ACMP_6.4

Transcription

1 ACMP_6.4 Passing Score: 800 Time Limit: 0 min

2 Exam A QUESTION 1 When creating a firewall rule what are valid choices for the Service/Application field? (Choose three) A. Applications B. Applications Category C. Internet Protocol D. Internet Category E. Protocol Correct Answer: ABE /Reference: : NAT QUESTION 2 The Aruba Policy Enforcement Firewall (PEF-NG) module supports destination network address translation (dst-nat). Which is the default use of this statement in an Aruba controller configuration? A. source the IP addresses of users to specific IP address B. redirect HTTP sessions to Captive Portal C. redirect Access Points to another Aruba controller D. provide a telnet connection to the controller E. redirect a SSH session to terminate on the controller Correct Answer: B

3 /Reference: QUESTION 3 The Aruba Policy Enforcement Firewall (PEF) module supports source network address translation (src-nat). Which is a use of this statement in an Aruba configuration? A. provide a single source IP address for users in a role B. redirect Captive Portal HTTP sessions C. redirect Access Points to another Aruba controller D. provide IP addresses to clients E. redirects clients to Aruba Firewall Correct Answer: A /Reference: : Policy Interpretation QUESTION 4 Review the following truncated output from an Aruba controller for this item. (example) #show rights logon access-list List Position Name Location logon-control 2 captiveportal logon-control Priority Source Destination Service Action user any udp 68 deny 2 any any svc-icmp permit 3 any any svc-dns permit 4 any any svc-dhcp permit 5 any any svc-natt permit captiveportal

4 Priority Source Destination Service Action user controller svc-https dst-nat user any svc-http dst-nat user any svc-https dst-nat user any svc-http-proxy1 dst-nat user any svc-http-proxy2 dst-nat user any svc-http-proxy3 dst-nat 8088 Based on the above output from an Aruba controller, an unauthenticated user assigned to the logon role attempts to start an http session to IP address What will happen? A. the user's traffic will be passed to the IP address because of the policy statement:user any svc-http dst-nat 8080 B. the user's traffic will be passed to the IP address because of the policy statement:user any svc-https dst-nat 8081 C. the user's traffic will be passed to the IP address because of the policy statement:user any svc-http-proxy1 dst-nat 8088 D. the user will not reach the IP address because of the policy statement:user any svc-http dst-nat 8080 E. the user will not reach the IP address because of the implicit deny any any at the end of the policy. Correct Answer: D /Reference: QUESTION 5 Refer to the following configuration segment for this item. ip access-list session anewone user network any permit user host any deny user any any permit An administrator wants users to have access to all destinations except Based on the above Aruba Mobility Controller configuration segment, which statements best describe this policy? (Choose two) A. The rule user host any deny is redundant because of the implicit deny all at the end. B. The rule user network any permit is redundant. C. The two rules user network any permit and user host any deny need to be re-sequenced. D. The last statement user any any permit is not required E. The last statement should be any any any deny

5 Correct Answer: BC /Reference: QUESTION 6 Refer to the following configuration segment for this item. netdestination "internal" no invert network position 1 range position 2! ip access-list session "My-Policy" alias "user" alias "internal" service_any permit queue low! A user frame is evaluated against this firewall policy with the following attributes: Source IP: Destination IP: Destination Port: 80 Referring to the above file segment, how will the frame be handled by this firewall policy? A. The frame will be dropped because of the implicit deny all at the end of the netdestination definition. B. The frame will be dropped because of the implicit deny all at the end of the firewall policy. C. The frame will be forwarded because of the implicit permit all at the end of the firewall policy. D. The frame will be passed because there is no service specified in the firewall policy. E. The frame will be dropped because there is no service specified in the firewall policy. Correct Answer: B /Reference: QUESTION 7 ip access-list session anewone user network any permit user any any permit host host any deny A user sends a frame with the following attributes: Source IP: Destination IP: Destination Port: 25

6 Based on the above Mobility Controller configuration file segment, what will this policy do with the user frame? A. The frame is discarded because of the implicit deny all at the end of the policy. B. The frame is discarded because of the statement:user host host deny. C. The frame is accepted because of the statement:user any any permit. D. The frame is accepted because of the statement:user network any permit. E. This is not a valid policy. Correct Answer: C /Reference: QUESTION 8 ip access-list session anewone user network any permit user host any deny user any any permit Referring to the above portion of a Mobility Controller configuration file, what can you conclude? (Choose two) A. This is a session firewall policy. B. This is an extended Access Control List (ACL). C. Any traffic going to destination will be denied. D. Any traffic going to destination will be denied. E. Any traffic going to destination will be permitted. Correct Answer: AE /Reference:

