EXAMEN ANUAL

What is the maximum number of remote APs supported by a 3600 controller?

• 512

• 1024

• 128

• 256

• 2048

Centralized licensing is not in use on an Aruba based network which has a Master and three local
controllers. No APs terminate on the Master controller. Roles and Firewall policies need to be
created and applied, hence PEF-NG license is required

• Only the master controller since role and firewall policies are created here.

• Only the local controllers since firewall policies are applied here

• The master and all three local controllers

• This isn't the correct license for this purpose, use PEF-VPN license

• This is not needed because PEF-NG is part of base OS

What information do you need to generate a feature license key for an Aruba controller?

• The controller's MAC address and the feature description

• Controller's MAC address and the certificate number

• Controller's Serial Number and the feature description

• Controller's Serial Number and the certificate number

• Controller's MAC address and Serial Number

What are the PEF-NG license limits based on?

• Number of APs

• One license per controller

• Number of users

• Number of local controllers

• Master Controller total user count

Which of the following licenses are consumed by Mesh APs advertising an SSIDs?

• AP license

• Mesh license

• PEF-V license

• No license is required

• RAP License

The permanent licenses on the controller will be deleted with the use of which command?

• Delete license

• Write erase

• Licenses cannot be deleted once activated

• Write erase all

• Reboot delete all

A network administrator wants to terminate VPN sessions on a local controller in the DMZ. Which
statement is true about the PEF-VPN license?

• It is only applied to the master controller

• It is only applied to the DMZ controller.

• It is based on the number of APs

• One license is needed on the master and the DMZ local

• It is distributed by the license server as needed

What is the best practice regarding licensing for a backup master to support Master Redundancy
in a network without centralized licensing?

• Backup master only requires the AP license

• Supported limits and installed licenses should be the same on primary master and backup
  Master

• Licenses are pushed from the primary to the backup Master along with the configuration

• The Backup Master does not require licenses to support master redundancy

• On the backup only one license of each typeis needed.

By default Centralized licensing messages between master controllers are sent

• In the clear unencrypted

• Using CPSec

• Using IPSec site to site VPN tunnels

• Encrypted using GRE

• PAPI

When creating a firewall rule on an Aruba controller, which parameter is optional?

• Destination

• Service

• Source

• Log

• Action

An administrator creates a WLAN with an unmodified default AAA profile. What is the default role
the user is placed in?

• default-logon

• logon

• guest-logon

• default-ap

• AP-Role

What is the first role a user is given when a user associates to an open WLAN?

• The guest post authentication role

• The initial role in the captive portal profile

• The role in the server group profile

• The initial role in the AAA profile

• The initial role in the 802.1x profile

What are aliases used for?

• Improve controller performance

• Simplify the configuration process

• Tie IP addresses to ports

• Assign rules to policies

• Assign policies to roles

The Aruba Policy Enforcement Firewall (PEF-NG) module supports destination network address
translation (dst-nat).
Which is the default use of this statement in an Aruba controller configuration?

• Source the IP addresses of users to specific IP address

• Redirect HTTP sessions to Captive Portal

• Redirect Access Points to another Aruba controller

• Provide a telnet connection to the controller

• Redirect a SSH session to terminate on the controller

The Aruba Policy Enforcement Firewall (PEF) module supports source network address
translation (src-nat).
Which is a use of this statement in an Aruba configuration?

• Provide a single source IP address for users in a role

• Redirect Captive Portal HTTP sessions

• Redirect Access Points to another Aruba controller

• Provide IP addresses to clients

• Redirects clients to Aruba Firewall

The network administrator wishes to terminate the VPN encryption on the Aruba controller.
When writing a firewall rule to accomplish the task of automatically moving the VPN traffic for the
wireless clients from a third party VPN concentrator to an Aruba controller, which action needs to
be configured in the rule?

• redirect to IPSec Group

• source NAT

• destination NAT

• redirect to tunnel

• redirect to GRE

Review the following truncated output from an Aruba controller for this item.

