EXAMEN ANUAL

Please wait - loading…

Question 1 of 165

Which of the following Aruba controllers is able to provide IEEE 802.3af? (Choose two)

Select one or more of the following:

3200
620
650
6000 with M3
7000

Explanation

Question 2 of 165

What is the maximum number of remote APs supported by a 3600 controller?

Select one of the following:

512
1024
128
256
2048

Explanation

Question 3 of 165

Which dual radio access point models support concurrent operations in the 2.4Ghz band as well
as the 5Ghz band? (Choose three)

Select one or more of the following:

AP-92
AP-93
AP-105
AP-224
AP-135

Explanation

Question 4 of 165

Which of the following APs do NOT support dual radio operations? (Choose two)

Select one or more of the following:

AP 93
AP 105
RAP 3WN
AP 224
AP 135

Explanation

Question 5 of 165

Centralized licensing is not in use on an Aruba based network which has a Master and three local
controllers. No APs terminate on the Master controller. Roles and Firewall policies need to be
created and applied, hence PEF-NG license is required

Select one of the following:

Only the master controller since role and firewall policies are created here.
Only the local controllers since firewall policies are applied here
The master and all three local controllers
This isn't the correct license for this purpose, use PEF-VPN license
This is not needed because PEF-NG is part of base OS

Explanation

Question 6 of 165

What information do you need to generate a feature license key for an Aruba controller?

Select one of the following:

The controller's MAC address and the feature description
Controller's MAC address and the certificate number
Controller's Serial Number and the feature description
Controller's Serial Number and the certificate number
Controller's MAC address and Serial Number

Explanation

Question 7 of 165

What are the PEF-NG license limits based on?

Select one of the following:

Number of APs
One license per controller
Number of users
Number of local controllers
Master Controller total user count

Explanation

Question 8 of 165

Which of the following licenses are consumed by Mesh APs advertising an SSIDs?

Select one of the following:

AP license
Mesh license
PEF-V license
No license is required
RAP License

Explanation

Question 9 of 165

The permanent licenses on the controller will be deleted with the use of which command?

Select one of the following:

Delete license
Write erase
Licenses cannot be deleted once activated
Write erase all
Reboot delete all

Explanation

Question 10 of 165

A network administrator wants to terminate VPN sessions on a local controller in the DMZ. Which
statement is true about the PEF-VPN license?

Select one of the following:

It is only applied to the master controller
It is only applied to the DMZ controller.
It is based on the number of APs
One license is needed on the master and the DMZ local
It is distributed by the license server as needed

Explanation

Question 11 of 165

What is the best practice regarding licensing for a backup master to support Master Redundancy
in a network without centralized licensing?

Select one of the following:

Backup master only requires the AP license
Supported limits and installed licenses should be the same on primary master and backup
Master
Licenses are pushed from the primary to the backup Master along with the configuration
The Backup Master does not require licenses to support master redundancy
On the backup only one license of each typeis needed.

Explanation

Question 12 of 165

Which of the following licenses can be included in the licensing pool for centralized licensing?
(Choose three)

Select one or more of the following:

Factory default licenses
PEFNG license
Evaluation licenses
RFProtect license
PEFV license

Explanation

Question 13 of 165

By default Centralized licensing messages between master controllers are sent

Select one of the following:

In the clear unencrypted
Using CPSec
Using IPSec site to site VPN tunnels
Encrypted using GRE
PAPI

Explanation

Question 14 of 165

Which of the following will occur if a master license server fails with no standby server present?
(Choose two)

Select one or more of the following:

Local controllers licenses will continue to be valid for 30 days
Local controllers will immediately remove all installed licenses
No licenses will be sent to any new controllers that come online
All licenses go back into the pool for redistribution
A Local Controller elects itself master license server

Explanation

Question 15 of 165

Which may be applied directly to an VLAN interface? (Choose three)

Select one or more of the following:

Access List (ACL)
Firewall Policy
Roles
AAA profiles
RF Plan Map

Explanation

Question 16 of 165

When creating a firewall rule on an Aruba controller, which parameter is optional?

Select one of the following:

Destination
Service
Source
Log
Action

Explanation

Question 17 of 165

An administrator creates a WLAN with an unmodified default AAA profile. What is the default role
the user is placed in?

Select one of the following:

default-logon
logon
guest-logon
default-ap
AP-Role

Explanation

Question 18 of 165

What is the first role a user is given when a user associates to an open WLAN?

Select one of the following:

The guest post authentication role
The initial role in the captive portal profile
The role in the server group profile
The initial role in the AAA profile
The initial role in the 802.1x profile

Explanation

Question 19 of 165

Which of the following could be used to set a user's post-authentication role or VLAN association?
(Choose two)

Select one or more of the following:

AAA default role for authentication method
Server Derivation Rule
Vendor Specific Attributes
AP Derivation Rule
The Global AAA profile

Explanation

Question 20 of 165

Which describe "roles" as used on Aruba Mobility Controllers? (Choose two)

Select one or more of the following:

Roles are assigned to users.
Roles are applied to interfaces.
Policies are built from roles.
A user can belong to only one role at a time.
Roles are a set of authentication rules

Explanation

Question 21 of 165

Which netdestination aliases are built into the controller? (Choose three)

Select one or more of the following:

logon
any
user
guest
localip

Explanation

Question 22 of 165

What are aliases used for?

Select one of the following:

Improve controller performance
Simplify the configuration process
Tie IP addresses to ports
Assign rules to policies
Assign policies to roles

Explanation

Question 23 of 165

Which of the following firewall rules allows a user to initiate an ICMP session to other devices?
(Choose two)

Select one or more of the following:

localip any svc-icmp permit
user any svc-icmp permit
user user svc-icmp permit
any any svc-icmp permit
mswitch any svc-icmp permit

Explanation

Question 24 of 165

The Aruba Policy Enforcement Firewall (PEF-NG) module supports destination network address
translation (dst-nat).
Which is the default use of this statement in an Aruba controller configuration?

Select one of the following:

Source the IP addresses of users to specific IP address
Redirect HTTP sessions to Captive Portal
Redirect Access Points to another Aruba controller
Provide a telnet connection to the controller
Redirect a SSH session to terminate on the controller

Explanation

Question 25 of 165

The Aruba Policy Enforcement Firewall (PEF) module supports source network address
translation (src-nat).
Which is a use of this statement in an Aruba configuration?

Select one of the following:

Provide a single source IP address for users in a role
Redirect Captive Portal HTTP sessions
Redirect Access Points to another Aruba controller
Provide IP addresses to clients
Redirects clients to Aruba Firewall

Explanation

Question 26 of 165

The network administrator wishes to terminate the VPN encryption on the Aruba controller.
When writing a firewall rule to accomplish the task of automatically moving the VPN traffic for the
wireless clients from a third party VPN concentrator to an Aruba controller, which action needs to
be configured in the rule?

Select one of the following:

redirect to IPSec Group
source NAT
destination NAT
redirect to tunnel
redirect to GRE

Explanation

Question 27 of 165

Review the following truncated output from an Aruba controller for this item.

(example) #show rights logon

access-list List

----------------

Position Name Location

-------- ---- --------

1 logon-control
2 captiveportal

logon-control

-------------

Priority Source Destination Service Action

-------- ------ ----------- ------- ------

1 user any udp 68 deny
2 any any svc-icmp permit
3 any any svc-dns permit
4 any any svc-dhcp permit
5 any any svc-natt permit

captiveportal

-------------

Priority Source Destination Service Action

-------- ------ ----------- ------- ------

1 user controller svc-https dst-nat 8081
2 user any svc-http dst-nat 8080
3 user any svc-https dst-nat 8081
4 user any svc-http-proxy1 dst-nat 8088
5 user any svc-http-proxy2 dst-nat 8088
6 user any svc-http-proxy3 dst-nat 8088

Based on the above output from an Aruba controller, an unauthenticated user assigned to the
logon role attempts to start an http session to IP address 172.16.43.170.

