I85PREP
⌘ K
Aruba Network Security Expert (Written) study materials
Aruba Network Security Expert (Written) study resources

Aruba Network Security Expert (Written) practice questions

One question at a time. Build your Aruba Network Security Expert (Written) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Architecture and Design

In a role-based access control design for Aruba ClearPass, which element maps authenticated users to a set of authorization rights?

  1. The service
  2. The role Correct answer.
  3. The enforcement profile
  4. The policy server

Explanation

A role is the logical grouping of privileges assigned to an authenticated identity, and enforcement policies reference roles to decide authorization. Enforcement profiles define the actual attributes returned to the network device. Services tie together authentication and role mapping for a given connection type.

Question 2Network Security Architecture and Design

Which Aruba architecture places all control-plane functions in a central mobility controller while access points operate as thin devices?

  1. Controller-less overlay architecture
  2. Instant AP cluster architecture
  3. Distributed control-plane architecture
  4. Controller-based (centralized) architecture Correct answer.

Explanation

In a controller-based design the mobility controller terminates tunnels and handles control-plane and data-plane functions for thin APs. Instant AP clusters push control functions into the APs themselves. Controller-less designs move the control plane to gateways or overlay fabrics.

Question 3Network Security Architecture and Design

A design team wants to isolate guest wireless traffic so it exits directly to the internet from the access point while corporate traffic is tunneled to the controller. Which capability supports this?

  1. 802.1X with EAP-TLS
  2. Client isolation within the SSID
  3. Role-based VLAN assignment only
  4. Split tunneling with a guest role Correct answer.

Explanation

Split tunneling lets a controller-based design forward selected traffic (typically guest) locally at the AP while other traffic is tunneled. Role-based VLAN assignment changes the VLAN but does not by itself define a local breakout path. Client isolation only blocks peer-to-peer traffic within a VLAN.

Question 4Network Security Architecture and Design

Which Aruba design component is responsible for enforcing stateful firewall policy and role-based access for wireless clients in a controller-based network?

  1. The DHCP server
  2. The access point radio
  3. The ClearPass policy manager
  4. The mobility controller Correct answer.

Explanation

The mobility controller applies stateful firewall policies and user roles to traffic in a controller-based design. ClearPass authenticates and authorizes but does not forward or filter the data path. AP radios and DHCP servers play no role-based enforcement function.

Question 5Network Security Architecture and Design

What is the primary security benefit of placing Aruba gateways at the WAN edge in a distributed enterprise design?

  1. Eliminating the need for authentication
  2. Removing the requirement for encryption
  3. Centralizing policy enforcement for branch traffic Correct answer.
  4. Increasing wireless channel width

Explanation

Branch gateways enforce consistent security policy and tunnel traffic to a central gateway, giving centralized control over distributed traffic. They do not remove authentication or encryption requirements. Channel width is a radio configuration unrelated to gateway placement.

Question 6Network Security Architecture and Design

Which EAP method provides mutual certificate-based authentication and is commonly recommended for strong wireless security in an Aruba design?

  1. EAP-MD5
  2. PAP
  3. PEAP-MSCHAPv2
  4. EAP-TLS Correct answer.

Explanation

EAP-TLS requires certificates on both the client and the server, delivering mutual certificate-based authentication and strong resistance to credential theft. PEAP-MSCHAPv2 uses server certificates but password-based client credentials. EAP-MD5 and PAP provide no strong mutual authentication.

Question 7Network Security Architecture and Design

An administrator needs to ensure that only corporate-managed devices connect to a sensitive SSID. Which ClearPass capability best supports this requirement?

  1. Onboard device provisioning with certificate-based authorization Correct answer.
  2. Open authentication with a hidden SSID
  3. Captive portal with a shared password
  4. MAC authentication against a local list

Explanation

Onboard provisioning issues unique device certificates that ClearPass can validate, binding access to managed devices. MAC authentication can be spoofed and a shared password is not device-specific. A hidden SSID provides no authentication.

Question 8Network Security Architecture and Design

Which statement describes the function of a TPM in an Aruba ClearPass onboarding design?

  1. It terminates wireless tunnels
  2. It assigns IP addresses to endpoints
  3. It stores device credentials and keys in hardware Correct answer.
  4. It enforces firewall policy on the controller

Explanation

A Trusted Platform Module is a hardware component that securely stores keys and credentials used for device identity and attestation. DHCP assigns addresses, controllers terminate tunnels, and controllers enforce firewall policy.