7 QUESTION 9 The screen captures above show the 802.1X authentication profile and AAA profile settings for a VAP. If machine authentication fails and user authentication passes, which role will be assigned? A. employee B. guest C. denyall D. logon E. no role is assigned Correct Answer: B /Reference: QUESTION 10 The screen captures above show the 802.1X authentication profile and AAA profile settings for a VAP. If machine authentication passes and user authentication fails, which role will be assigned? A. employee B. denyall C. guest D. logon E. no role is assigned Correct Answer: B /Reference: QUESTION 11 The screen captures above show the 802.1X authentication profile and AAA profile settings for a VAP. If machine authentication fails and user authentication fails, which role will be assigned?

8 A. employee B. guest C. Captive Portal D. Logon E. no role will be assigned Correct Answer: E /Reference: : Configuration Wizards QUESTION 12 What can NOT be configured from the Aruba controller configuration wizards? A. Controller IP B. Boot Partition C. User firewall policy. D. User derivation rules. E. Radius Servers Correct Answer: B /Reference: QUESTION 13 An administrator is setting up a factory default controller. No new AP groups were created. When adding a WLAN SSID in the Campus WLAN wizard what AP group is available? A. The air-monitors AP group B. The logon AP group C. The default AP group D. The initial AP group E. The Spectrum AP group

9 Correct Answer: C /Reference: QUESTION 14 The reusable Aruba Controller wizards are accessible in what way? A. Only on startup through the CLI B. Through the CLI, after the initial CLI wizard has been completed C. In the Web UI under maintenance. D. In the Web UI under configuration. E. Must be initialized from CLI first. Correct Answer: D /Reference: QUESTION 15 The Controller wizard enables which of the following controller clock configurations?(choose three) A. NTP to a time server B. Set time zone C. Daylight savings time D. Only GMT can be configured E. Manual configuration of date and time Correct Answer: ABE /Reference:

10 QUESTION 16 When configuring ports in the Controller wizard, which of the following are NOT configuration options?(choose two) A. Inter-VLAN routing B. Speed C. Trusted D. LACP E. Trunk Correct Answer: AD /Reference: : Management QUESTION 17 By default, which CLI based remote access method is enabled on Aruba controllers? A. RSH B. Telnet C. SSH D. Telnet and SSH E. Telnet, SSH and RSH Correct Answer: C /Reference:

11 QUESTION 18 An Aruba controller can be accessed with which CLI based remote access methods?(choose two) A. RSH B. Telnet C. SSH D. SFTP E. SCP Correct Answer: BC /Reference: QUESTION 19 As an admin/root user, what other type of role-based management users can be created on Aruba controllers? A. Auditing-compliance user B. AirWave management user C. Reporting Generation user D. Guest provisioning user E. Maintenance user Correct Answer: D /Reference: QUESTION 20 Which log type should be enabled to troubleshoot IPSec authentication issues on Aruba Controllers? A. Security Logs B. Management Logs C. Wireless Logs

12 D. IDS Logs E. System Logs Correct Answer: A /Reference: QUESTION 21 Referring to the above screen capture, if an administrator desires to change a specific AP into a Spectrum Monitor without assigning the AP to a new group, which menus could be used? A. Network > Controller B. Wireless > AP Configuration C. Wireless > AP Installation D. Advanced Services > Wireless E. Wizards > WIP Wizard Correct Answer: B /Reference: QUESTION 22 A customer forgot all passwords for a controller. What method could you use to reset the passwords? A. Telnet to the controller and login to the password recovery account B. SSH to the controller and login to the password recovery account C. Connect directly to the serial console and login to the password recovery account D. Interrupt the boot process at CP-boot and select password recovery E. Open the controller and press the reset switch Correct Answer: C

13 /Reference: : Roaming QUESTION 23 With CPSec disabled, which tunnel protocol is used between APs and Controllers in an Aruba environment? A. Basic IP B. GRE C. IPinIP D. Mobile IP E. IPSec Correct Answer: B /Reference: QUESTION 24 In an Aruba controller based system, the L3 mobility tunnel exists between the home agent and which other element? A. the default gateway B. the remote AP C. the foreign agent D. the mobile node E. the foreign switch Correct Answer: C /Reference: QUESTION 25 When an client roams what device decides when to move the client to another AP?