What will happen?

Select one of the following:

the user's traffic will be passed to the IP address because of the policy statement:
user any svc-http dst-nat 8080
the user's traffic will be passed to the IP address because of the policy statement:
user any svc-https dst-nat 8081
the user's traffic will be passed to the IP address because of the policy statement:
user any svc-http-proxy1 dst-nat 8088
the user will not reach the IP address because of the policy statement:
user any svc-http dst-nat 8080
the user will not reach the IP address because of the implicit deny any any at the end of the
policy.

Explanation

Question 28 of 165

Refer to the following configuration segment for this item.

ip access-list session anewone

user network 172.16.1.0 255.255.255.0 any permit

user host 172.16.1.1 any deny

user any any permit

An administrator wants users to have access to all destinations except 172.16.1.1. Based on the
above Aruba Mobility Controller configuration segment, which statements best describe this
policy? (Choose two)

Select one or more of the following:

The rule user host 172.16.1.1 any deny is redundant because of the implicit deny all at the end.
The rule user network 172.16.1.0 255.255.255.0 any permit is redundant.
The two rules user network 172.16.1.0 255.255.255.0 any permit and user host 172.16.1.1 any
deny need to be re-sequenced.
The last statement user any any permit is not required
The last statement should be any any any deny

Explanation

Question 29 of 165

Refer to the following configuration segment for this item.

netdestination "internal"

no invert

network 172.16.43.0 255.255.255.0 position 1

range 172.16.11.0 172.16.11.16 position 2

!
ip access-list session "My-Policy"

alias "user" alias "internal" service_any permit queue low
!
A user frame is evaluated against this firewall policy with the following attributes:
Source IP: 172.17.49.3 Destination IP: 10.100.86.37 Destination Port: 80
Referring to the above file segment, how will the frame be handled by this firewall policy?

Select one of the following:

The frame will be dropped because of the implicit deny all at the end of the netdestination
definition.
The frame will be dropped because of the implicit deny all at the end of the firewall policy
The frame will be forwarded because of the implicit permit all at the end of the firewall policy.
The frame will be passed because there is no service specified in the firewall policy.
The frame will be dropped because there is no service specified in the firewall policy.

Explanation

Question 30 of 165

ip access-list session anewone
user network 10.1.1.0 255.255.255.0 any permit
user any any permit
host 10.1.1.1 host 10.2.2.2 any deny

A user sends a frame with the following attributes:
Source IP: 10.1.1.1 Destination IP: 10.2.2.2 Destination Port: 25
Based on the above Mobility Controller configuration file segment, what will this policy do with the
user frame?

Select one of the following:

The frame is discarded because of the implicit deny all at the end of the policy.
The frame is discarded because of the statement:
user host 10.1.1.1 host 10.2.2.2 deny.
The frame is accepted because of the statement:
user any any permit.
The frame is accepted because of the statement:
user network 10.1.1.0 255.255.255.0 any permit.
This is not a valid policy.

Explanation

Question 31 of 165

ip access-list session anewone

user network 10.1.1.0 255.255.255.0 any permit

user host 10.1.1.1 any deny

user any any permit

Referring to the above portion of a Mobility Controller configuration file, what can you conclude?
(Choose two)

Select one or more of the following:

This is a session firewall policy.
This is an extended Access Control List (ACL).
Any traffic going to destination 10.1.1.1 will be denied.
Any traffic going to destination 10.2.2.2 will be denied.
Any traffic going to destination 172.16.100.100 will be permitted.

Explanation

Question 32 of 165

Which of these are NOT a client attribute that can be configured in user derivation rules?

Select one of the following:

MAC address
DHCP option value
BSSID
Filter ID
encryption

Explanation

Question 33 of 165

What are the types of user derivation rules that can be applied to a user? (Choose two)

Select one or more of the following:

SSID
MAC
VLAN
Role
AP

Explanation

Question 34 of 165

Which is a Device Specific Attribute that can be evaluated in a user derivation rule?

Select one of the following:

user login name
authentication server
location by AP Name
controller Loopback address
controller IP

Explanation

Question 35 of 165

Which match condition can be used by a server derivation rule? (Choose two)

Select one or more of the following:

greater than
less than
inverse of
contains
equals

Explanation

Question 36 of 165

An administrator wants to assign a VLAN to a user based upon the authentication process using
Vendor Specific Attributes (VSA). Where are Aruba Vendor Specific Attribute (VSA) values
provisioned?

Select one of the following:

controller
client
RADIUS server
Internal user database
Option 60 of DHCP reply

Explanation

Question 37 of 165

View the Server group screen shot above.

A company has provisioned the same VAP, AAA and SSID profiles at both its Miami and NY
offices. This Server Group is applied for 802.1x authentication at both locations. The user's
credentials are only found in the Miami Radius server "RadiusMiami". There is no Radius
synchronization and both servers are reachable. What happens when the user attempts to
authenticate?

Select one of the following:

The controller recognizes the users Domain and sends the authentication request directly to
RadiusMiami.
The request is initially sent to RadiusNY1 then RadiusNY1 redirects the controller to send the
authentication request to RadiusMiami
RadiusNY1 receives the request and returns a deny. No other action is taken.
RadiusNY1 receives the request and returns a deny. The authentication request will then be
sent to RadiusMiami.
The RadiusNY1 sends the request to RadiusMiami that replies to the controller

Explanation

Question 38 of 165

View the Server group and User Roles screen shots above.

A user associated to an SSID with 802.1x using this server group. RadiusNY returned a standard
radius attribute of filter-Id with a value of "employee". The user was placed in the guest Role.
What statements below are correct? (Choose two)

Select one or more of the following:

The user was placed in the 802.1x authentication default Role guest
The user was placed in the initial Role guest
Role derivation failed because roles are case sensitive
Role derivation failed because the incorrect operation "value-of" was used
802.1x authentication failed so the user was automatically placed in the guest Role

Explanation

Question 39 of 165

View the Server group and User Roles screen shots above.

A user associated to an SSID with 802.1x using this server group. RadiusNY returned a standard
radius attribute of filter-Id with a value of "employee".
What Role will the user get?

Select one of the following:

The User will get the Emp Role
The User will get the 802.1x authentication default Role
The User will get the employee Role
The User will get the Employee Role
The User will get the initial Role

Explanation

Question 40 of 165

Which profiles are required in an AP Group to enable an SSID with VLAN 1, WPA2 and LMSIP?
(Choose three)

Select one or more of the following:

Virtual-AP profile
WLAN profile
802.1x authentication profile
AP System Profile
SSID Profile

Explanation

Question 41 of 165

A user connected to a Captive Portal VAP successfully. When the user opens their browser and
tries to access their homepage, they get redirected as expected to another URL on the Aruba
Controller. However, they see an error message that web authentication has been disabled. What
might be a cause of this?

Select one of the following:

Captive Portal has not been assigned in the SSID profile.
The Captive portal profile has not been assigned to the AAA profile.
A server group has not been assigned to the captive portal profile
An initial role has not been assigned to the AAA profile.
The Captive portal profile has not been assigned to the initial role.

Explanation

Question 42 of 165

Which of the following will accept named VLANs as a parameter? (Choose three)

Select one or more of the following:

Virtual AP profile
User derivation rule for a single VLAN
Server derivation rule for a single VLAN
Server derivation rule for a VLAN Pool
Access VLAN for a VLAN Pool

Explanation

Question 43 of 165

A customer has a remote AP deployment, where each remote AP has an IPSEC VPN tunnel with
L2TP to the controller. 1 of the remote APs is stuck in the user table and hasn't yet transitioned to
the AP active table in the controller. The customer suspects that the AP is not setting up its VPN
connection successfully. Which of the following commands might be useful in troubleshooting this?
(Choose three)

Select one or more of the following:

Logging level debugging security process localdb
Logging level debugging security process l2tp
Logging level debugging security process dot1x
Logging level debugging security process crypto
Logging level debugging security process vpn

Explanation

Question 44 of 165

The screen captures below show the 802.1X authentication profile and AAA profile settings for a
VAP.