(example) #show rights logon

access-list List

----------------

Position Name Location

-------- ---- --------

1 logon-control
2 captiveportal

logon-control

-------------

Priority Source Destination Service Action

-------- ------ ----------- ------- ------

1 user any udp 68 deny
2 any any svc-icmp permit
3 any any svc-dns permit
4 any any svc-dhcp permit
5 any any svc-natt permit

captiveportal

-------------

Priority Source Destination Service Action

-------- ------ ----------- ------- ------

1 user controller svc-https dst-nat 8081
2 user any svc-http dst-nat 8080
3 user any svc-https dst-nat 8081
4 user any svc-http-proxy1 dst-nat 8088
5 user any svc-http-proxy2 dst-nat 8088
6 user any svc-http-proxy3 dst-nat 8088

Based on the above output from an Aruba controller, an unauthenticated user assigned to the
logon role attempts to start an http session to IP address 172.16.43.170.

What will happen?

• the user's traffic will be passed to the IP address because of the policy statement:
  user any svc-http dst-nat 8080

• the user's traffic will be passed to the IP address because of the policy statement:
  user any svc-https dst-nat 8081

• the user's traffic will be passed to the IP address because of the policy statement:
  user any svc-http-proxy1 dst-nat 8088

• the user will not reach the IP address because of the policy statement:
  user any svc-http dst-nat 8080

• the user will not reach the IP address because of the implicit deny any any at the end of the
  policy.

Refer to the following configuration segment for this item.

netdestination "internal"

no invert

network 172.16.43.0 255.255.255.0 position 1

range 172.16.11.0 172.16.11.16 position 2

!
ip access-list session "My-Policy"

alias "user" alias "internal" service_any permit queue low
!
A user frame is evaluated against this firewall policy with the following attributes:
Source IP: 172.17.49.3 Destination IP: 10.100.86.37 Destination Port: 80
Referring to the above file segment, how will the frame be handled by this firewall policy?

• The frame will be dropped because of the implicit deny all at the end of the netdestination
  definition.

• The frame will be dropped because of the implicit deny all at the end of the firewall policy

• The frame will be forwarded because of the implicit permit all at the end of the firewall policy.

• The frame will be passed because there is no service specified in the firewall policy.

• The frame will be dropped because there is no service specified in the firewall policy.

ip access-list session anewone
user network 10.1.1.0 255.255.255.0 any permit
user any any permit
host 10.1.1.1 host 10.2.2.2 any deny

A user sends a frame with the following attributes:
Source IP: 10.1.1.1 Destination IP: 10.2.2.2 Destination Port: 25
Based on the above Mobility Controller configuration file segment, what will this policy do with the
user frame?

• The frame is discarded because of the implicit deny all at the end of the policy.

• The frame is discarded because of the statement:
  user host 10.1.1.1 host 10.2.2.2 deny.

• The frame is accepted because of the statement:
  user any any permit.

• The frame is accepted because of the statement:
  user network 10.1.1.0 255.255.255.0 any permit.

• This is not a valid policy.

Which of these are NOT a client attribute that can be configured in user derivation rules?

• MAC address

• DHCP option value

• BSSID

• Filter ID

• encryption

Which is a Device Specific Attribute that can be evaluated in a user derivation rule?

• user login name

• authentication server

• location by AP Name

• controller Loopback address

• controller IP

An administrator wants to assign a VLAN to a user based upon the authentication process using
Vendor Specific Attributes (VSA). Where are Aruba Vendor Specific Attribute (VSA) values
provisioned?

• controller

• client

• RADIUS server

• Internal user database

• Option 60 of DHCP reply

A user connected to a Captive Portal VAP successfully. When the user opens their browser and
tries to access their homepage, they get redirected as expected to another URL on the Aruba
Controller. However, they see an error message that web authentication has been disabled. What
might be a cause of this?

• Captive Portal has not been assigned in the SSID profile.

• The Captive portal profile has not been assigned to the AAA profile.

• A server group has not been assigned to the captive portal profile

• An initial role has not been assigned to the AAA profile.

• The Captive portal profile has not been assigned to the initial role.

What can NOT be configured from the Aruba controller configuration wizards?

• Controller IP

• Boot Partition

• User firewall policy

• User derivation rules.

• Radius Servers

An administrator is setting up a factory default controller. No new AP groups were created. When
adding a WLAN SSID in the Campus WLAN wizard what AP group is available?

• The air-monitors AP group

• The logon AP group

• The default AP group

• The initial AP group

• The Spectrum AP group

The reusable Aruba Controller wizards are accessible in what way?

• Only on startup through the CLI

• Through the CLI, after the initial CLI wizard has been completed

• In the Web UI under maintenance.