Question 9Network Security Architecture and Design

A security architect wants wireless traffic between clients on the same SSID to be blocked while still allowing each client to reach the internet. Which design element achieves this?

  1. Band steering
  2. WPA3-SAE transition mode
  3. Client isolation on the SSID Correct answer.
  4. A larger DHCP scope

Explanation

Client isolation prevents direct client-to-client traffic while permitting each client to reach upstream networks. DHCP scope size and WPA3 transition mode do not affect peer-to-peer traffic. Band steering only influences which radio a client uses.

Question 10Network Security Architecture and Design

Which deployment model for Aruba ClearPass places policy evaluation at the local node to reduce WAN dependency for branch authentication?

  1. Standalone policy manager per site Correct answer.
  2. Single centralized policy manager only
  3. Controller-only authentication
  4. Cloud-only authentication

Explanation

A standalone or distributed ClearPass deployment at each site allows local policy evaluation so branch access survives WAN outages. A single centralized server creates a WAN dependency. Controllers and cloud services do not replace local policy evaluation in this model.

Question 11Network Security Architecture and Design

Which Aruba feature allows a single SSID to present different network access based on the authenticated user's role?

  1. SSID hiding
  2. Static WEP key rotation
  3. Role-based access with per-role VLAN and ACL assignment Correct answer.
  4. Transmit power tuning

Explanation

Role-based access assigns a role after authentication and applies that role's VLAN and ACL, letting one SSID serve multiple user classes. WEP rotation, SSID hiding, and power tuning do not differentiate access by identity.

Question 12Network Security Architecture and Design

Which protocol should be used to protect RADIUS traffic between a controller and ClearPass?

  1. Syslog over UDP
  2. RADSEC over TLS Correct answer.
  3. TACACS+ over cleartext
  4. SNMPv2c

Explanation

RADSEC wraps RADIUS in TLS to provide confidentiality and integrity for authentication traffic. SNMPv2c and syslog over UDP are not authentication transports, and TACACS+ in cleartext lacks encryption.

Question 13Network Security Architecture and Design

In an Aruba design, what is the purpose of a downloadable user role?

  1. To assign a public IP address
  2. To deliver role and policy attributes from ClearPass to the controller Correct answer.
  3. To authenticate the RADIUS server
  4. To encrypt the wireless frame

Explanation

A downloadable user role carries role and policy attributes from ClearPass to the controller so it can enforce authorization decisions. Frame encryption is handled by 802.11 security, and address assignment is a DHCP function. The RADIUS server authenticates to the controller, not the reverse.

Question 14Network Security Architecture and Design

A guest network design must allow visitors to register and gain limited internet access without IT involvement. Which ClearPass feature best fits?

  1. EAP-TLS onboarding
  2. Static PSK per user
  3. 802.1X with machine certificates
  4. Self-registration guest portal Correct answer.

Explanation

A self-registration guest portal lets visitors create accounts and receive sponsor or self approval for limited access. EAP-TLS onboarding and machine-certificate 802.1X are for managed devices, not visitors. Static PSKs do not scale and are not guest-friendly.

Question 15Network Security Architecture and Design

Which design principle most directly limits lateral movement between IoT devices on the same wireless network?

  1. Enabling band steering
  2. Segmenting IoT into a dedicated SSID and VLAN with restrictive ACLs Correct answer.
  3. Increasing the DHCP lease time
  4. Using WPA2-PSK on the corporate SSID

Explanation

Placing IoT devices on a dedicated SSID and VLAN with restrictive ACLs confines their traffic and blocks lateral movement to other segments. Band steering, lease time, and PSK settings do not create segmentation.

Question 16Network Security Architecture and Design

Which Aruba component provides a centralized point to apply firewall policy to traffic from both wired and wireless clients in a campus design?

  1. The RADIUS client
  2. The access switch only
  3. The DNS server
  4. The mobility controller or gateway Correct answer.

Explanation

Mobility controllers and gateways apply stateful firewall policy to wired and wireless traffic in a campus design. Access switches can apply ACLs but are not the centralized policy point for both media. DNS servers and RADIUS clients do not enforce firewall policy.

Question 17Network Security Architecture and Design

What does the Aruba Policy Enforcement Firewall use to identify a user's role after authentication?