14 A. Aruba AP B. Aruba controller C. Client D. Radius Server E. Router Correct Answer: C /Reference: QUESTION 26 The above diagram has one master and three local controllers. AP1 GRE terminates on controller Local 1. All controllers are configured with the wireless user VLAN 201. A wireless user associates with AP 1. Only L2 mobility is enabled. Which elements will know about this association? A. Local 1 only B. Local 1 and the Master C. Local 1 and Local 2 and the Master D. Local 1 and AP1 E. All Controllers Correct Answer: B /Reference: QUESTION 27 Which command will show all client association history?

15 A. show mobile trail current (ip address) B. show ip mobile trail (ip address) C. show ap client status (mac address) D. show current client ip (ip address) E. show client ip (ip address) mobility Correct Answer: B /Reference: QUESTION 28 With CPSec enabled, which tunnel protocol is used between APs and Controllers in an Aruba environment? A. EAP B. SSH C. IPinIP D. Mobile IP E. IPSec Correct Answer: E /Reference: QUESTION 29 A client Roams from one Local controller-1 to another Local controller-2. The controllers are in different subnets and L3 Mobility is enabled. How is the client traffic sent back to Local-controller-1? A. IP-IP tunneled B. FTP C. Multicast D. L2 GRE Tunnel E. Routed locally

16 Correct Answer: D /Reference: QUESTION 30 A network needs to implement L3 roaming. On the Master Controller, the administrator, enabled IP mobility, created a Domain and created the HAT table with all the IP addresses of the local controllers. He then enabled Mobility on the VAPs. The configuration was then saved. L3 Mobility is still not working, what could be the cause? (Choose two) A. IP Mobility must be enabled on all controllers. B. IP-IP tunnels must be configured between controllers. C. The Domain must activated on each controller. D. The HAT table must be configured on each controller. E. The HAT table must be configured with each controllers supported subnets. Correct Answer: AC /Reference: : RF Management QUESTION 31 By default, how long will an AP scan a single channel when ARM is enabled? A. 80 milliseconds B. 90 milliseconds C. 100 milliseconds D. 110 milliseconds E. 200 milliseconds Correct Answer: D

17 /Reference: QUESTION 32 Which actions does ARM (Adaptive Radio Management) perform? (Choose two) A. allows controllers to provision the AP Radio type B. allows controllers to provision the best channel for APs C. allows controllers to provision the best power setting for APs D. allows controllers to provision allowed Radio bands E. allows controllers to provision lower power when unauthorized APs are detected Correct Answer: BC /Reference: QUESTION 33 Which of the following metrics does the ARM feature use to calculate the optimal channel and power level for Access Points? (Choose two) A. RF Spectrum Index B. Priority Index C. Interference Index D. Coverage Index E. Frequency Index Correct Answer: CD /Reference: QUESTION 34 How does the ARM Band Steering feature encourage 5GHz capable clients to move/connect to the 5GHz radios of Aruba APs? A. ARM suppresses the probe responses on the 2.4 ghz radio?

18 B. ARM utilizes third party software on the wireless clients C. Current Wi-Fi chipset firmware supports this by default D. It's not possible the move clients to 5GHz radios when they can see both 2.4 and 5GHz APs E. ARM disables the 2.4Ghz radio for the specified client Correct Answer: A /Reference: QUESTION 35 Which of the statements below are TRUE regarding ARM's Spectrum Load Balancing feature? (Choose two) A. Available only on 5GHz radios B. Disabled by default C. Balances client load across available channels/aps D. Enabled by default E. Available only on 2.4GHz radios Correct Answer: BC /Reference: QUESTION 36 What is the function of Band Steering? A. Balancing clients across APs on different channels within the same band B. Encourages clients, 5GHz capable, to connect on the 5GHz spectrum