If machine authentication fails and user authentication passes, which role will be assigned?

Select one of the following:

employee
guest
contractor
logon
no role is assigned

Explanation

Question 45 of 165

The screen captures above show the 802.1X authentication profile and AAA profile settings for a
VAP.

If machine authentication passes and user authentication fails, which role will be assigned?

Select one of the following:

employee
guest
contractor
logon
no role is assigned

Explanation

Question 46 of 165

The screen captures above show the 802.1X authentication profile and AAA profile settings for a
VAP.

If machine authentication fails and user authentication fails, which role will be assigned?

Select one of the following:

Employee
Guest
Captive Portal
Logon
No role will be assigned

Explanation

Question 47 of 165

What can NOT be configured from the Aruba controller configuration wizards?

Select one of the following:

Controller IP
Boot Partition
User firewall policy
User derivation rules.
Radius Servers

Explanation

Question 48 of 165

An administrator is setting up a factory default controller. No new AP groups were created. When
adding a WLAN SSID in the Campus WLAN wizard what AP group is available?

Select one of the following:

The air-monitors AP group
The logon AP group
The default AP group
The initial AP group
The Spectrum AP group

Explanation

Question 49 of 165

The reusable Aruba Controller wizards are accessible in what way?

Select one of the following:

Only on startup through the CLI
Through the CLI, after the initial CLI wizard has been completed
In the Web UI under maintenance.
In the Web UI under configuration.
Must be initialized from CLI first.

Explanation

Question 50 of 165

The Contrtoller wizard enables which of the following controller clock configurations? (Choose
three)

Select one or more of the following:

NTP to a time server
Set time zone
Daylight savings time
Only GMT can be configured
Manual configuration of date and time

Explanation

Question 51 of 165

When configuring ports in the Controller wizard, which of the following are NOT configuration
options? (Choose two)

Select one or more of the following:

Inter-VLAN routing
Speed
Trusted
LACP
Trunk

Explanation

Question 52 of 165

By default, which CLI based remote access method is enabled on Aruba controllers?

Select one of the following:

RSH
Telnet
SSH
Telnet and SSH
Telnet, SSH and RSH

Explanation

Question 53 of 165

An Aruba controller can be accessed with which CLI based remote access methods? (Choose
two)

Select one or more of the following:

RSH
Telnet
SSH
SFTP
SCP

Explanation

Question 54 of 165

As an admin/root user, what other type of role-based management users can be created on Aruba
controllers?

Select one of the following:

Auditing-compliance user
AirWave management user
Reporting Generation user
Guest provisioning user
Maintenance user

Explanation

Question 55 of 165

Which log type should be enabled to troubleshoot IPSec authentication issues on Aruba
Controllers?

Select one of the following:

Security Logs
Management Logs
Wireless Logs
IDS Logs
System Logs

Explanation

Question 56 of 165

Exhibit:

Referring to the above screen capture, if an administrator desires to change a specific AP into a
Spectrum Monitor without assigning the AP to a new group, which menus could be used?

Select one of the following:

Network > Controller
Wireless > AP Configuration
Wireless > AP Installation
Advanced Services > Wireless
Wizards > WIP Wizard

Explanation

Question 57 of 165

A customer forgot all passwords for a controller. What method could you use to reset the
passwords?

Select one of the following:

Telnet to the controller and login to the password recovery account
SSH to the controller and login to the password recovery account
Connect directly to the serial console and login to the password recovery account
Interrupt the boot process at CP-boot and select password recovery
Open the controller and press the reset switch

Explanation

Question 58 of 165

With CPSec disabled, which tunnel protocol is used between APs and Controllers in an Aruba
environment?

Select one of the following:

Basic IP
GRE
IPinIP
Mobile IP
IPSec

Explanation

Question 59 of 165

In an Aruba controller based system, the L3 mobility tunnel exists between the home agent and
which other element?

Select one of the following:

the default gateway
the remote AP
the foreign agent
the mobile node
the foreign switch

Explanation

Question 60 of 165

When an 802.11 client roams what device decides when to move the client to another AP?

Select one of the following:

Aruba AP
Aruba controller
Client
Radius Server
Router

Explanation

Question 61 of 165

Exhibit:

The above diagram has one master and three local controllers. AP1 GRE terminates on controller
Local 1. All controllers are configured with the wireless user VLAN 201. A wireless user
associates with AP 1. Only L2 mobility is enabled.
Which elements will know about this association?

Select one of the following:

Local 1 only
Local 1 and the Master
Local 1 and Local 2 and the Master
Local 1 and AP1
All Controllers

Explanation

Question 62 of 165

Which command will show all client association history?

Select one of the following:

Aruba-6000# show mobile trail current (ip address)
Aruba-6000# show ip mobile trail (ip address)
Aruba-6000# show ap client status (mac address)
Aruba-6000# show current client ip (ip address)
Aruba-6000# show client ip (ip address) mobility

Explanation

Question 63 of 165

With CPSec enabled, which tunnel protocol is used between APs and Controllers in an Aruba
environment?

Select one of the following:

EAP
SSH
IPinIP
Mobile IP
IPSec

Explanation

Question 64 of 165

By default, how long will an AP scan a single channel when ARM is enabled?

Select one of the following:

80 milliseconds
90 milliseconds
100 milliseconds
110 milliseconds
200 milliseconds

Explanation

Question 65 of 165

Which actions does ARM (Adaptive Radio Management) perform? (Choose two)

Select one or more of the following:

Allows controllers to provision the AP Radio type
Allows controllers to provision the best channel for APs
Allows controllers to provision the best power setting for APs
Allows controllers to provision allowed Radio bands
Allows controllers to provision lower power when unauthorized APs are detected

Explanation

Question 66 of 165

Which of the following metrics does the ARM feature use to calculate the optimal channel and
power level for Access Points? (Choose two)

Select one or more of the following:

RF Spectrum Index
Priority Index
Interference Index
Coverage Index
Frequency Index

Explanation

Question 67 of 165

How does the ARM Band Steering feature encourage 5GHz capable clients to move/connect to
the 5GHz radios of Aruba APs?

Select one of the following:

ARM suppresses the probe response on the 2.4 GHz radio
ARM utilizes third party software on the wireless clients
Current Wi-Fi chipset firmware supports this by default
It's not possible the move clients to 5GHz radios when they can see both 2.4 and 5GHz APs
ARM disables the 2.4Ghz radio for the specified client

Explanation

Question 68 of 165

Which of the statements below are TRUE regarding ARM's Spectrum Load Balancing feature?
(Choose two)

Select one or more of the following:

Available only on 5GHz radios
Disabled by default
Balances client load across available channels/APs
Enabled by default
Available only on 2.4GHz radios

Explanation

Question 69 of 165

What is the function of Band Steering?

Select one of the following:

Balancing clients across APs on different channels within the same band
Encourages clients, 5GHz capable, to connect on the 5GHz spectrum
Coordinate access to the same channel across multiple APs
Enables selection of 20 vs. 40 MHz mode of operation per band
Enables acceptable coverage index on both the "b/g" and "a" spectrums

Explanation

Question 70 of 165

What are the Airtime Allocation Policy options for Airtime Fairness? (Choose three)

Select one or more of the following:

Default Access
Priority Access
Fair Access
Preferred Access
Distributed Access

Explanation

Question 71 of 165

Which of the following statements is true of Spectrum Mode?

Select one of the following:

No licenses are required to run an AP in Spectrum mode
Spectrum mode can only be configured for one AP at a time
An AP can be in spectrum mode for both 2.4 and 5G bands at the same time
An AP can be placed in Spectrum Mode via the Spectrum Profile
Spectrum mode can be configured from the GUI under AP installation

Explanation

Question 72 of 165

Which ARM feature addresses the issue of sticky clients by moving clients to associate to APs
with better 802.11 signal quality?