  1. The DHCP option 43 value
  2. The AP's serial number
  3. The client's MAC OUI only
  4. Attributes returned in the RADIUS Access-Accept Correct answer.

Explanation

Role assignment relies on attributes such as Filter-Id or vendor-specific attributes returned in the RADIUS Access-Accept. MAC OUI, DHCP option 43, and AP serial numbers do not carry authorization role information.

Question 18Network Security Architecture and Design

Which consideration is most important when designing RADIUS server redundancy for a large Aruba wireless deployment?

  1. Relying on MAC caching only
  2. Disabling accounting to reduce load
  3. Configuring multiple RADIUS servers with failover in the AAA profile Correct answer.
  4. Using a single server with a longer timeout

Explanation

Multiple RADIUS servers referenced in the AAA profile allow the controller to fail over if the primary is unavailable. A single server with longer timeouts increases outage risk. Disabling accounting and MAC caching do not provide authentication redundancy.

Question 19Network Security Architecture and Design

Which WLAN security mode should be selected to meet a requirement for protected management frames and simultaneous authentication of equals?

  1. WPA2-PSK with TKIP
  2. WEP with 128-bit keys
  3. WPA3-Enterprise or WPA3-Personal (SAE) Correct answer.
  4. Open with MAC filtering

Explanation

WPA3 mandates protected management frames and, in personal mode, uses SAE for simultaneous authentication of equals. WPA2-PSK with TKIP, WEP, and open networks lack these protections.

Question 20Network Security Architecture and Design

A design requires that wireless clients be denied access when their endpoint posture is non-compliant. Which ClearPass capability enables this?

  1. Band steering
  2. Posture assessment integrated into the service policy Correct answer.
  3. Static PSK rotation
  4. SSID broadcast suppression

Explanation

Posture assessment evaluates endpoint health and feeds the result into the service policy so non-compliant devices can be denied or remediated. PSK rotation, band steering, and SSID suppression do not evaluate endpoint state.

Question 21Network Security Architecture and Design

Which statement best describes the security role of an Aruba Mobility Master (or central management) node in a large design?

  1. It terminates guest internet sessions
  2. It assigns wireless channels
  3. It forwards all client data traffic
  4. It provides centralized configuration and policy orchestration for managed controllers Correct answer.

Explanation

A central management node orchestrates configuration and policy across managed controllers rather than forwarding client data. Data forwarding and guest termination remain on controllers or gateways, and channel assignment is an RF function.

Question 22Network Security Architecture and Design

In a design using Aruba Central for management, which practice best protects the management plane?

  1. Sharing a single administrator account
  2. Disabling audit logging
  3. Exposing management over the open internet without restrictions
  4. Restricting management access with role-based accounts and strong authentication Correct answer.

Explanation

Management-plane security depends on least-privilege role-based accounts, strong authentication, and restricted reachability. Shared accounts, unrestricted internet exposure, and disabled logging weaken accountability and attack surface.

Question 23Network Security Architecture and Design

Which design choice reduces the risk of rogue access points being connected to the corporate wired network?

  1. Increasing AP transmit power
  2. Using WPA2-PSK on guest
  3. Enabling wired port authentication with 802.1X on access ports Correct answer.
  4. Broadcasting more SSIDs

Explanation

802.1X port authentication on access ports prevents unauthorized devices, including rogue APs, from gaining wired access. Additional SSIDs, higher transmit power, and guest PSK settings do not control wired port admission.

Question 24Network Security Architecture and Design

Which Aruba ClearPass feature allows an administrator to simulate and preview policy decisions before deployment?

  1. RADIUS accounting logs
  2. Policy simulation in the policy manager Correct answer.
  3. SNMP traps
  4. Packet capture on the controller

Explanation

Policy simulation evaluates sample requests against configured services and policies to preview decisions before they affect production. Packet capture, accounting logs, and SNMP traps observe live behavior but do not preview policy outcomes.

Question 25Network Security Architecture and Design

A hospital must keep medical device traffic separated from staff traffic while allowing both to use the same physical APs. Which design approach best satisfies this?

  1. Disabling encryption on both groups
  2. Multiple SSIDs mapped to distinct VLANs with role-based ACLs Correct answer.
  3. Using the same PSK for all devices
  4. A single SSID with one flat VLAN

Explanation

Separate SSIDs mapped to distinct VLANs with role-based ACLs isolate device groups while sharing the same physical infrastructure. A flat VLAN, disabled encryption, and a shared PSK remove the separation the requirement demands.