19 C. Coordinate access to the same channel across multiple APs D. Enables selection of 20 vs. 40 MHz mode of operation per band E. Enables acceptable coverage index on both the "b/g" and "a" spectrums Correct Answer: B /Reference: QUESTION 37 What are the Airtime Allocation Policy options for Airtime Fairness? (Choose three) A. Default Access B. Priority Access C. Fair Access D. Preferred Access E. Distributed Access Correct Answer: ACD /Reference: QUESTION 38 Which of the following statements is true of Spectrum Mode? A. No licenses are required to run an AP in Spectrum mode B. Spectrum mode can only be configured for one AP at a time C. An AP can be in spectrum mode for both 2.4 and 5G bands at the same time D. An AP can be placed in Spectrum Mode via the Spectrum Profile E. Spectrum mode can be configured from the GUI under AP installation Correct Answer: C

20 /Reference: QUESTION 39 Which ARM feature addresses the issue of sticky clients by moving clients to associate to APs with better signal quality? A. Co-Channel interference mitigation B. Airtime Fairness C. ClientMatch D. Coordinated access to a single channel E. Band Steering Correct Answer: C /Reference: QUESTION 40 Aruba Client Match does NOT use which of the following parameters to determine the best AP for a client connection? A. Device type B. Location C. Signal to Noise Ratio D. Access Point load E. Spectrum Analysis Correct Answer: E /Reference: QUESTION 41 What is the function of Station Handoff Assist, if enabled?

21 A. Force device to 5Ghz band B. Force device off AP if RSSI is below threshold C. Send message to device to change AP D. Send message to adjoining AP to accept device E. Send message to adjoining AP to initiate association to the device Correct Answer: B /Reference: QUESTION 42 What is true about client match? (Choose two) A. Does Load balancing B. Does Spectrum load balancing C. Does Band Steering/Band Balancing D. Moves higher traffic devices to adjacent APs E. Sends QRT frames to neighbor APs Correct Answer: AC /Reference: : Master/Local QUESTION 43 Which settings cannot be modified directly from a local controller? A. Port VLAN setting B. Switch Time Zone C. Port trusted D. Roles E. SNMP Enable Trap Generation

22 Correct Answer: D /Reference: QUESTION 44 Masters communicate configuration information with locals using which tunnel type? A. GRE B. IP in IP C. Provision Tunnel Protocol D. IPSec E. PPTP Correct Answer: D /Reference: QUESTION 45 In the above screen capture, the administrator notes that most of the configuration options are grayed out and have no action. What is the cause of the problem? A. attempting to make global changes on a Master Controller B. attempting to make global changes on a Local Controller C. this change can only be performed via the CLI D. does not have the correct software license E. there is an error in the configuration Correct Answer: B /Reference: : --

23 QUESTION 46 Referring to the above screen capture, on which Controller can you create a VLAN? A. Controller only B. Controller and only C. All three Controllers D. None of the Controllers E. Controller only Correct Answer: C /Reference: QUESTION 47 Referring to the above screen capture, on which controller can you add an administrative user and assign a controller management role? A. Controller only B. Controller and only C. All three Controllers D. must be done in the RADIUS server E. Controller only Correct Answer: C /Reference:

24 QUESTION 48 Refer to the above screen capture. By default, which controller's internal database will be used for user authentication? A. Controller only B. Controller and only C. All three Controllers D. You can't tell from this screen E. The Controller with the user session Correct Answer: A /Reference: QUESTION 49 Referring to the above screen capture, on which controller can you modify APs configuration to enable ARM? A. Controller only B. Controller and only C. All three Controllers D. None of the Controllers E. On Controllers where ARM is enabled Correct Answer: A /Reference: QUESTION 50 The Master fails with Central Licensing enabled. What happens to the local Controllers? A. Locals continue to operate for 1 day B. Locals operate for 30 days and accept new APs C. Locals continue to operate for 90 days and accepts new APs D. Locals can only use their originally installed Licenses

25 E. Locals will operate with active APs but not will accept any other APs Correct Answer: B /Reference: : Auth and Crypto QUESTION 51 With CPSec disabled, Aruba access points are Layer 3 connected to controllers using which protocol? A q B. LWAPP C. PPTP D. GRE E. HTTPs Correct Answer: D /Reference: QUESTION 52 With CPSec disabled, which encryption protocol does a tunnel mode campus AP's use on client traffic? A. TKIP and AES B. It is provisioned by the Administrator C. WEP and AES D. WEP, TKIP, and AES E. No encryption is used Correct Answer: E