• In the Web UI under configuration.

• Must be initialized from CLI first.

By default, which CLI based remote access method is enabled on Aruba controllers?

• RSH

• Telnet

• SSH

• Telnet and SSH

• Telnet, SSH and RSH

As an admin/root user, what other type of role-based management users can be created on Aruba
controllers?

• Auditing-compliance user

• AirWave management user

• Reporting Generation user

• Guest provisioning user

• Maintenance user

Which log type should be enabled to troubleshoot IPSec authentication issues on Aruba
Controllers?

• Security Logs

• Management Logs

• Wireless Logs

• IDS Logs

• System Logs

A customer forgot all passwords for a controller. What method could you use to reset the
passwords?

• Telnet to the controller and login to the password recovery account

• SSH to the controller and login to the password recovery account

• Connect directly to the serial console and login to the password recovery account

• Interrupt the boot process at CP-boot and select password recovery

• Open the controller and press the reset switch

With CPSec disabled, which tunnel protocol is used between APs and Controllers in an Aruba
environment?

• Basic IP

• GRE

• IPinIP

• Mobile IP

• IPSec

In an Aruba controller based system, the L3 mobility tunnel exists between the home agent and
which other element?

• the default gateway

• the remote AP

• the foreign agent

• the mobile node

• the foreign switch

When an 802.11 client roams what device decides when to move the client to another AP?

• Aruba AP

• Aruba controller

• Client

• Radius Server

• Router

Which command will show all client association history?

• Aruba-6000# show mobile trail current (ip address)

• Aruba-6000# show ip mobile trail (ip address)

• Aruba-6000# show ap client status (mac address)

• Aruba-6000# show current client ip (ip address)

• Aruba-6000# show client ip (ip address) mobility

With CPSec enabled, which tunnel protocol is used between APs and Controllers in an Aruba
environment?

• EAP

• SSH

• IPinIP

• Mobile IP

• IPSec

By default, how long will an AP scan a single channel when ARM is enabled?

• 80 milliseconds

• 90 milliseconds

• 100 milliseconds

• 110 milliseconds

• 200 milliseconds

How does the ARM Band Steering feature encourage 5GHz capable clients to move/connect to
the 5GHz radios of Aruba APs?

• ARM suppresses the probe response on the 2.4 GHz radio

• ARM utilizes third party software on the wireless clients

• Current Wi-Fi chipset firmware supports this by default

• It's not possible the move clients to 5GHz radios when they can see both 2.4 and 5GHz APs

• ARM disables the 2.4Ghz radio for the specified client

What is the function of Band Steering?

• Balancing clients across APs on different channels within the same band

• Encourages clients, 5GHz capable, to connect on the 5GHz spectrum

• Coordinate access to the same channel across multiple APs

• Enables selection of 20 vs. 40 MHz mode of operation per band

• Enables acceptable coverage index on both the "b/g" and "a" spectrums

Which of the following statements is true of Spectrum Mode?

• No licenses are required to run an AP in Spectrum mode

• Spectrum mode can only be configured for one AP at a time

• An AP can be in spectrum mode for both 2.4 and 5G bands at the same time

• An AP can be placed in Spectrum Mode via the Spectrum Profile

• Spectrum mode can be configured from the GUI under AP installation

Which ARM feature addresses the issue of sticky clients by moving clients to associate to APs
with better 802.11 signal quality?

• Co-Channel interference mitigation

• Airtime Fairness

• ClientMatch

• Coordinated access to a single channel

• Band Steering

Which settings cannot be modified directly from a local controller?

• Port VLAN setting

• Switch Time Zone

• Port trusted

• Roles

• SNMP Enable Trap Generation

Masters communicate configuration information with locals using which tunnel type?

• GRE

• IP in IP

• Provision Tunnel Protocol

• IPSec

• PPTP

With CPSec disabled, Aruba access points are Layer 3 connected to controllers using which
protocol?

• 802.1q

• LWAPP

• PPTP

• GRE

• HTTPs

With CPSec disabled, which encryption protocol does a tunnel mode campus AP use on client
traffic?

• TKIP and AES

• It is provisioned by the Administrator

• WEP and AES

• WEP, TKIP, and AES

• No encryption is used

In a campus environment, where are encryption keys sent or stored when users roam between
tunneled mode APs on the same controller using 802.1X?