Question 26Network Security Architecture and Design

Which security mode on an Aruba WLAN provides per-session encryption keys derived during 802.1X authentication, preventing one client's traffic from being decrypted by another client?

  1. WPA2-Enterprise with AES-CCMP Correct answer.
  2. Open authentication with MAC filtering
  3. Static WEP with a shared key
  4. WPA2-Personal with a pre-shared key

Explanation

WPA2-Enterprise uses 802.1X to authenticate each client and derive unique pairwise keys, so traffic is encrypted per session. Personal and static-key modes share one key across all clients, and open authentication provides no encryption.

Question 27Network Security Architecture and Design

Which Aruba ClearPass feature is used to define the ordered set of services, role mappings, and enforcement profiles that determine how a connecting endpoint is treated?

  1. Service
  2. Enforcement Policy Correct answer.
  3. Role Mapping Policy
  4. Policy

Explanation

An enforcement policy is the ordered rule set that evaluates conditions and assigns enforcement profiles, which apply role and VLAN changes. Services trigger evaluation, while role mapping and policy objects are components referenced within that evaluation.

Question 28Network Security Architecture and Design

An architect must ensure that a wireless client's traffic is tunneled to a Mobility Controller even when the client associates to a remote AP in a branch office. Which Aruba deployment mode should be selected for that SSID?

  1. Bridge mode
  2. Split-tunnel mode
  3. Decrypt-tunnel mode
  4. Tunnel mode Correct answer.

Explanation

Tunnel mode forwards all client traffic over a GRE tunnel to the controller, where policy is enforced centrally. Bridge and split-tunnel modes forward traffic locally at the AP, and decrypt-tunnel mode is used for specific traffic inspection scenarios, not full central forwarding.

Question 29Network Security Architecture and Design

Which Aruba design element provides a dedicated, out-of-band path for administrative access to network devices so that management traffic is isolated from user traffic?

  1. A native VLAN carrying untagged traffic on trunk ports
  2. A voice VLAN with QoS prioritization
  3. A guest VLAN with captive portal authentication
  4. A management VLAN with ACLs restricting access to authorized administrators Correct answer.

Explanation

A dedicated management VLAN, protected by ACLs that permit only authorized administrative hosts, isolates management traffic from user data. Guest and voice VLANs serve user traffic, and the native VLAN is a trunking concept, not a management isolation control.

Question 30Network Security Architecture and Design

A design must ensure that a compromised IoT device on a wireless network cannot initiate connections to staff workstations on a different VLAN. Which Aruba design approach most directly enforces this requirement?

  1. Applying a per-user bandwidth contract to the IoT role
  2. Enabling 802.11k and 802.11v to improve roaming for IoT devices
  3. Enabling broadcast filtering on the IoT SSID to reduce multicast traffic
  4. Assigning IoT devices to a dedicated role with a stateful firewall policy that denies inter-VLAN initiation Correct answer.

Explanation

A role-based stateful firewall policy on the controller or gateway can deny IoT-initiated sessions to other VLANs while permitting required outbound flows. Broadcast filtering, bandwidth contracts, and roaming assistance do not enforce inter-VLAN access control.

Question 31Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

In an 802.1X deployment, which component acts as the enforcement point that relays authentication messages between the supplicant and the authentication server?

  1. The certificate authority
  2. The authenticator Correct answer.
  3. The authentication server
  4. The supplicant

Explanation

802.1X defines three roles: the supplicant (client), the authenticator (the switch or controller port that controls access), and the authentication server (typically RADIUS). The authenticator does not make the final authentication decision; it relays EAP messages and enforces the result by opening or blocking the port.

Question 32Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which RADIUS message does a network access device send to the RADIUS server to request authentication of a user?

  1. Accounting-Request
  2. Access-Accept
  3. Access-Request Correct answer.
  4. Access-Challenge

Explanation

An Access-Request carries the user credentials or EAP payload from the network access device to the RADIUS server. Access-Accept and Access-Challenge are server responses, and Accounting-Request is used for usage logging rather than authentication.

Question 33Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

What is the primary purpose of a role in an Aruba role-based access control design?