26 /Reference: QUESTION 53 In a campus environment, where are encryption keys sent or stored when users roam between tunneled mode APs on the same controller using 802.1X? A. sent to the new AP via GRE B. sent to the new AP via IPSec C. stored on the controller D. stored on the RADIUS server E. original AP sends keys to new AP Correct Answer: C /Reference: QUESTION 54 In the diagram provided for this question, the wireless user's laptop is associated with an Aruba AP in tunnel forwarding mode. The AP terminates on the local controller. When the client transmits, where will the headers be removed? A. AP B. L2 Switch C. Router D. Local Controller E. Internet Correct Answer: D /Reference: QUESTION 55 When configuring a server group containing 3 servers, a customer Chooses 'fail through mode'. What other configuration option has to be enabled on the controller for this to work with 802.1x authentication?

27 A. Machine authentication B. EAP Termination C. Server group fall through mode D. MAC authentication E. Round robin or top down mode Correct Answer: B /Reference: QUESTION 56 A campus AP has been provisioned with a VAP in bridge forwarding and standard operation modes. Which of the following authentication types are supported? (Choose two) A X authentication B. Open System authentication C. Local authentication D. Captive portal authentication E. VPN authentication Correct Answer: AB /Reference: : AP Provisioning QUESTION 57 Which method is NOT supported to provision an Aruba campus AP? A. Telnet directly to AP B. SSH to the AP's controller C. Web interface to the AP's controller D. Console to AP

28 E. CLI on controller Correct Answer: A /Reference: QUESTION 58 When direct consoled to an AP, what is the command sequence to factory default the AP and re-bootstrap? A. setenv bootstat init B. setenv master init, boot C. purge, save, boot D. init, save, boot E. printenv, purge, boot Correct Answer: C /Reference: QUESTION 59 What settings need to be changed on a factory default AP in order for it to use ADP to discover the Aruba Controller? A. DNS of the controller B. Static route C. AP group D. enable multicast E. no changes needed Correct Answer: E /Reference:

29 : Derivation Rules QUESTION 60 Which of these are NOT a client attribute that can be configured in user derivation rules? A. MAC address B. DHCP option value C. BSSID D. Filter ID E. encryption Correct Answer: D /Reference: QUESTION 61 What are the types of user derivation rules that can be applied to a user?(choose two) A. SSID B. MAC C. VLAN D. Role E. AP Correct Answer: CD /Reference:

30 QUESTION 62 Which is a Device Specific Attribute that can be evaluated in a user derivation rule? A. user login name B. authentication server C. location by AP Name D. controller Loopback address E. controller IP Correct Answer: C /Reference: QUESTION 63 Which match condition can be used by a server derivation rule?(choose two) A. greater than B. less than C. inverse of D. contains E. equals Correct Answer: DE /Reference: QUESTION 64 An administrator wants to assign a VLAN to a user based upon the authentication process using Vendor Specific Attributes (VSA). Where are Aruba Vendor Specific Attribute (VSA) values provisioned? A. controller

31 B. client C. RADIUS server D. Internal user database E. Option 60 of DHCP reply Correct Answer: C /Reference: QUESTION 65 View the Server group screen shot above. A company has provisioned the same VAP, AAA and SSID profiles at both its Miami and NY offices. This Server Group is applied for 802.1x authentication at both locations. The user's credentials are only found in the Miami Radius server "RadiusMiami". There is no Radius synchronization and both servers are reachable. What happens when the user attempts to authenticate? A. The controller recognizes the users Domain and sends the authentication request directly to RadiusMiami. B. The request is initially sent to RadiusNY1 then RadiusNY1 redirects the controller to send the authentication request to RadiusMiami C. RadiusNY1 receives the request and returns a deny. No other action is taken. D. RadiusNY1 receives the request and returns a deny. The authentication request will then be sent to RadiusMiami. E. The RadiusNY1 sends the request to RadiusMiami that replies to the controller Correct Answer: C /Reference: QUESTION 66, View the Server group and User Roles screen shots above. A user associated to an SSID with 802.1x using this server group. RadiusNY returned a standard radius attribute of filter-id with a value of "employee". The user was placed in the guest Role. What statements below are correct?(choose two) A. The user was placed in the 802.1x authentication default Role guest B. The user was placed in the initial Role guest