Select one of the following:

Co-Channel interference mitigation
Airtime Fairness
ClientMatch
Coordinated access to a single channel
Band Steering

Explanation

Question 73 of 165

Aruba Client Match does NOT use which of the following parameters to determine the best AP for
a client connection? (Choose two)

Select one or more of the following:

Device type
Location
Signal to Noise Ratio
Access Point load
Spectrum Analysis

Explanation

Question 74 of 165

Which settings cannot be modified directly from a local controller?

Select one of the following:

Port VLAN setting
Switch Time Zone
Port trusted
Roles
SNMP Enable Trap Generation

Explanation

Question 75 of 165

Masters communicate configuration information with locals using which tunnel type?

Select one of the following:

GRE
IP in IP
Provision Tunnel Protocol
IPSec
PPTP

Explanation

Question 76 of 165

In the above screen capture:

The administrator notes that most of the configuration options are grayed out and have no action.
What is the cause of the problem?

Select one of the following:

attempting to make global changes on a Master Controller
attempting to make global changes on a Local Controller
this change can only be performed via the CLI
does not have the correct software license
there is an error in the configuration

Explanation

Question 77 of 165

Exhibit:

Referring to the above screen capture, on which Controller can you create a vlan?

Select one of the following:

Controller 10.1.11.100 only
Controller 10.1.11.101 and 10.254.1.3 only
All three Controllers
None of the Controllers
Controller 10.254.1.101 only

Explanation

Question 78 of 165

Exhibit:

Referring to the above screen capture, on which controller can you add an administrative user and
assign a controller management role?

Select one of the following:

Controller 10.1.11.100 only
Controller 10.1.11.101 and 10.254.1.3 only
All three Controllers
Must be done in the RADIUS server
Controller 10.254.1.101 only

Explanation

Question 79 of 165

Exhibit:

By default, which controller's internal database will be used for user authentication?

Select one of the following:

Controller 10.1.11.100 only
Controller 10.1.11.101 and 10.254.1.3 only
All three Controllers
You can't tell from this screen
The Controller with the user session

Explanation

Question 80 of 165

Exhibit:

Referring to the above screen capture, on which controller can you modify APs configuration to
enable ARM?

Select one of the following:

Controller 10.1.11.100 only
Controller 10.1.11.101 and 10.254.1.3 only
All three Controllers
None of the Controllers
On Controllers where ARM is enabled

Explanation

Question 81 of 165

With CPSec disabled, Aruba access points are Layer 3 connected to controllers using which
protocol?

Select one of the following:

802.1q
LWAPP
PPTP
GRE
HTTPs

Explanation

Question 82 of 165

With CPSec disabled, which encryption protocol does a tunnel mode campus AP use on client
traffic?

Select one of the following:

TKIP and AES
It is provisioned by the Administrator
WEP and AES
WEP, TKIP, and AES
No encryption is used

Explanation

Question 83 of 165

In a campus environment, where are encryption keys sent or stored when users roam between
tunneled mode APs on the same controller using 802.1X?

Select one of the following:

sent to the new AP via GRE
sent to the new AP via IPSec
stored on the controller
stored on the RADIUS server
original AP sends keys to new AP

Explanation

Question 84 of 165

In the diagram provided for this question, the wireless user's laptop is associated with an Aruba
AP in tunnel forwarding mode. The AP terminates on the local controller.

When the client transmits, where will the 802.11 headers be removed?

Select one of the following:

AP
L2 Switch
Router
Controller
Internet

Explanation

Question 85 of 165

When configuring a server group containing 3 servers, a customer chooses 'fail through mode'.
What other configuration option has to be enabled on the controller for this to work with 802.1x
authentication?

Select one of the following:

Machine authentication
EAP Termination
Server group fall through mode
MAC authentication
Round robin or top down mode

Explanation

Question 86 of 165

A campus AP has been provisioned with a VAP in bridge forwarding and standard operation
modes. Which of the following authentication types are supported? (Choose two)

Select one or more of the following:

802.1X authentication
Open System authentication
Local authentication
Captive portal authentication
VPN authentication

Explanation

Question 87 of 165

Which method is NOT supported to provision an Aruba campus AP?

Select one of the following:

Telnet directly to AP
SSH to the AP's controller
Web interface to the AP's controller
Console to AP
CLI on controller

Explanation

Question 88 of 165

When direct consoled to an AP, what is the command sequence to factory default the AP and rebootstrap?

Select one of the following:

setenv bootstat init
setenv master init, boot
purge, save, boot
init, save, boot
print, purge, boot

Explanation

Question 89 of 165

What settings need to be changed on a factory default AP in order for it to use ADP to discover the
Aruba Controller?

Select one of the following:

DNS of the controller
Static route
AP group
enable multicast
no changes needed

Explanation

Question 90 of 165

As illustrated in the above diagram, a company has two campus locations and a building
headquarters all located in different cities.

Following best practices, what would be the best way to construct mobility domains for the
company?

Select one of the following:

Buildings (1, 2) in one domain and Buildings (3, 4, 5, 6) in one domain
Buildings (1, 2) in one domain, Building (3) in one domain, and Buildings (4, 5, 6) in one domain
Buildings (1, 2, 4, 5, 6) in one domain and Building (3) in one domain
Buildings (1, 2, 3, 4, 5, 6) in one domain
Buildings (1) in one domain building (4) in one domain

Explanation

Question 91 of 165

How many Aruba controllers can be added to a single mobility domain?

Select one of the following:

64 controllers of any type
128 controllers supporting 2000 users
256 controllers with no more than 1024 subnets
Controllers supporting up to 6000 AP's
There is no controller limit

Explanation

Question 92 of 165

In a master-local controller scenario, where is the mobility domain defined?

Select one of the following:

the AP group
the master controller
the local controller
the master and the local controllers
the master and the local controllers where roaming is needed

Explanation

Question 93 of 165

A university has 2 departments. Department 1 has its own mobility domain with one controller.
Department 2 has multiple controllers configured in a second domain. The university is planning
on offering a new application and needs users to be able to roam between both mobility domains.

What is the best way to accomplish this?

Select one of the following:

The 2 existing domains should be left as they are. A 3rd mobility domain should then be
created and all 3 controllers need to be added to it
Merge the controllers into the same mobility domain
The IP subnets of all controllers need to be configured to match
This cannot be accomplished
Create a new domain between a department 1 controller and one of the department 2
controllers

Explanation

Question 94 of 165

A port firewall policy is applied to a trunk port that denies controller access. An "allow all" Vlan
firewall policy is applied to VLAN 33 on the same port. A user connected to VLAN 33 on that port
attempts to gain access to the controller. Which of the following statements is true?

Select one of the following:

The Port policy is applied, therefore no controller access
The Vlan policy is applied, then the port policy, therefore no controller access
The Vlan policy is applied, therefore access to the controller is allowed
You cannot place a firewall policy on a Ports Vlan when the Port already has a policy, therefore
no controller access
When locally connected to a controller's port you always have controller access

Explanation

Question 95 of 165

An access port has been placed in trusted mode. The Vlan on the port is in Untrusted mode.
Which of the following statements is true?

Select one of the following:

The traffic is trusted since the port is trusted
The traffic is untrusted since the VLAN is untrusted
This is an invalid configuration, both must be set the same
You cannot set Vlans as trusted or untrusted
Only traffic from that specific port is trusted, all other traffic is untrusted

Explanation

Question 96 of 165

A wired device is connected to an untrusted port on a controller. How can a role be assigned to
the device?

Select one of the following:

An initial Role can be assigned directly to the VLAN
Roles are assigned to devices connected to a trusted port
A default Role can be directly assigned to an untrusted port
Adding a wired AAA profile to a VLAN on the untrusted port
The Role assigned to the untrusted port

Explanation

Question 97 of 165

A port on a controller has been configured as untrusted. No wired access AAA profile or Global
AAA profile is configured. When a user connects to that port which of the following statements is
true?