  1. To define a set of permissions and policies applied to a user or device after authentication Correct answer.
  2. To assign a VLAN to each switch port
  3. To encrypt RADIUS shared secrets between devices
  4. To determine which certificate authority signs the server certificate

Explanation

A role is a named collection of permissions, such as firewall policies, VLAN assignment, and session attributes, that is applied to a client after it authenticates. Roles decouple policy from physical port location so the same port can serve users with different privileges.

Question 34Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which EAP method encapsulates authentication inside a TLS tunnel established before the client credentials are exchanged?

  1. EAP-TLS
  2. PEAP Correct answer.
  3. EAP-MD5
  4. LEAP

Explanation

PEAP first builds a TLS tunnel using a server certificate and then runs an inner authentication method inside it, protecting user credentials. EAP-TLS uses certificates for both client and server but does not use an inner method, and EAP-MD5 and LEAP provide no tunnel.

Question 35Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

A company wants switches to authenticate users against a central directory and apply per-user policies. Which server role must be configured to receive 802.1X requests?

  1. A RADIUS server Correct answer.
  2. A DHCP server
  3. A DNS server
  4. An NTP server

Explanation

RADIUS is the protocol used by 802.1X authenticators to forward credentials to a central authentication server and receive authorization attributes. DHCP, DNS, and NTP provide addressing, name resolution, and time synchronization, not authentication.

Question 36Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which attribute is commonly returned by a RADIUS server to tell the network device which VLAN a client should be placed in?

  1. Acct-Session-Id
  2. NAS-Identifier
  3. Calling-Station-Id
  4. Tunnel-Type and Tunnel-Private-Group-ID Correct answer.

Explanation

VLAN assignment is conveyed using the tunnel attributes, where Tunnel-Type is set to VLAN and Tunnel-Private-Group-ID carries the VLAN identifier. The other attributes describe the device, the client MAC, or the accounting session and do not assign a VLAN.

Question 37Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which protocol allows a network device to send user authentication and authorization requests to a central server and receive policy attributes in return?

  1. STP
  2. SNMP
  3. RADIUS Correct answer.
  4. LLDP

Explanation

RADIUS is the AAA protocol used for authentication, authorization, and accounting of network access. SNMP is for device management, STP prevents Layer 2 loops, and LLDP is a neighbor discovery protocol.

Question 38Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

What does MAC authentication (MAC-based authentication) verify when a device connects to the network?

  1. The device's MAC address against a configured list or directory Correct answer.
  2. The device's IP address against a DHCP scope
  3. The device's user certificate
  4. The device's DNS suffix

Explanation

MAC authentication uses the client's MAC address as the credential, checked against a local list or a RADIUS directory. It is common for devices that cannot run an 802.1X supplicant, though it provides weak security because MAC addresses can be spoofed.

Question 39Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

A client authenticates successfully with 802.1X, but the RADIUS server returns no VLAN attribute. What typically happens to the client's traffic?

  1. The client is placed in the role or VLAN configured for the port or initial state Correct answer.
  2. The client is assigned to VLAN 1 regardless of any port configuration
  3. The client is denied all network access permanently
  4. The client receives a new certificate from the RADIUS server

Explanation

When no authorization attributes are returned, the device applies the default or initial role and VLAN configured for that port or user role. Access is not automatically denied, and VLAN 1 is not a universal fallback.

Question 40Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which statement best describes the difference between authentication and authorization in an AAA framework?

  1. Authentication and authorization are interchangeable terms
  2. Authentication determines permissions; authorization verifies identity
  3. Authentication applies to devices; authorization applies only to users
  4. Authentication verifies identity; authorization determines what the identity may do Correct answer.

Explanation

Authentication establishes who the client is, while authorization decides which resources and policies that identity may use. In RADIUS, the Access-Accept with attributes is where authorization is expressed.

Question 41Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

An administrator wants the RADIUS server to verify client certificates during EAP-TLS. Which configuration is required on the server side?

  1. A shared secret only
  2. A trusted CA certificate used to validate the client certificate chain Correct answer.
  3. An SNMP community string
  4. A DHCP reservation for each client

Explanation

EAP-TLS requires mutual certificate validation, so the server must trust the CA that issued the client certificates. The shared secret protects RADIUS messages but does not validate client certificates, and DHCP or SNMP settings are unrelated.

Question 42Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which RADIUS response indicates that the server needs additional information from the client before it can decide?