32 C. Role derivation failed because roles are case sensitive D. Role derivation failed because the incorrect operation "value-of" was used E x authentication failed so the user was automatically placed in the guest Role Correct Answer: AC /Reference: QUESTION 67 A Server Group has been configured with three Radius servers. Load balancing has been enabled. Choose the correct statement? A. All Radius request are sent round robin continuously B. 10 request are sent to first server then 10 to the next server C. Only the first two servers are used and the third is a backup server D. Runs average response times and balances the load accordingly E. To use Load Balancing EAP Termination must be enabled Correct Answer: D /Reference: : Profiles QUESTION 68 Which profiles are required in an AP Group to enable an SSID with VLAN 1, WPA2 and LMSIP?(Choose three) A. Virtual-AP profile B. WLAN profile C x authentication profile D. AP System Profile E. SSID Profile Correct Answer: ADE

33 /Reference: QUESTION 69 A user connected to a Captive Portal VAP successfully. When the user opens their browser and tries to access their homepage, they get redirected as expected to another URL on the Aruba Controller. However, they see an error message that web authentication has been disabled. What might be a cause of this? A. Captive Portal has not been assigned in the SSID profile. B. The Captive portal profile has not been assigned to the AAA profile. C. A server group has not been assigned to the captive portal profile. D. An initial role has not been assigned to the AAA profile. E. The Captive portal profile has not been assigned to the initial role. Correct Answer: E /Reference: QUESTION 70 Which of the following will accept named VLANs as a parameter? (Choose three) A. a VLAN pool B. User Role for single VLAN C. RADIUS Server attributes for role derivation D. Firewall session rule E. Port trunk configuration Correct Answer: ABC /Reference: : Controller Configuration QUESTION 71

34 A customer has a remote AP deployment, where each remote AP has an IPSEC VPN tunnel with L2TP to the controller. 1 of the remote APs is stuck in the user table and hasn't yet transitioned to the AP active table in the controller. The customer suspects that the AP is not setting up its VPN connection successfully. Which of the following commands might be useful in troubleshooting this? (Choose three.) A. Logging level debugging security process localdb B. Logging level debugging security process l2tp C. Logging level debugging security process dot1x D. Logging level debugging security process crypto E. Logging level debugging security process vpn Correct Answer: ABD /Reference: : Spectrum analysis QUESTION 72 What is true about an AP in Hybrid Spectrum mode? A. Scan home channel and services client traffic on home channel B. Scans all channels and services clients on home channel C. Puts the selected band in spectrum mode and services clients on other band D. Makes the AP a spectrum monitor, but does not affect other APs in the AP-group E. All APs in AP-group scan home channel and service clients Correct Answer: A /Reference:

35 QUESTION 73 What is the total number of charts you can simultaneously monitor in a spectrum dashboard? A. 3 B. 4 C. 8 D. 9 E. 12 Correct Answer: E /Reference: QUESTION 74 An Aruba Controller is configured with VLAN 1,5, 200, and All VLANs have IP addresses assigned. Which is the default management VLAN on the Aruba controller? A. VLAN 5 B. VLAN 1 C. VLAN 200 D. None, it must be defined E. VLAN 4095 Correct Answer: B /Reference: QUESTION 75 Which of the following statements is true? A. Aruba Campus APs must be physically attached to the Aruba Controller. B. Aruba Campus APs must be in the same broadcast domain as the Controller.

36 C. Aruba Campus APs can be in different subnets from the Controller. D. Aruba Campus APs must be physically attached to the same Layer 3 switch. E. Aruba Campus APs can be connected directly to the public internet. Correct Answer: C /Reference: QUESTION 76 Referring to the diagram provided for this question, in which locations must you define the new data VLANs for wireless client traffic? (Choose two) A. in all L2 switches where an Aruba AP is physically connected B. in all APs and the L2 switches to which they are connected C. in the Aruba controller and the router it's connected to in an L2 deployment D. in the routers and switches where the APs are physically connected E. only on the Aruba controller in an L3 deployment Correct Answer: CE /Reference: QUESTION 77 A controller is provisioned in L3 Mode for Wireless Users. What must be configured on the controller to enable DHCP requests to an external DHCP server? A. an IP helper command B. the IP address of the DNS server C. the IP address of the APs D. the subnet address of the DHCP server E. the DHCP server IPSEC Key Correct Answer: A