Select one of the following:

Since there is no wired access AAA profile, only port policies will be applied
The user will fall into the default wired access AAA profile and will be given the initial role.
Since there is no wired access AAA profile or Global AAA profile the user will be given the
logon role.
When configuring the port as untrusted, an error message of "no wired access AAA profile
exists" Therefore this is an invalid configuration
the user is denied all access automatically because no wired access AAA or Global AAA profile
is assigned

Explanation

Question 98 of 165

Which method can APs use to discover a controller?

Select one of the following:

DHCP
Dynamic DNS (DDNS)
PnP
PAPI
HTTPS

Explanation

Question 99 of 165

When APs boot up, in which order do they discover a controller?

Select one of the following:

DNS, DHCP, ADP multicast, ADP unicast, static
static, DNS, DHCP, ADP broadcast, ADP multicast
static, DHCP, ADP multicast, ADP broadcast, DNS
static, DHCP, DNS, ADP multicast, ADP broadcast
DNS, static, ADP multicast, ADP broadcast

Explanation

Question 100 of 165

An AP is not communicating with the controller. Upon investigation you find that the AP is not
discovering its controller through DNS. Instead, it received a DHCP reply with option 43 specifying
the SIP server's IP address. How do you resolve this problem?

Select one of the following:

Statically configure the AP to ignore Option 43
Remove the option 43 configuration on the DHCP server
Statically configure the AP to only use DNS resolution and not other dynamic discovery
methods
After failing option 43 the AP should have proceeded with ADP, therefore the AP is faulty and
needs to be replaced
The AP should be purged

Explanation

Question 101 of 165

How is an AP redirected to a Local controller after DNS resolution returns the Master's IP
address?

Select one of the following:

Master looks at the AP-Group and CONTROLLER-IP attributes
Master looks at the AP-Group and LMS-IP attributes
In the AP-provisioning screen, the LMS-IP attribute must be set
The AP must be statically configured to find the local controller
In the AP-provisioning screen, set the CONTROLLER-IP attribute

Explanation

Question 102 of 165

An AP was configured and assigned to an AP group then powered off for over a week. When the
AP is redeployed, what previous configuration will it retain?

Select one of the following:

It's AP name and AP Group
It's Serial Number
The controller's IP address
After a few days all configurations are lost
The controller IP address and the AP Group

Explanation

Question 103 of 165

A 3600 controller has 64 PEF-NG license, 128 AP licenses and 1 RFProtect license. How many
AP's can terminate on the controller?

Select one of the following:

1 Campus APs
64 Campus APs
128 Remote APs
256 Remote APs
512 Remote APs

Explanation

Question 104 of 165

A 3200 controller has 16 AP licenses,16 PEF-NG licenses, 16 RFProtect licenses. There are 10
Campus APs terminating on the controller. How many remote AP's can terminate on the
controller?

Select one of the following:

Explanation

Question 105 of 165

Centralized licensing is not enabled in a network of 1 Master and 2 Local controllers, what should
be the license count on all controllers to terminate 8 APs on each Local controller and support
Local redundancy?

Select one of the following:

16 AP license on all controllers
8 AP license on Master and 16 AP license on both locals
8 AP license on all controllers
1 AP license on Master and 16 AP license on both locals
16 AP licenses on the Locals

Explanation

Question 106 of 165

An 7240 controller is Licensed for 560 APs. The controller has 500 Campus APs terminating on
the controller. How many Remote APs can terminate on this controller?

Select one of the following:

Explanation

Question 107 of 165

An Aruba Controller is configured with VLAN 1,5, 200, and 4095. All VLANs have IP addresses
assigned. Which is the default management VLAN on the Aruba controller?

Select one of the following:

VLAN 5
VLAN 1
VLAN 200
None, it must be defined
VLAN 4095

Explanation

Question 108 of 165

Which of the following statements is true?

Select one of the following:

Aruba Campus APs must be physically attached to the Aruba Controller
Aruba Campus APs must be in the same broadcast domain as the Controller.
Aruba Campus APs can be in different subnets from the Controller
Aruba Campus APs must be physically attached to the same Layer 3 switch
Aruba Campus APs can be connected directly to the public internet.

Explanation

Question 109 of 165

Exhibit:

Referring to the diagram provided for this question, in which locations must you define the new
data VLANs for wireless client traffic? (Choose two)

Select one or more of the following:

in all L2 switches where an Aruba AP is physically connected
in all APs and the L2 switches to which they are connected
in the Aruba controller and the router it's connected to in an L2 deployment
in the routers and switches where the APs are physically connected
only on the Aruba controller in an L3 deployment

Explanation

Question 110 of 165

A controller is provisioned in L3 Mode for Wireless Users. What must be configured on the
controller to enable DHCP requests to an external DHCP server?

Select one of the following:

an IP helper command
the IP address of the DNS server
the IP address of the APs
the subnet address of the DHCP server
the DHCP server IPSEC Key

Explanation

Question 111 of 165

Which parameter(s) does a Master controller use to determine where a provisioned AP should
terminate its GRE tunnel?

Select one of the following:

the IP address of the AP
the MAC address of the AP
the IP address of the switch nearest to the AP
the name and group settings of the AP
the VLAN the AP is attached to

Explanation

Question 112 of 165

Which of the following configurations can accept a VLAN pool? (Choose two)

Select one or more of the following:

Trunk native VLAN
Virtual AP profile
User Role
Server derived role
FW Policies

Explanation

Question 113 of 165

What does Aruba Layer 3 redundancy require to operate?

Select one of the following:

LMS-IP
Backup LMS-IP
VRRP
Backup AP group
ARM

Explanation

Question 114 of 165

Exhibit:

In the diagram provided for this question, the client laptop is associated with the Aruba AP. The
Aruba controller is configured to perform L2 switching for this SSID.
What will be the client laptop default gateway?

Select one of the following:

Explanation

Question 115 of 165

In the diagram provided for this question, the Aruba controller terminates one end of a GRE tunnel
that carries wireless user traffic.

Where does the other end terminate?

Select one of the following:

A
B
C
D
A or B

Explanation

Question 116 of 165

In the above diagram, the system shows two Aruba access points and a wired user.

Which VLAN(s) do NOT need to be configured on link A between the L2 switch and router to
support the wireless users?

Select one of the following:

101 and 102
101 and 103
102 and 103
only 101
only 103

Explanation

Question 117 of 165

In the above diagram, the system shows two Aruba access points.

Which VLANs must be configured on trunk link D between the router and Aruba controller to
support wireless users when the controller is provisioned for L2 operations?

Select one of the following:

10, 101 and 102
101 and 102
101, 102 and 103
10, 101,102 and 103
10 and 103

Explanation

Question 118 of 165

Exhibit:

Referring to the diagram provided for this question, if the Aruba controller is configured to perform
L3 switching, what will be the wireless client laptop default gateway?

Select one of the following:

Explanation

Question 119 of 165

When configuring Captive Portal, which protocols are supported when accessing the Captive
Portal? (Choose two)

Select one or more of the following:

HTTPS
VPN
HTTP
TELNET
SSH

Explanation

Question 120 of 165

When the controller is configured for Captive Portal and the user is only required to provide an
email address for authentication, which option is configured in the GUI?

Select one of the following:

enable termination
enable guest logon
enable user logon
eap method
disable CP Login

Explanation

Question 121 of 165

A user logged in with the Captive Portal settings shown in the above screen capture.

What does the user need to do to logout?

Select one of the following:

wait 30 minutes then logout
wait 60 minutes then logout
click Logout on the browser screen
he cannot logout
wait 10 seconds for redirect

Explanation

Question 122 of 165

Screenshots of the Captive Portal authentication profile and server group of a guest network are
displayed above.

How was the user authenticated?