• sent to the new AP via GRE

• sent to the new AP via IPSec

• stored on the controller

• stored on the RADIUS server

• original AP sends keys to new AP

When configuring a server group containing 3 servers, a customer chooses 'fail through mode'.
What other configuration option has to be enabled on the controller for this to work with 802.1x
authentication?

• Machine authentication

• EAP Termination

• Server group fall through mode

• MAC authentication

• Round robin or top down mode

Which method is NOT supported to provision an Aruba campus AP?

• Telnet directly to AP

• SSH to the AP's controller

• Web interface to the AP's controller

• Console to AP

• CLI on controller

When direct consoled to an AP, what is the command sequence to factory default the AP and rebootstrap?

• setenv bootstat init

• setenv master init, boot

• purge, save, boot

• init, save, boot

• print, purge, boot

What settings need to be changed on a factory default AP in order for it to use ADP to discover the
Aruba Controller?

• DNS of the controller

• Static route

• AP group

• enable multicast

• no changes needed

How many Aruba controllers can be added to a single mobility domain?

• 64 controllers of any type

• 128 controllers supporting 2000 users

• 256 controllers with no more than 1024 subnets

• Controllers supporting up to 6000 AP's

• There is no controller limit

In a master-local controller scenario, where is the mobility domain defined?

• the AP group

• the master controller

• the local controller

• the master and the local controllers

• the master and the local controllers where roaming is needed

A university has 2 departments. Department 1 has its own mobility domain with one controller.
Department 2 has multiple controllers configured in a second domain. The university is planning
on offering a new application and needs users to be able to roam between both mobility domains.

What is the best way to accomplish this?

• The 2 existing domains should be left as they are. A 3rd mobility domain should then be
  created and all 3 controllers need to be added to it

• Merge the controllers into the same mobility domain

• The IP subnets of all controllers need to be configured to match

• This cannot be accomplished

• Create a new domain between a department 1 controller and one of the department 2
  controllers

A port firewall policy is applied to a trunk port that denies controller access. An "allow all" Vlan
firewall policy is applied to VLAN 33 on the same port. A user connected to VLAN 33 on that port
attempts to gain access to the controller. Which of the following statements is true?

• The Port policy is applied, therefore no controller access

• The Vlan policy is applied, then the port policy, therefore no controller access

• The Vlan policy is applied, therefore access to the controller is allowed

• You cannot place a firewall policy on a Ports Vlan when the Port already has a policy, therefore
  no controller access

• When locally connected to a controller's port you always have controller access

An access port has been placed in trusted mode. The Vlan on the port is in Untrusted mode.
Which of the following statements is true?

• The traffic is trusted since the port is trusted

• The traffic is untrusted since the VLAN is untrusted

• This is an invalid configuration, both must be set the same

• You cannot set Vlans as trusted or untrusted

• Only traffic from that specific port is trusted, all other traffic is untrusted

A wired device is connected to an untrusted port on a controller. How can a role be assigned to
the device?

• An initial Role can be assigned directly to the VLAN

• Roles are assigned to devices connected to a trusted port

• A default Role can be directly assigned to an untrusted port

• Adding a wired AAA profile to a VLAN on the untrusted port

• The Role assigned to the untrusted port

A port on a controller has been configured as untrusted. No wired access AAA profile or Global
AAA profile is configured. When a user connects to that port which of the following statements is
true?

• Since there is no wired access AAA profile, only port policies will be applied

• The user will fall into the default wired access AAA profile and will be given the initial role.

• Since there is no wired access AAA profile or Global AAA profile the user will be given the
  logon role.

• When configuring the port as untrusted, an error message of "no wired access AAA profile
  exists" Therefore this is an invalid configuration

• the user is denied all access automatically because no wired access AAA or Global AAA profile
  is assigned

Which method can APs use to discover a controller?

• DHCP

• Dynamic DNS (DDNS)

• PnP

• PAPI

• HTTPS

When APs boot up, in which order do they discover a controller?

• DNS, DHCP, ADP multicast, ADP unicast, static

• static, DNS, DHCP, ADP broadcast, ADP multicast

• static, DHCP, ADP multicast, ADP broadcast, DNS

• static, DHCP, DNS, ADP multicast, ADP broadcast

• DNS, static, ADP multicast, ADP broadcast

An AP is not communicating with the controller. Upon investigation you find that the AP is not
discovering its controller through DNS. Instead, it received a DHCP reply with option 43 specifying
the SIP server's IP address. How do you resolve this problem?

