch to authenticate independently, each receiving its own VLAN assignment.
Question 7: Which command enables 802.1X globally on an ArubaOS-CX switch?
- aaa authentication port-access dot1x authenticator (Correct answer)
- dot1x system-auth-control
- aaa dot1x enable global
- port-access authenticator enable
Correct answer: aaa authentication port-access dot1x authenticator
The 'aaa authentication port-access dot1x authenticator' command enables 802.1X authentication globally in ArubaOS-CX.
ACSP Switch Security Features 2
Which ArubaOS-CX feature limits the number of MAC addresses learned on a port to prevent MAC flooding attacks?