Select one of the following:

with a radius server called Radius01
with the Internal database
with a radius server called Internal
with another form of authentication
user wasn't authenticated against any server

Explanation

Question 123 of 165

Where should mobility domains be enabled in a network with 1 master, 1 backup master and 5
local controllers?

Select one of the following:

Only on the master controller
All the local controllers in the network
All the controllers where the client is allowed to roam
Master and backup master
Only on the backup master

Explanation

Question 124 of 165

What are two different methods of configuring AP redundancy between 2 local controllers?
(Choose two)

Select one or more of the following:

Fast-Failover
Configure the locals as remote nodes
Use named VLANS
LMS and Backup LMS IP
AP Redundancy can only be configured between a Master and Local

Explanation

Question 125 of 165

An Aruba 650 controller is functioning as a standby Master. How many APs can it control while in
standby mode?

Select one of the following:

Explanation

Question 126 of 165

Aruba pair of 3200XM controllers are licensed to their maximum and are configured as a VRRP
pair. Each controller terminates 24 APs. One of the controllers fails. How many of the APs from
the failed controller can fail over to the remaining controller?

Select one of the following:

Explanation

Question 127 of 165

Which protocol does the Aruba controller utilize for controller redundancy?

Select one of the following:

HSRP
VRRP
VPN
GRE
IP-IP

Explanation

Question 128 of 165

With Fast-Failover disabled, to which IP address should the Aruba AP terminate its GRE tunnel for
layer 2 controller redundancy to work and to support failover of access points?

Select one of the following:

VRRP IP address
management IP of an Aruba controller
management IP of the backup Aruba controller
HSRP IP address
Loopback IP address of backup Aruba controller

Explanation

Question 129 of 165

When an Aruba 6000 controller has two M3 modules installed, for which uses may the modules be
used? (Choose two)

Select one or more of the following:

hot standby operations
VRRP backup
higher AP density per switch chassis
Active-Active masters
Active-Active master-backup

Explanation

Question 130 of 165

Referring to the diagram provided for this question, an employee brought an unauthorized AP from
home and attached the LAN port to the cubicle Ethernet port. All Aruba APs and AMs as well as
the employee AP are in VLAN 80 and within RF range of each other. No traffic from the wired or
wireless network has passed through the unauthorized AP yet, but the AP began wireless
broadcasts.

How will the Aruba system initially classify the employee's non-Aruba AP?

Select one of the following:

a valid AP
an AM
a Rogue AP
an interfering AP
a known interfering AP

Explanation

Question 131 of 165

Referring to the diagram provided for this question, an employee brought an unauthorized AP from
home and attached it to the cubicle Ethernet port as shown in the diagram. The APs are in VLANs
as shown in the diagram. Only AP1 is within RF range.

How will the Aruba controller classify this AP?

Select one of the following:

an AP
an AM
a Rogue AP
an Interfering AP
a workstation

Explanation

Question 132 of 165

Referring to the diagram provided for this question, an employee brought an unauthorized AP from
home, but did not attach it to the LAN infrastructure. The APs are in the VLANs as shown in the
diagram. Only AP1 is within RF range of the employee AP.

By default, how will the Aruba system classify the employee's AP?

Select one of the following:

an AP
an AM
a Rogue AP
an Interfering AP
a valid workstation

Explanation

Question 133 of 165

What can an AM do that an AP cannot do?

Select one of the following:

Detect rogue APs
Detect an AP failure
Scans all channels in under 1 minute
Detect interfering APs
Scan all valid channels

Explanation

Question 134 of 165

(group8) #show ap active
Active AP Table
---------------
Name Group IP Address 11g Clients 11g Ch/EIRP/MaxEIRP 11a Clients 11a
Ch/EIRP/MaxEIRP
---- ----- ---------- --------- ------------------- ----------- -------------------
AP1 building1 10.1.80.150 0 AM 0 AM
AP2 building1 10.1.80.151 0 AM 0 AM
A user called technical support because they cannot see any of their APs in building one. You
perform the "show" command as illustrated above.
What can you conclude about these two APs from this output?

Select one of the following:

the GRE for the APs terminate on two different controllers: 10.1.80.150 and 10.1.80.151
the system will not function because there is no building1 group defined
the building1 APs will not accept any user connections
the user needs to configure his client to use the b/g band
the user needs to configure his client to use the a band

Explanation

Question 135 of 165

Exhibit:

Based on the above screen capture for Interfering APs, what can you conclude?

Select one of the following:

The APs must be connected to the Aruba network.
The APs are classified as interfering because they are all transmitting on channel 6
There must not be any evidence that the APs are attached to the wired corporate network.
These APs are classified as interfering because they are not Aruba APs.
They are classified as interfering because they are running in g mode.

Explanation

Question 136 of 165

As illustrated in the above diagram and screen capture, a wireless hacker injects messages into
your network to detach a client from your Aruba AP.

What action should you take to identify and prevent the Intruder from connecting to your system?
(Choose two)

Select one or more of the following:

Enable Detect disconnect Station Attack
Enable Spoofed Deauth Blacklist
Take no action as there is no protection against this form of attack
Take no action as the Aruba system ignores this attack because it is against the client
Enable Detect EAP rate Anomaly

Explanation

Question 137 of 165

(group8) #show ap arm history ap-name AP1
Interface :wifi0
ARM History
-----------
Time of Change Old Channel New Channel Old Power New Power Reason
-------------- ----------- ----------- --------- --------- ------
2010-10-28 07:58:53 157+ 149+ 21 21 I
2010-10-28 07:52:06 149+ 157+ 21 21 M
2010-10-28 07:16:59 157+ 149+ 21 21 I
Interface :wifi1
ARM History
-----------
Time of Change Old Channel New Channel Old Power New Power Reason
-------------- ----------- ----------- --------- --------- ------
2010-10-28 08:52:53 6 1 21 21 I
Referring to the output above. What can you conclude about AP1?

Select one of the following:

This device is scanning channels.
This device is unstable because the channel assignment changed.
The device changed channels recently
The device changed channels and power levels recently.
The device is transmitting at maximum power levels.

Explanation

Question 138 of 165

Which of the following parameters can be specified in a rule for AP classification? (Choose three)

Select one or more of the following:

SSID of an AP
Number of clients connected to an AP.
SNR of an AP.
Operating mode of an AP
Discovering APs

Explanation

Question 139 of 165

Which of the following functions can be configured in the Controller WIP wizard? (Choose three)

Select one or more of the following:

Configure APs as Air Monitors
Configure rules for AP classification.
Configure preset levels for intrusion detection
Blacklisting Rules for clients
Identify encryption method used in your network.

Explanation

Question 140 of 165

A client device associates with an SSID provisioned with 802.1X authentication. The client is set for PEAP authentication. EAP termination (AAA Fastconnect) is disabled on the controller. But the
client continuously cycles through the authentication process. Which of the following could cause
this? (Choose two)

Select one or more of the following:

The client is provisioned with the wrong EAP type.
The client has an expired or revoked server certificate.
The DHCP server is not enabled
The VLAN is missing for the SSID.
The controller does not support PEAP in this mode.

Explanation

Question 141 of 165

A client device associates with an SSID provisioned with 802.1X authentication. The client is set
for LEAP authentication. EAP termination (AAA Fastconnect) is enabled on the controller. But the
client continuously cycles through the authentication process. Which of the following could cause
this?

Select one of the following:

The Radius server is rejecting the client credentials.
The client has an expired or revoked server certificate.
The DHCP server is not enabled
The VLAN is missing for the SSID
The controller does not support LEAP in this mode.

Explanation

Question 142 of 165

A client attaches to a secure jack interface set to untrusted. But when the client tries to access the
captive portal page, the following message appears, "Web Authentication is not enabled." What
might be wrong?

Select one of the following:

The client has the browser provisioned with proxy settings.
The controller port needs to be set to trusted
A "aaa" profile needs to be selected on the Wired Access page
A Captive Portal profile needs to be assigned to the initial role.
Web Authentication cannot be used in this way.