• Statically configure the AP to ignore Option 43

• Remove the option 43 configuration on the DHCP server

• Statically configure the AP to only use DNS resolution and not other dynamic discovery
  methods

• After failing option 43 the AP should have proceeded with ADP, therefore the AP is faulty and
  needs to be replaced

• The AP should be purged

How is an AP redirected to a Local controller after DNS resolution returns the Master's IP
address?

• Master looks at the AP-Group and CONTROLLER-IP attributes

• Master looks at the AP-Group and LMS-IP attributes

• In the AP-provisioning screen, the LMS-IP attribute must be set

• The AP must be statically configured to find the local controller

• In the AP-provisioning screen, set the CONTROLLER-IP attribute

An AP was configured and assigned to an AP group then powered off for over a week. When the
AP is redeployed, what previous configuration will it retain?

• It's AP name and AP Group

• It's Serial Number

• The controller's IP address

• After a few days all configurations are lost

• The controller IP address and the AP Group

A 3600 controller has 64 PEF-NG license, 128 AP licenses and 1 RFProtect license. How many
AP's can terminate on the controller?

• 1 Campus APs

• 64 Campus APs

• 128 Remote APs

• 256 Remote APs

• 512 Remote APs

A 3200 controller has 16 AP licenses,16 PEF-NG licenses, 16 RFProtect licenses. There are 10
Campus APs terminating on the controller. How many remote AP's can terminate on the
controller?

• 6

• 12

• 16

• 24

• 32

Centralized licensing is not enabled in a network of 1 Master and 2 Local controllers, what should
be the license count on all controllers to terminate 8 APs on each Local controller and support
Local redundancy?

• 16 AP license on all controllers

• 8 AP license on Master and 16 AP license on both locals

• 8 AP license on all controllers

• 1 AP license on Master and 16 AP license on both locals

• 16 AP licenses on the Locals

An 7240 controller is Licensed for 560 APs. The controller has 500 Campus APs terminating on
the controller. How many Remote APs can terminate on this controller?

• 12

• 24

• 48

• 60

• 120

An Aruba Controller is configured with VLAN 1,5, 200, and 4095. All VLANs have IP addresses
assigned. Which is the default management VLAN on the Aruba controller?

• VLAN 5

• VLAN 1

• VLAN 200

• None, it must be defined

• VLAN 4095

Which of the following statements is true?

• Aruba Campus APs must be physically attached to the Aruba Controller

• Aruba Campus APs must be in the same broadcast domain as the Controller.

• Aruba Campus APs can be in different subnets from the Controller

• Aruba Campus APs must be physically attached to the same Layer 3 switch

• Aruba Campus APs can be connected directly to the public internet.

A controller is provisioned in L3 Mode for Wireless Users. What must be configured on the
controller to enable DHCP requests to an external DHCP server?

• an IP helper command

• the IP address of the DNS server

• the IP address of the APs

• the subnet address of the DHCP server

• the DHCP server IPSEC Key

Which parameter(s) does a Master controller use to determine where a provisioned AP should
terminate its GRE tunnel?

• the IP address of the AP

• the MAC address of the AP

• the IP address of the switch nearest to the AP

• the name and group settings of the AP

• the VLAN the AP is attached to

What does Aruba Layer 3 redundancy require to operate?

• LMS-IP

• Backup LMS-IP

• VRRP

• Backup AP group

• ARM

When the controller is configured for Captive Portal and the user is only required to provide an
email address for authentication, which option is configured in the GUI?

• enable termination

• enable guest logon

• enable user logon

• eap method

• disable CP Login

Where should mobility domains be enabled in a network with 1 master, 1 backup master and 5
local controllers?

• Only on the master controller

• All the local controllers in the network

• All the controllers where the client is allowed to roam

• Master and backup master

• Only on the backup master

An Aruba 650 controller is functioning as a standby Master. How many APs can it control while in
standby mode?

• 0

• 16

• 24

• 128

• 256

Aruba pair of 3200XM controllers are licensed to their maximum and are configured as a VRRP
pair. Each controller terminates 24 APs. One of the controllers fails. How many of the APs from
the failed controller can fail over to the remaining controller?