37 /Reference: QUESTION 78 Which parameter(s) does a Master controller use to determine where a provisioned AP should terminate its GRE tunnel? A. the IP address of the AP B. the MAC address of the AP C. the IP address of the switch nearest to the AP D. the name and group settings of the AP E. the VLAN the AP is attached to Correct Answer: D /Reference: QUESTION 79 Which of the following configurations can accept a VLAN pool?(choose two) A. Trunk native VLAN B. Virtual AP profile C. User Role D. Server derived role E. FW Policies Correct Answer: BC /Reference: : Self-Healing QUESTION 80 Which of the following is an Aruba Layer 3 redundancy mechanism?(choose two)

38 A. HA B. Backup LMS-IP C. VRRP D. Backup AP group E. ARM Correct Answer: AB /Reference: QUESTION 81 When configuring Fast Failover what are the 3 HA roles that can be selected? (Choose three) A. Primary B. Active C. Dual D. Standby E. Backup Correct Answer: BCD /Reference: QUESTION 82 In the above diagram, the system shows two Aruba access points. Which VLANs must be configured on trunk link D between the router and Aruba controller to support wireless users when the controller is provisioned for L2 operations?

39 A. 10, 101 and 102 B. 101 and 102 C. 101, 102 and 103 D. 10, 101,102 and 103 E. 10 and 103 Correct Answer: A /Reference: : L3 Flow QUESTION 83 Referring to the diagram provided for this question, if the Aruba controller is configured to perform L3 switching, what will be the wireless client laptop default gateway? A. A B. B C. C D. D E. E Correct Answer: D /Reference: : Captive Portal QUESTION 84 When configuring Captive Portal, which protocols are supported when accessing the Captive Portal? (Choose two.) A. HTTPS B. VPN C. HTTP

40 D. TELNET E. SSH Correct Answer: AC /Reference: QUESTION 85 When the controller is configured for Captive Portal and the user is only required to provide an address for authentication, which option is configured in the GUI? A. enable termination B. enable guest logon C. enable user logon D. eap method E. disable CP Login Correct Answer: B /Reference: QUESTION 86 A user logged in with the Captive Portal settings shown in the above screen capture. What does the user need to do to logout? A. wait 30 minutes then logout B. wait 60 minutes then logout C. click Logout on the browser screen D. he cannot logout E. wait 10 seconds for redirect Correct Answer: C

41 /Reference: QUESTION 87 Screenshots of the Captive Portal authentication profile and server group of a guest network are displayed above. How was the user authenticated? A. with a radius server called Radius01 B. with the Internal database C. with a radius server called Internal D. with another form of authentication E. user wasn't authenticated against any server Correct Answer: E /Reference: QUESTION 88 Where should mobility domains be enabled in a network with 1 master, 1 backup master and 5 local controllers? A. Only on the master controller B. All the local controllers in the network C. All the controllers where the client is allowed to roam D. Master and backup master E. Only on the backup master Correct Answer: C /Reference: QUESTION 89 What are two different methods of configuring AP redundancy between 2 local controllers?(choose two.)

42 A. Fast-Failover B. Configure the locals as remote nodes C. Use named VLANS D. Backup LMS IP E. AP Redundancy can only be configured between a Master and Local Correct Answer: AD /Reference: : Switch Redundancy QUESTION 90 An AP is not communicating with the controller. Upon investigation you find that the AP is not discovering its controller through DNS. Instead, it received a DHCP reply with option 43 specifying the SIP server's IP address. How do you resolve this problem? A. Statically configure the AP to ignore Option 43 B. On the DHCP server implement Option 60 C. Statically configure the AP to only use DNS resolution and not other dynamic discovery methods D. After failing option 43 the AP should have proceeded with ADP, therefore the AP is faulty and needs to be replaced E. The AP should be purged Correct Answer: B /Reference: QUESTION 91 How is an AP redirected to a Local controller after DNS resolution returns the Master's IP address?