Explanation

Question 143 of 165

Which command, when executed on a master controller, will show the APs connected to all
controllers?

Select one of the following:

show stm connectivity
show ap active
show ap database
show ap bss-table
show ap controller-lms

Explanation

Question 144 of 165

Which of the following commands is most useful in showing the traffic of an individual user?

Select one of the following:

show datapath session table
show acl hits
show rights
show firewall
show traffic client

Explanation

Question 145 of 165

An Aruba based network has a Master and four local controllers deployed. But one of the locals, a
new installation, is not seen by the Master. What might be wrong? (Choose two)

Select one or more of the following:

PAPI is not enabled on the local controller.
The master controller can only support three local controllers
IPSec is blocked by the internal network between the local and the master controllers.
The passphrase does not match on the master and local controllers.
GRE is blocked between the master and local controllers

Explanation

Question 146 of 165

An Aruba controller is configured with the correct IP address and gateway information and is
connected to the corporate LAN via a core layer 2 switch. Control Plane Security is not enabled
on the network. An access point is provisioned with AP name and group and connected to a
different Layer 2 switch on the corporate LAN that has IP connectivity to the core layer 2 switch.
The AP powers on and layer 2 connects to the network, but the wireless radios do not power on.
Which could cause this condition? (Choose two)

Select one or more of the following:

the layer 2 switches have ACLs that block GRE traffic
the layer 2 switches are configured to block IPSec traffic
a DHCP server is not configured for the segment to which the AP is connected
the AP's mac address needs to be configured in the Aruba controller whitelist.
the AP and controller are in different subnets

Explanation

Question 147 of 165

In the diagram provided for this question, four buildings are identified on a college campus. Most
of the wireless LAN traffic will be from students accessing the internet.

According to Aruba best practices, which building is the best location to install the Aruba mobility
controller?

Select one of the following:

data center
dormitory
server farm
library
3rd party site

Explanation

Question 148 of 165

Referring to the diagram provided for this question, representing an office wireless LAN
deployment, there will be approximately 250 users in the offices section of the building. All
Switches are setup as L3 routers.

According to Aruba best practice, which network device is the best choice for the wireless clients'
default gateway?

Select one of the following:

device 'A'
device 'B'
device 'C'
device 'D'
device 'C or D'

Explanation

Question 149 of 165

One hundred (100) additional APs were deployed in an existing network. But some APs are not
able to connect to the lms-ip address, even though all of the APs belong to the same AP group.
Which of the following are NOT potential causes? (Choose two)X

Select one or more of the following:

The problem APs are not getting an IP address.
The problem APs have the wrong lms-ip address setting
There is a firewall between the problem APs and the controller blocking PAPI.
The controller does not support that many APs in a single AP-Group.
There are not enough AP licenses to support the additional quantity of APs.

Explanation

Question 150 of 165

IEEE 802.11r provides support for which of the following:

Select one of the following:

radio measurements within a WLAN
radio measurement within an ESS
fast roaming within an ESS
fast roaming within a BSS
roaming across controllers

Explanation

Question 151 of 165

If a Remote AP (RAP) is attempting to contact a controller that is behind a NAT device what
protocol must be allowed through the NAT/Firewall?

Select one of the following:

PAPI
NATT
IPSec
SSH
GRE

Explanation

Question 152 of 165

Which of the following are NOT valid RAP forwarding modes? (Choose two)

Select one or more of the following:

Tunnel
Bridge
Split-Tunnel
Backup
Standard

Explanation

Question 153 of 165

Which of the following are valid RAP operating modes?

Select one of the following:

Always, Backup, Standard, Persistent
Always, Backup, Tunnel, Persistent
Always, Hotel-Connect, Tunnel, Standard
Backup, Hotel-Connect, Standard, Persistent
Backup, Normal, Tunnel, Always

Explanation

Question 154 of 165

When configuring split tunnel mode on a Remote AP (RAP) where is the routing function for the
split tunnel defined?

Select one of the following:

On the IP routing tab in the configuration screen
On the AP provisioning screen.
In the RAP static routing tables
In the Firewall policy
In the RAP whitelist

Explanation

Question 155 of 165

When does a RAP's backup SSID begin broadcasting?

Select one of the following:

When the GRE tunnel to the controller is established
When the IPSec tunnel to the controller is established.
When the controller cannot be reached with PAPI
When bridging is required for guest users
When the controller cannot be reached with SSL

Explanation

Question 156 of 165

A Remote AP provisioned in "Split-Tunnel" Forwarding mode has which characteristic?

Select one of the following:

Local traffic first goes to the controller and is then spilt back to the local network.
Traffic is IPSec encrypted before it is sent to the controller.
The user role must have a "Permit" statement in order to locally bridge the traffic.
The user role must have a "route dst-nat" statement to locally bridge the traffic.
The RAP uses PAPI to send data traffic to the controller

Explanation

Question 157 of 165

A Remote AP was properly functioning before losing it's internet connection and now cannot
communicate with the controller. What SSID is the AP broadcasting?

Select one of the following:

The SSID in Operational mode Always and Forwarding mode Backup
The SSID in Operational mode Split Tunnel and Forwarding mode Bridge
The SSID in Operational mode Always and Forwarding mode Tunnel
The SSID in Operational mode Standard and Forwarding mode Tunnel
The SSID in Operational mode Persistent and Forwarding mode Bridge

Explanation

Question 158 of 165

A Remote AP provisioned with an SSID in "Bridged" forwarding mode has which one of the
following characteristics?

Select one of the following:

The client obtains its IP address from the controller.
The client's default gateway must be the controller.
The client traffic is forwarded through a GRE tunnel to the controller.
The client's default gateway may be the Access Point or a local gateway
The client's authentication must be 802.1X.

Explanation

Question 159 of 165

An AP 105 was converted into a RAP. The RAP can authenticate its IPSec tunnel to a controller
using which of the following methods? (Choose two)

Select one or more of the following:

802.1X/EAP authentication
Captive Portal authentication
IP address authentication
Username/Password authentication
Certificate/MAC address authentication

Explanation

Question 160 of 165

Which of the following describes a Remote AP provisioned in "Split-Tunnel" Forwarding mode?

Select one of the following:

Local user traffic first goes to the controller and is then spilt back to the local network.
All data and control traffic goes to the controller unsecured.
The user role must have a "Permit" statement in order to locally bridge the traffic.
The user role must have a "route src-nat" statement to locally bridge the traffic.
The RAP uses PAPI to send data traffic to the controller.

Explanation

Question 161 of 165

A Remote AP provisioned in "Split-Tunnel" Forwarding mode has which of the following characteristics?

Select one of the following:

Local traffic first goes to the controller and is then spilt back to the local network.
User Traffic is CPSec encrypted before it is sent to the controller.
The user role must have a "Permit" statement in order to locally bridge the traffic
The user role must have a "permit dst-nat" statement to locally bridge the traffic.
The RAP uses UDP 4500 to send traffic to the controller.

Explanation

Question 162 of 165

What is the purpose of Mesh Clusters?

Select one of the following:

To separate Mesh points from Mesh Portals.
To ensure that mesh APs with the same VAPs are not in the same cluster
To define a group of mesh APs that create mesh links with each other.
To cluster mesh APs of the same model together.
To enable mesh APs to join the nearest mesh portal cluster.

Explanation

Question 163 of 165

A company purchased an indoor mesh deployment using the 620 controller and the AP 105
models, where 5 APs will be deployed on a floor to provide wireless internet access for users.
Users may open VPN tunnels using software clients over the wireless network to a 3rd party VPN
concentrator overseas. The company wants to limit wireless user access to TCP traffic locally and
VPN traffic overseas.

In addition to the base AOS, which licenses will be necessary for this deployment?

Select one of the following:

VPN, PEF-NG
AP Capacity, PEF-NG
AP Capacity, PEF-NG, VPN
AP Capacity
PEF-NG, PEF-V

Explanation

Question 164 of 165

When deploying Remote Mesh Portals, what is one of the purposes of the Mesh Private VLAN?

Select one of the following:

To separate wireless user traffic coming from mesh networks from non-mesh networks
To tag mesh wireless user traffic on a particular AP
To allow Mesh Points to form private vlan networks with certain users
To tag control plane traffic from Mesh points to the controller
To tag clients high priority traffic

Explanation

Question 165 of 165

How does an Aruba infrastructure calculate a wireless device's location?

Select one of the following:

GPS
RF Fingerprinting
RSSI triangulation
TDOA
LBS

Explanation

["https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287505/desktop_8e4483fc-8824-4a01-ade8-57d99ab4a4fd.jpg","https://cdn.goconqr.com/uploads/checkbox_question/image/1287516/desktop_a7cfc997-44bc-46ed-b48e-96fff1831749.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287524/desktop_4d338ff4-17cb-41c7-bffe-06d8a7c97946.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287574/desktop_28fca8db-831a-4026-8d06-0b285a05aa01.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287582/desktop_f1b251e0-6eae-4981-b531-ee3a5844b859.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287615/desktop_633df450-6782-4078-b968-82eddea71615.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287714/desktop_72a5b565-7d79-4fb8-9ba6-addceb778208.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287837/desktop_52b24118-9bf2-4bc4-988f-3b9fd6009e81.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1287961/desktop_3369be1a-229b-43bb-97f1-c2e14ff91028.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290392/desktop_abc1f334-044e-496d-b640-8f94de71a384.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290399/desktop_0acafb73-2ea9-4a6b-8f45-07d0fae67d3c.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290404/desktop_079a792d-9698-4300-b40c-05e8b9873550.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290481/desktop_a4800f2c-075a-4d06-a169-80eb623acd9d.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290517/desktop_84e40bd7-6b86-4150-982c-8f663cf9ade2.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290558/desktop_78ba69f4-2007-466d-9a09-e6ce49c89c07.jpg","https://cdn.goconqr.com/uploads/checkbox_question/image/1290872/desktop_9480d04d-0001-4109-b388-b763c370849e.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290947/desktop_9c0f30b1-71e2-4f06-bae0-54cebf472278.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290983/desktop_07e9f075-29f7-4a20-8971-4409ca631a57.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1290997/desktop_c5c2a484-3d96-404c-ab43-b7360ce77ba9.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291009/desktop_b6de69c5-96ae-4386-8cde-5d2af40e8d3d.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291016/desktop_b400c8d4-2d70-4470-a5d6-97296693c7dc.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291045/desktop_9ae9032d-f285-431a-8d42-a01be985188d.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291085/desktop_d8a0cb5e-dece-4acb-bffb-73deb4fa3caa.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291175/desktop_98d63609-3d30-4a2c-89ab-af737bc6e0ea.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291187/desktop_0bd2a9b9-07be-442a-b1dd-f0d235020ccf.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291195/desktop_5f615af0-ed74-4905-8431-4d1715e4e613.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291207/desktop_85dad69e-3452-40eb-8fb3-7f0661b8d4cc.jpg","https://cdn.goconqr.com/uploads/checkbox_question/image/1291226/desktop_12cef38e-10f9-4da7-b332-cc6d7f66b532.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291283/desktop_1dd2e572-eb33-459a-b73a-b9d2fd379c2a.jpg","https://cdn.goconqr.com/uploads/multiple_choice_question/image/1291293/desktop_e558b19b-0651-4fdd-967b-b20abdd053e9.jpg"]

	Created by Juan Javier Sastoque over 9 years ago

Quiz on EXAMEN ANUAL, created by Juan Javier Sastoque on 19/03/2015.

EXAMEN ANUAL

EXAMEN ANUAL

Question 1 of 165

Which of the following Aruba controllers is able to provide IEEE 802.3af? (Choose two)

Select one or more of the following:

Explanation

Question 2 of 165

What is the maximum number of remote APs supported by a 3600 controller?

Select one of the following:

Explanation

Question 3 of 165

Which dual radio access point models support concurrent operations in the 2.4Ghz band as well as the 5Ghz band? (Choose three)

Select one or more of the following:

Explanation

Question 4 of 165

Which of the following APs do NOT support dual radio operations? (Choose two)

Select one or more of the following:

Explanation

Question 5 of 165

Centralized licensing is not in use on an Aruba based network which has a Master and three local controllers. No APs terminate on the Master controller. Roles and Firewall policies need to be created and applied, hence PEF-NG license is required

Select one of the following:

Explanation

Question 6 of 165

What information do you need to generate a feature license key for an Aruba controller?

Select one of the following:

Explanation

Question 7 of 165

What are the PEF-NG license limits based on?

Select one of the following:

Explanation

Question 8 of 165

Which of the following licenses are consumed by Mesh APs advertising an SSIDs?

Select one of the following:

Explanation

Question 9 of 165

The permanent licenses on the controller will be deleted with the use of which command?

Select one of the following:

Explanation

Question 10 of 165

A network administrator wants to terminate VPN sessions on a local controller in the DMZ. Which statement is true about the PEF-VPN license?

Select one of the following:

Explanation

Question 11 of 165

What is the best practice regarding licensing for a backup master to support Master Redundancy in a network without centralized licensing?

Select one of the following:

Explanation

Question 12 of 165

Which of the following licenses can be included in the licensing pool for centralized licensing? (Choose three)

Select one or more of the following:

Explanation

Question 13 of 165

By default Centralized licensing messages between master controllers are sent

Select one of the following:

Explanation

Question 14 of 165

Which of the following will occur if a master license server fails with no standby server present? (Choose two)

Select one or more of the following:

Explanation

Question 15 of 165

Which may be applied directly to an VLAN interface? (Choose three)

Select one or more of the following:

Explanation

Question 16 of 165

When creating a firewall rule on an Aruba controller, which parameter is optional?

Select one of the following:

Explanation

Question 17 of 165

An administrator creates a WLAN with an unmodified default AAA profile. What is the default role the user is placed in?

Select one of the following:

Explanation

Question 18 of 165

What is the first role a user is given when a user associates to an open WLAN?

Select one of the following:

Explanation

Question 19 of 165

Which of the following could be used to set a user's post-authentication role or VLAN association? (Choose two)

Select one or more of the following:

Explanation

Question 20 of 165

Which dual radio access point models support concurrent operations in the 2.4Ghz band as well
as the 5Ghz band? (Choose three)

Centralized licensing is not in use on an Aruba based network which has a Master and three local
controllers. No APs terminate on the Master controller. Roles and Firewall policies need to be
created and applied, hence PEF-NG license is required

A network administrator wants to terminate VPN sessions on a local controller in the DMZ. Which
statement is true about the PEF-VPN license?

What is the best practice regarding licensing for a backup master to support Master Redundancy
in a network without centralized licensing?

Which of the following licenses can be included in the licensing pool for centralized licensing?
(Choose three)

Which of the following will occur if a master license server fails with no standby server present?
(Choose two)

An administrator creates a WLAN with an unmodified default AAA profile. What is the default role
the user is placed in?

Which of the following could be used to set a user's post-authentication role or VLAN association?
(Choose two)

Which of the following firewall rules allows a user to initiate an ICMP session to other devices?
(Choose two)

The Aruba Policy Enforcement Firewall (PEF-NG) module supports destination network address
translation (dst-nat).
Which is the default use of this statement in an Aruba controller configuration?

The Aruba Policy Enforcement Firewall (PEF) module supports source network address
translation (src-nat).
Which is a use of this statement in an Aruba configuration?

ip access-list session anewone

user network 10.1.1.0 255.255.255.0 any permit

user host 10.1.1.1 any deny

user any any permit

Referring to the above portion of a Mobility Controller configuration file, what can you conclude?
(Choose two)

An administrator wants to assign a VLAN to a user based upon the authentication process using
Vendor Specific Attributes (VSA). Where are Aruba Vendor Specific Attribute (VSA) values
provisioned?