• 8

• 16

• 32

• 48

• 96

Which protocol does the Aruba controller utilize for controller redundancy?

• HSRP

• VRRP

• VPN

• GRE

• IP-IP

With Fast-Failover disabled, to which IP address should the Aruba AP terminate its GRE tunnel for
layer 2 controller redundancy to work and to support failover of access points?

• VRRP IP address

• management IP of an Aruba controller

• management IP of the backup Aruba controller

• HSRP IP address

• Loopback IP address of backup Aruba controller

What can an AM do that an AP cannot do?

• Detect rogue APs

• Detect an AP failure

• Scans all channels in under 1 minute

• Detect interfering APs

• Scan all valid channels

(group8) #show ap active
Active AP Table
---------------
Name Group IP Address 11g Clients 11g Ch/EIRP/MaxEIRP 11a Clients 11a
Ch/EIRP/MaxEIRP
---- ----- ---------- --------- ------------------- ----------- -------------------
AP1 building1 10.1.80.150 0 AM 0 AM
AP2 building1 10.1.80.151 0 AM 0 AM
A user called technical support because they cannot see any of their APs in building one. You
perform the "show" command as illustrated above.
What can you conclude about these two APs from this output?

• the GRE for the APs terminate on two different controllers: 10.1.80.150 and 10.1.80.151

• the system will not function because there is no building1 group defined

• the building1 APs will not accept any user connections

• the user needs to configure his client to use the b/g band

• the user needs to configure his client to use the a band

(group8) #show ap arm history ap-name AP1
Interface :wifi0
ARM History
-----------
Time of Change Old Channel New Channel Old Power New Power Reason
-------------- ----------- ----------- --------- --------- ------
2010-10-28 07:58:53 157+ 149+ 21 21 I
2010-10-28 07:52:06 149+ 157+ 21 21 M
2010-10-28 07:16:59 157+ 149+ 21 21 I
Interface :wifi1
ARM History
-----------
Time of Change Old Channel New Channel Old Power New Power Reason
-------------- ----------- ----------- --------- --------- ------
2010-10-28 08:52:53 6 1 21 21 I
Referring to the output above. What can you conclude about AP1?

• This device is scanning channels.

• This device is unstable because the channel assignment changed.

• The device changed channels recently

• The device changed channels and power levels recently.

• The device is transmitting at maximum power levels.

A client device associates with an SSID provisioned with 802.1X authentication. The client is set
for LEAP authentication. EAP termination (AAA Fastconnect) is enabled on the controller. But the
client continuously cycles through the authentication process. Which of the following could cause
this?

• The Radius server is rejecting the client credentials.

• The client has an expired or revoked server certificate.

• The DHCP server is not enabled

• The VLAN is missing for the SSID

• The controller does not support LEAP in this mode.

A client attaches to a secure jack interface set to untrusted. But when the client tries to access the
captive portal page, the following message appears, "Web Authentication is not enabled." What
might be wrong?

• The client has the browser provisioned with proxy settings.

• The controller port needs to be set to trusted

• A "aaa" profile needs to be selected on the Wired Access page

• A Captive Portal profile needs to be assigned to the initial role.

• Web Authentication cannot be used in this way.

Which command, when executed on a master controller, will show the APs connected to all
controllers?

• show stm connectivity

• show ap active

• show ap database

• show ap bss-table

• show ap controller-lms

Which of the following commands is most useful in showing the traffic of an individual user?

• show datapath session table

• show acl hits

• show rights

• show firewall

• show traffic client

IEEE 802.11r provides support for which of the following:

• radio measurements within a WLAN

• radio measurement within an ESS

• fast roaming within an ESS

• fast roaming within a BSS

• roaming across controllers

If a Remote AP (RAP) is attempting to contact a controller that is behind a NAT device what
protocol must be allowed through the NAT/Firewall?

• PAPI

• NATT

• IPSec

• SSH

• GRE

Which of the following are valid RAP operating modes?

• Always, Backup, Standard, Persistent

• Always, Backup, Tunnel, Persistent

• Always, Hotel-Connect, Tunnel, Standard

• Backup, Hotel-Connect, Standard, Persistent

• Backup, Normal, Tunnel, Always

When configuring split tunnel mode on a Remote AP (RAP) where is the routing function for the
split tunnel defined?