  1. Access-Accept
  2. Accounting-Response
  3. Access-Challenge Correct answer.
  4. Access-Reject

Explanation

Access-Challenge asks the network access device to prompt the client for more data, such as an OTP, before a final decision. Access-Accept and Access-Reject are final outcomes, and Accounting-Response acknowledges accounting packets.

Question 43Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

A network uses role-based access control. A user authenticates successfully but is placed in a role that restricts access to a specific subnet. Which component enforces that restriction?

  1. The RADIUS server directly filters the user's packets
  2. The client operating system firewall
  3. The network access device applies the role's policies to the user's traffic Correct answer.
  4. The DNS server resolves only permitted names

Explanation

The RADIUS server returns role information, but enforcement occurs on the network access device, which applies the role's policies such as ACLs or firewall rules to the client's traffic. The server does not sit inline to filter packets.

Question 44Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which EAP method provides only one-way authentication of the client to the server without a server certificate and is considered insecure for wireless?

  1. EAP-TLS
  2. PEAP
  3. EAP-MD5 Correct answer.
  4. EAP-TTLS

Explanation

EAP-MD5 authenticates the client with a hash-based challenge but does not authenticate the server and provides no key material, making it vulnerable to rogue servers. EAP-TLS, PEAP, and EAP-TTLS all use TLS and provide server authentication.

Question 45Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

A company wants devices that cannot run an 802.1X supplicant to still be authenticated. Which approach is most appropriate?

  1. Disable authentication on all ports
  2. Require EAP-TLS on those devices
  3. Use WEP for those devices
  4. Use MAC authentication as a fallback method Correct answer.

Explanation

MAC authentication lets devices without supplicants present their MAC address as a credential, often configured as a fallback after 802.1X times out. Disabling authentication removes security, EAP-TLS requires a supplicant, and WEP is a deprecated wireless encryption method.

Question 46Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which attribute is used by a RADIUS server to identify the network access device that sent the request?

  1. Framed-IP-Address
  2. Session-Timeout
  3. NAS-IP-Address Correct answer.
  4. User-Password

Explanation

NAS-IP-Address identifies the network access device (the RADIUS client) so the server can apply device-specific policy and shared secrets. User-Password carries credentials, Framed-IP-Address assigns a client address, and Session-Timeout limits session duration.

Question 47Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

What is the main security benefit of using a TLS tunnel in PEAP or EAP-TTLS?

  1. It protects inner credentials and prevents rogue-server credential theft Correct answer.
  2. It eliminates the need for a RADIUS server
  3. It allows the client to skip authentication
  4. It compresses authentication traffic to reduce latency

Explanation

The TLS tunnel encrypts the inner authentication exchange so credentials are not exposed, and server certificate validation prevents clients from trusting a rogue access point. It does not remove the need for a RADIUS server or skip authentication.

Question 48Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which RADIUS message pair is used to start and stop accounting records for a user session?

  1. CoA-Request and Disconnect-Request
  2. Access-Request and Access-Accept
  3. Access-Challenge and Access-Reject
  4. Accounting-Request Start and Accounting-Request Stop Correct answer.

Explanation

Accounting uses Accounting-Request messages with a status of Start and Stop to mark session boundaries. Access messages handle authentication, and CoA or Disconnect messages are used to change or terminate sessions dynamically.

Question 49Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

A client fails 802.1X authentication but the port is configured with a MAC authentication fallback. What is the expected behavior?

  1. The device places the client in the server VLAN
  2. The device sends the client a new certificate
  3. The device attempts MAC authentication using the client's MAC address Correct answer.
  4. The device immediately blocks the port permanently

Explanation

With MAC authentication fallback, after the 802.1X attempt fails or times out the device tries MAC authentication as an alternative credential. The port is not permanently blocked, and no certificate is issued by the switch.

Question 50Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Which statement about the RADIUS shared secret is correct?

  1. It is a pre-shared key used to authenticate and integrity-protect messages between the network device and the RADIUS server Correct answer.
  2. It is only used for accounting packets
  3. It is the same as the user's password
  4. It is sent in cleartext with every Access-Request

Explanation

The shared secret is a pre-shared key configured on both the network access device and the RADIUS server; it protects the integrity of RADIUS messages and obscures sensitive attributes. It is never transmitted in cleartext and is distinct from user credentials.