43 A. Master looks at the AP-Group and CONTROLLER-IP attributes B. Master looks at the AP-Group and LMS-IP attributes C. In the AP-provisioning screen, the LMS-IP attribute must be set D. The AP must be statically configured to find the local controller E. In the AP-provisioning screen, set the CONTROLLER-IP attribute Correct Answer: B /Reference: QUESTION 92 An AP was configured to use dynamic controller discovery and assigned to an AP group, then powered off for over a week. When the AP is redeployed, what previous configuration will it retain? A. Its AP name and AP Group B. Its Serial Number C. The controller's IP address D. After a few days all configurations are lost E. The controller IP address and the AP Group Correct Answer: A /Reference: QUESTION 93 Referring to the diagram provided for this question, an employee brought an unauthorized AP from home and attached the LAN port to the cubicle Ethernet port. All Aruba APs and AMs as well as the employee AP are in VLAN 80 and within RF range of each other. No traffic from the wired or wireless network has passed through the unauthorized AP yet, but the AP began wireless broadcasts. How will the Aruba system initially classify the employee's non-aruba AP? A. a valid AP

44 B. an AM C. a Rogue AP D. an interfering AP E. a known interfering AP Correct Answer: D /Reference: : -- QUESTION 94 Exhibit: Referring to the diagram provided for this question, an employee brought an unauthorized AP from home and attached it to the cubicle Ethernet port as shown in the diagram. The APs are in VLANs as shown in the diagram. Only AP1 is within RF range. How will the Aruba controller classify this AP? A. an AP B. an AM C. a Rogue AP D. an Interfering AP E. a workstation Correct Answer: D /Reference: QUESTION 95 Exhibit: Referring to the diagram provided for this question, an employee brought an unauthorized AP from home, but did not attach it to the LAN infrastructure. The APs are in the VLANs as shown in the diagram. Only AP1 is within RF range of the employee AP. By default, how will the Aruba system classify the employee's AP? A. an AP

45 B. an AM C. a Rogue AP D. an Interfering AP E. a valid workstation Correct Answer: D /Reference: QUESTION 96 What can an AM do that an AP cannot do? A. Detect rogue APs B. Detect an AP failure C. Scans all channels in under 1 minute D. Detect interfering APs E. Scan all valid channels Correct Answer: C /Reference: QUESTION 97 A client has not purchased the RF Protect license. Without this license what is still supported, in the basic OS? A. Only Intrusion Detection but no Intrusion Protection B. Rogue Detection and Containment

46 C. Spectrum Analysis D. Can only configure High, Medium and Low settings, No customization E. Without the License there is no Intrusion detection nor Intrusion Protection Correct Answer: B /Reference: QUESTION 98 A Valid client laptop is attempting to associate to a Rogue AP. The AM in proximity creates a Tarpit. What are the two mechanisms that the AM can utilize to Tarpit? (Choose two) A. Fake client's BSSID B. Fake SSID C. Fake Channel D. Fake BSSID E. Fake ESSID Correct Answer: CD /Reference: : IDS Other QUESTION 99 (group8) #show ap active Active AP Table Name Group IP Address 11g Clients 11g Ch/EIRP/MaxEIRP 11a Clients 11a Ch/EIRP/MaxEIRP AP1 building AM 0 AM AP2 building AM 0 AM A user called technical support because they cannot see any of their APs in building one. You perform the "show" command as illustrated above. What can you conclude about these two APs from this output?

47 A. the GRE for the APs terminate on two different controllers: and B. the system will not function because there is no building1 group defined C. the building1 APs will not accept any user connections D. the user needs to configure his client to use the b/g band E. the user needs to configure his client to use the a band Correct Answer: C /Reference: QUESTION 100 Exhibit: Based on the above screen capture for Interfering APs, what can you conclude? A. The APs must be connected to the Aruba network. B. The APs are classified as interfering because they are all transmitting on channel 6. C. There must not be any evidence that the APs are attached to the wired corporate network. D. These APs are classified as interfering because they are not Aruba APs. E. They are classified as interfering because they are running in g mode. Correct Answer: C /Reference: QUESTION 101 (group8) #show ap arm history ap-name AP1 Interface :wifi0 ARM History Time of Change Old Channel New Channel Old Power New Power Reason :58: I :52: M :16: I

48 Interface :wifi1 ARM History Time of Change Old Channel New Channel Old Power New Power Reason :52: I Referring to the output above. What can you conclude about AP1? A. This device is scanning channels. B. This device is unstable because the channel assignment changed. C. The device changed channels recently. D. The device changed channels and power levels recently. E. The device is transmitting at maximum power levels. Correct Answer: C /Reference: