I85PREP
⌘ K
Aruba Network Security Professional study materials
Aruba Network Security Professional study resources

Aruba Network Security Professional practice questions

One question at a time. Build your Aruba Network Security Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Fundamentals and Threat Landscape

Which security principle states that a user should be granted only the minimum access required to perform their job function?

  1. Defense in depth
  2. Least privilege Correct answer.
  3. Separation of duties
  4. Zero trust

Explanation

Least privilege limits each account to only the permissions necessary for its assigned tasks, reducing the blast radius of a compromise. Separation of duties divides critical tasks among different people, while defense in depth layers controls and zero trust removes implicit trust based on location.

Question 2Network Security Fundamentals and Threat Landscape

An attacker sends a victim an email that appears to come from the victim's bank and directs them to a lookalike login page. Which attack type is this?

  1. Smurfing
  2. Phishing Correct answer.
  3. Tailgating
  4. Bluejacking

Explanation

Phishing uses spoofed communications to trick recipients into revealing credentials or visiting fraudulent sites. Smurfing is a volumetric network attack, bluejacking targets Bluetooth devices, and tailgating is physical unauthorized entry.

Question 3Network Security Fundamentals and Threat Landscape

Which characteristic best distinguishes a worm from a virus?

  1. A worm requires a host file to execute
  2. A worm only affects mobile devices
  3. A worm self-propagates across networks without user action Correct answer.
  4. A worm encrypts files for ransom

Explanation

Worms spread autonomously by exploiting network services, whereas viruses need a host file and typically require user interaction to propagate. Ransomware describes the payload behavior, not the propagation method.

Question 4Network Security Fundamentals and Threat Landscape

What is the primary purpose of a DMZ in a network architecture?

  1. To encrypt all internal traffic
  2. To isolate internet-facing services from the internal network Correct answer.
  3. To replace the need for firewalls
  4. To provide backup power to network devices

Explanation

A DMZ places publicly reachable services in a segmented zone so that compromise of those hosts does not directly expose the internal LAN. It is a segmentation control, not an encryption or availability mechanism.

Question 5Network Security Fundamentals and Threat Landscape

Which term describes the confidentiality impact of data being altered without authorization?

  1. Integrity Correct answer.
  2. Authentication
  3. Availability
  4. Non-repudiation

Explanation

Integrity ensures data is not modified in an unauthorized or undetected manner. Availability concerns access to data when needed, non-repudiation prevents denial of an action, and authentication verifies identity.

Question 6Network Security Fundamentals and Threat Landscape

A rogue device connects to an open switch port in a lobby and begins sending traffic onto the corporate VLAN. Which control most directly prevents this?

  1. Deploying a signature-based IDS
  2. Configuring a syslog server
  3. Enabling NTP authentication
  4. Enabling port security with MAC limits Correct answer.

Explanation

Port security restricts which and how many MAC addresses may appear on an access port, so an unauthorized device cannot simply plug in and transmit. An IDS detects but does not block, and syslog and NTP are supporting services.

Question 7Network Security Fundamentals and Threat Landscape

Which protocol is the secure replacement for Telnet when remotely managing network devices?

  1. SSH Correct answer.
  2. TFTP
  3. SNMPv1
  4. FTP

Explanation

SSH provides encrypted, authenticated remote shell access and replaces the cleartext Telnet protocol. FTP, TFTP, and SNMPv1 all lack strong confidentiality protections.

Question 8Network Security Fundamentals and Threat Landscape

What does a risk assessment typically combine to produce a risk value?

  1. Latency and jitter
  2. Threat and vulnerability Correct answer.
  3. Bandwidth and latency
  4. Cost and uptime

Explanation

Risk is generally expressed as a function of likelihood (threat exploiting a weakness) and impact, so threat and vulnerability information are core inputs. Latency, jitter, bandwidth, and uptime are performance metrics, not risk inputs.

Question 9Network Security Fundamentals and Threat Landscape

An attacker on the same VLAN sends forged ARP replies so that traffic destined for the gateway is sent to the attacker's MAC address. Which attack is this?

  1. VLAN hopping
  2. DNS poisoning
  3. ARP spoofing Correct answer.
  4. DHCP starvation

Explanation

ARP spoofing (ARP poisoning) sends gratuitous or forged ARP replies to bind a victim's IP to the attacker's MAC, enabling man-in-the-middle interception. DNS poisoning targets name resolution records, VLAN hopping crosses VLAN boundaries, and DHCP starvation exhausts the address pool.

Question 10Network Security Fundamentals and Threat Landscape

Which mitigation most effectively limits the scope of a compromised endpoint's ability to reach other internal hosts?

  1. Enabling verbose logging
  2. Microsegmentation of internal traffic Correct answer.
  3. Disabling unused USB ports
  4. Increasing password length policy

Explanation

Microsegmentation applies granular policy between workloads so a compromised host can reach only the services it is explicitly permitted to use, limiting lateral movement. Password policy, USB controls, and logging are useful but do not constrain east-west traffic.

Question 11Network Security Fundamentals and Threat Landscape

A DHCP starvation attack is followed by a rogue DHCP server offering clients a malicious default gateway. What is the attacker's goal?

  1. To increase the DHCP lease duration
  2. To intercept client traffic through a man-in-the-middle position Correct answer.
  3. To encrypt the DHCP database
  4. To synchronize time across the subnet

Explanation

By exhausting the legitimate pool and answering requests with a rogue server, the attacker can hand out a gateway they control, positioning themselves to intercept or redirect client traffic. The goal is interception, not encryption, lease tuning, or time sync.

Question 12Network Security Fundamentals and Threat Landscape

Which feature on Aruba switches validates that DHCP offers come from an authorized server before clients accept them?

  1. Link aggregation
  2. Spanning Tree Protocol
  3. LLDP-MED
  4. DHCP snooping Correct answer.

Explanation

DHCP snooping classifies ports as trusted or untrusted and drops server-originated DHCP messages on untrusted ports, blocking rogue DHCP servers. STP, link aggregation, and LLDP-MED address loop prevention, bandwidth, and discovery respectively.

Question 13Network Security Fundamentals and Threat Landscape

What is the defining characteristic of a man-in-the-middle attack?

  1. The attacker physically steals a device
  2. The attacker guesses credentials by brute force
  3. The attacker secretly relays and possibly alters communication between two parties Correct answer.
  4. The attacker floods a target with traffic

Explanation

In a MITM attack the adversary positions between two communicating parties, relaying traffic while potentially reading or modifying it. Flooding is denial of service, brute force is credential attack, and theft is physical compromise.

Question 14Network Security Fundamentals and Threat Landscape

An attacker uses a compromised internal host to send crafted DNS queries to an external server to exfiltrate data. Which control best detects this behavior?

  1. Disabling STP on access ports
  2. Increasing the DHCP lease time
  3. Monitoring for anomalous DNS query volume and domain patterns Correct answer.
  4. Enabling jumbo frames

Explanation

DNS tunneling and exfiltration produce unusual query volumes, long or high-entropy labels, and contacts with rare domains, which DNS monitoring can flag. Lease time, frame size, and STP settings do not affect DNS behavior visibility.

Question 15Network Security Fundamentals and Threat Landscape

Which statement best describes the role of a demilitarized zone in containing a compromised web server?

  1. It automatically patches the web server
  2. It encrypts all traffic between the web server and clients
  3. It limits the internal systems the web server can reach Correct answer.
  4. It ensures the web server cannot be reached from the internet

Explanation

Placing the server in a DMZ means firewall policy restricts its outbound reachability into the internal network, containing a compromise. A DMZ does not make the server unreachable from the internet, does not encrypt client traffic, and does not patch systems.

Question 16Network Security Fundamentals and Threat Landscape

Which attack exploits a switch's content-addressable memory by flooding it with bogus source MAC addresses?

  1. VLAN hopping
  2. SYN flooding
  3. MAC flooding Correct answer.
  4. ARP spoofing

Explanation

MAC flooding fills the switch CAM table so the switch falls back to flooding unknown unicast frames out all ports, enabling eavesdropping. ARP spoofing targets address resolution, VLAN hopping crosses segments, and SYN flooding exhausts TCP connection state.

Question 17Network Security Fundamentals and Threat Landscape

Which control best mitigates the risk of an attacker using stolen credentials to log in from an unfamiliar location?

  1. Disabling unused switch ports
  2. Multi-factor authentication Correct answer.
  3. A longer DHCP lease
  4. Port security on access switches

Explanation

MFA requires an additional factor beyond the password, so stolen credentials alone are insufficient to authenticate. Port security, DHCP lease settings, and disabling unused ports address Layer 2 access rather than credential misuse.

Question 18Network Security Fundamentals and Threat Landscape

An organization wants to reduce the impact of a ransomware outbreak spreading across a flat internal network. Which change provides the greatest benefit?

  1. Segmenting the network into zones with restrictive inter-zone policy Correct answer.
  2. Enabling CDP on all interfaces
  3. Increasing the password complexity requirement
  4. Adding more bandwidth between access and core

Explanation

Ransomware spreads laterally using reachable services, so segmentation with restrictive inter-zone policy blocks movement between zones. Password complexity, CDP, and bandwidth do not restrict lateral reachability.

Question 19Network Security Fundamentals and Threat Landscape

Which describes a smurf attack?

  1. Spoofed ICMP echo requests sent to a broadcast address to amplify traffic toward a victim Correct answer.
  2. A forged ARP reply redirecting gateway traffic
  3. A physical intrusion using a stolen badge
  4. A brute-force attack against SSH

Explanation

A smurf attack spoofs the victim's source address in ICMP echo requests sent to a network broadcast address, so many hosts reply to the victim and amplify the flood. The other options describe ARP spoofing, brute force, and physical intrusion.

Question 20Network Security Fundamentals and Threat Landscape

A security analyst sees many outbound connections to a rare domain at regular short intervals with small, fixed-size payloads. Which threat is most consistent with this pattern?

  1. A routing loop
  2. A broadcast storm
  3. A DHCP scope exhaustion
  4. Command-and-control beaconing Correct answer.

Explanation

Regular, periodic connections to an uncommon domain with uniform small payloads are characteristic of malware beaconing to command-and-control infrastructure. Broadcast storms and routing loops create high local traffic, and DHCP exhaustion affects address assignment.

Question 21Network Security Fundamentals and Threat Landscape

Which combination best reflects a defense-in-depth approach to protecting management access to network devices?

  1. A single strong password on every device
  2. SNMPv1 read-write with a random community string
  3. Telnet with a complex enable secret
  4. Management VLAN, ACLs, SSH, and AAA with MFA Correct answer.

Explanation

Defense in depth layers independent controls: isolating management traffic, restricting sources with ACLs, encrypting sessions with SSH, and centralizing authentication with MFA. Single passwords, Telnet, and SNMPv1 each leave clear weaknesses.

Question 22Network Security Fundamentals and Threat Landscape

An attacker on VLAN 10 configures a trunk-capable NIC and sends tagged frames for VLAN 20. Which misconfiguration most directly enables this?

  1. NTP configured without authentication
  2. An access port configured as a trunk to an end device Correct answer.
  3. Spanning Tree disabled globally
  4. A short DHCP lease time

Explanation

If an end-device port is configured as a trunk, the attached host can send 802.1Q-tagged frames and reach other VLANs, which is a form of VLAN hopping. STP, DHCP lease duration, and NTP authentication do not grant VLAN reachability.

Question 23Network Security Fundamentals and Threat Landscape

Which statement correctly distinguishes an IDS from an IPS?

  1. An IDS blocks traffic inline while an IPS only logs
  2. An IPS is deployed inline and can drop malicious traffic, while an IDS typically monitors and alerts Correct answer.
  3. An IPS operates only at Layer 2 while an IDS operates only at Layer 7
  4. An IDS encrypts traffic while an IPS decrypts it

Explanation

An IPS sits inline in the traffic path and can actively block malicious packets, whereas an IDS usually receives copies of traffic and only alerts. Neither device is defined by encryption or by a single OSI layer.

Question 24Network Security Fundamentals and Threat Landscape

A company must choose between accepting, transferring, mitigating, or avoiding a risk identified in an assessment. Which factor most directly determines the appropriate response?

  1. The cost of the control relative to the potential impact and likelihood Correct answer.
  2. The age of the network hardware
  3. The length of the DHCP lease
  4. The number of open switch ports

Explanation

Risk treatment decisions weigh the cost and effectiveness of controls against the likelihood and impact of the risk. Port counts, hardware age, and lease duration are operational details that do not determine treatment strategy.

Question 25Network Security Fundamentals and Threat Landscape

Which behavior most strongly suggests a compromised host is performing internal reconnaissance after initial access?

  1. Sequential connections to many internal hosts on common service ports Correct answer.
  2. Periodic NTP synchronization
  3. Regular DNS lookups for the corporate intranet
  4. A single large file transfer to a backup server

Explanation

Scanning many internal hosts across common ports is characteristic of discovery and lateral-movement preparation. A single backup transfer, NTP sync, and routine intranet lookups are normal operational patterns.

Question 26Network Security Fundamentals and Threat Landscape

Which security objective is directly violated when an attacker alters the amount field in a financial transaction while it is in transit?

  1. Availability
  2. Integrity Correct answer.
  3. Non-repudiation
  4. Confidentiality

Explanation

Integrity ensures that data is not modified, either in storage or in transit, so tampering with a transaction field breaks it. Confidentiality concerns unauthorized disclosure and availability concerns timely access to resources. Non-repudiation concerns proving that an action occurred.

Question 27Network Security Fundamentals and Threat Landscape

Which category of malware self-propagates across a network without requiring a user to open a file or click a link?

  1. Worm Correct answer.
  2. Spyware
  3. Rootkit
  4. Trojan horse

Explanation

A worm spreads autonomously by exploiting network services and does not depend on user interaction to propagate. A Trojan relies on being run by a user, and a rootkit is a concealment mechanism rather than a propagation method. Spyware gathers information but does not self-replicate across hosts.

Question 28Network Security Fundamentals and Threat Landscape

An organization segments its network so that point-of-sale systems can reach only the payment processor and no other internal subnet. Which security principle does this design primarily implement?

  1. Separation of duties
  2. Job rotation
  3. Least privilege Correct answer.
  4. Mandatory vacation

Explanation

Least privilege grants each entity only the access it needs to perform its function, which is exactly what restricting POS systems to a single destination achieves. Separation of duties, job rotation, and mandatory vacation are administrative controls aimed at reducing fraud and collusion among people, not at limiting network reachability.

Question 29Network Security Fundamentals and Threat Landscape

A user receives an email that appears to come from the CEO and urgently requests gift card purchases for a client. The message originates from an external domain that closely resembles the company's domain. Which attack type is this?

  1. Business email compromise Correct answer.
  2. Cross-site scripting
  3. Credential stuffing
  4. Watering hole

Explanation

Business email compromise impersonates an executive or trusted party to trick an employee into transferring funds or goods. Watering hole attacks compromise websites the victim frequents, credential stuffing replays stolen passwords against login services, and cross-site scripting injects script into web pages.

Question 30Network Security Fundamentals and Threat Landscape

An analyst observes a host periodically resolving many internal hostnames that do not exist, followed by short connection attempts to those hosts on common management ports. Which activity does this pattern most indicate?

  1. A denial-of-service flood against external DNS resolvers
  2. A misconfigured DHCP scope handing out bad leases
  3. Normal behavior of a DNS forwarder caching records
  4. Internal service discovery by a compromised host Correct answer.

Explanation

Repeated resolution of nonexistent internal names followed by probes on management ports is characteristic of an attacker mapping live hosts and services from an already compromised system. DNS flooding would target external resolvers, a forwarder would not generate failed lookups for internal names, and a DHCP scope problem would not produce sequential port probes.

Question 31Aruba Security Architecture and Solution Components

In an Aruba wireless deployment, which component is responsible for centrally managing configuration and pushing policies to managed access points in a controller-based architecture?

  1. The individual access point
  2. The DHCP server
  3. The RADIUS server
  4. The Mobility Controller Correct answer.

Explanation

In a controller-based design the Mobility Controller holds the configuration and control plane, and it provisions managed APs with their settings and policies. APs are dependent on the controller for centralized configuration.

Question 32Aruba Security Architecture and Solution Components

What is the primary function of Aruba ClearPass in a security architecture?

  1. Switch stacking management
  2. WAN routing and failover
  3. Policy-based network access control and device profiling Correct answer.
  4. Wireless RF spectrum analysis

Explanation

ClearPass is the policy management platform that delivers network access control, including authentication, authorization, device profiling, and role assignment. It acts as the policy decision point for who and what may join the network.

Question 33Aruba Security Architecture and Solution Components

Which Aruba role-based access concept assigns a set of permissions to a user or device after successful authentication?

  1. VLAN pool
  2. SSID profile
  3. Captive portal page
  4. User role Correct answer.

Explanation

A user role bundles firewall policies and network privileges that are applied to a client after authentication. Role assignment is how Aruba enforces differentiated access for different classes of users and devices.

Question 34Aruba Security Architecture and Solution Components

Which protocol is commonly used between Aruba network devices and an external authentication server to carry user credentials for verification?

  1. LLDP
  2. RADIUS Correct answer.
  3. NTP
  4. SNMP

Explanation

RADIUS is the standard protocol for carrying authentication, authorization, and accounting requests between a network access device and an authentication server. Aruba controllers and ClearPass exchange access requests over RADIUS.

Question 35Aruba Security Architecture and Solution Components

What does Aruba IntroSpect primarily provide within a security architecture?

  1. Switch port authentication
  2. Wireless intrusion prevention at the AP
  3. User and entity behavior analytics for threat detection Correct answer.
  4. Site-to-site VPN termination

Explanation

IntroSpect applies user and entity behavior analytics to detect anomalous and potentially compromised activity across the network. It complements access control by monitoring behavior rather than only gating admission.

Question 36Aruba Security Architecture and Solution Components

In Aruba's architecture, what is the role of a Mobility Master (Mobility Conductor) in a larger deployment?

  1. It performs RF spectrum capture for rogue detection
  2. It terminates all client data traffic directly
  3. It replaces the need for any authentication server
  4. It provides hierarchical management and orchestration of multiple controllers Correct answer.

Explanation

The Mobility Master, now positioned as the Mobility Conductor, sits above controllers to provide centralized, hierarchical configuration and orchestration across many controllers. It simplifies management at scale without necessarily handling client data forwarding.

Question 37Aruba Security Architecture and Solution Components

A company wants wired and wireless users to receive consistent role-based firewall policies from a single policy engine. Which Aruba component best fits this requirement?

  1. A standalone DHCP relay
  2. An isolated guest VLAN
  3. ClearPass as the centralized policy platform Correct answer.
  4. A local AP captive portal

Explanation

ClearPass centralizes policy decisions so that both wired and wireless enforcement points can apply consistent roles and policies. Using one policy engine avoids divergent rules across access layers.

Question 38Aruba Security Architecture and Solution Components

Which Aruba feature enforces a firewall policy on a per-client basis after a role is assigned?

  1. Link Aggregation
  2. Spanning Tree Protocol
  3. Stateful role-based firewall on the controller or gateway Correct answer.
  4. DNS forwarding

Explanation

Aruba controllers and gateways apply stateful firewall policies tied to the assigned user role, controlling what each client may reach. This role-based enforcement is central to segmentation in the Aruba security model.

Question 39Aruba Security Architecture and Solution Components

What is the purpose of device profiling in ClearPass?

  1. To allocate IP addresses to endpoints
  2. To compress management traffic between controllers
  3. To encrypt wireless frames between the AP and client
  4. To identify device type and attributes so appropriate policies can be applied Correct answer.

Explanation

Device profiling collects attributes such as MAC OUI, DHCP fingerprints, and other signals to classify endpoints. The resulting device category feeds policy so that, for example, IoT devices get different access than corporate laptops.

Question 40Aruba Security Architecture and Solution Components

An administrator wants guest users to authenticate through a web page before gaining limited internet access. Which Aruba capability supports this?

  1. WPA3-SAE personal mode
  2. Captive portal with a guest role Correct answer.
  3. 802.1X with EAP-TLS
  4. MAC authentication with a deny-all role

Explanation

A captive portal presents a web login and, upon success, assigns a guest role that limits access. This is the standard mechanism for sponsor- or self-registered guest access in Aruba deployments.

Question 41Aruba Security Architecture and Solution Components

Which statement best describes the relationship between Aruba APs and controllers in a controller-based deployment?

  1. APs act as RADIUS servers for other APs
  2. APs operate fully independently with no controller interaction
  3. APs tunnel or bridge client traffic under controller control and receive configuration from it Correct answer.
  4. APs perform all policy decisions without any central component

Explanation

In controller-based mode, APs establish a control relationship with the controller, receiving configuration and forwarding or bridging traffic according to controller policy. The controller remains the central decision point.

Question 42Aruba Security Architecture and Solution Components

Which Aruba solution provides a cloud-managed option for centralized network management and security policy?

  1. Aruba Central Correct answer.
  2. Aruba ClearPass Policy Manager
  3. Aruba AirWave
  4. Aruba IntroSpect

Explanation

Aruba Central is the cloud-based management platform for configuring and monitoring Aruba infrastructure and applying policy across sites. It offers a cloud-delivered alternative to on-premises management.

Question 43Aruba Security Architecture and Solution Components

What does 802.1X provide when used with Aruba infrastructure?

  1. Layer 2 loop prevention
  2. Port-based network access control using an authentication exchange Correct answer.
  3. Automatic IP address assignment
  4. Wireless channel planning

Explanation

802.1X is a port-based access control standard in which a supplicant authenticates through an authenticator to an authentication server before access is granted. Aruba switches and controllers act as authenticators in this exchange.

Question 44Aruba Security Architecture and Solution Components

Which component acts as the policy decision point when ClearPass is integrated with Aruba controllers?

  1. The DNS server, which enforces the policy
  2. The DHCP server, which assigns the role
  3. ClearPass, which returns authorization attributes to the controller Correct answer.
  4. The client supplicant, which decides its own role

Explanation

In a RADIUS-based integration, ClearPass evaluates policy and returns authorization attributes such as role or VLAN to the controller. The controller then enforces that decision as the policy enforcement point.

Question 45Aruba Security Architecture and Solution Components

Which Aruba feature allows an administrator to define a consistent security posture for IoT devices separate from employee laptops?

  1. Using only open authentication
  2. Role and policy assignment based on device profile Correct answer.
  3. Disabling all wireless encryption
  4. A single shared pre-shared key for all devices

Explanation

Combining device profiling with role assignment lets IoT endpoints receive restrictive policies while employee devices get broader access. Segmentation by role is the mechanism that separates device classes.

Question 46Aruba Security Architecture and Solution Components

What is the function of a Aruba gateway in a security architecture that uses controller-less or gateway-based designs?

  1. It provides centralized policy enforcement and traffic forwarding for branches Correct answer.
  2. It performs only RF spectrum monitoring
  3. It acts as the certificate authority for all clients
  4. It replaces access points for wireless coverage

Explanation

Aruba gateways can centralize policy enforcement, tunneling, and traffic forwarding for branch and remote deployments. They provide a control and enforcement point where a dedicated controller may not be present.

Question 47Aruba Security Architecture and Solution Components

Which Aruba capability helps detect and contain rogue access points on the wireless network?

  1. Role-based firewall on the gateway
  2. ClearPass device profiling
  3. Wireless intrusion prevention with rogue AP classification Correct answer.
  4. 802.1X on wired ports

Explanation

Wireless intrusion prevention uses APs and controllers to detect, classify, and contain unauthorized or malicious access points. Classification distinguishes harmless neighbor APs from actual rogues before containment.

Question 48Aruba Security Architecture and Solution Components

An organization needs to authenticate employees with certificates while allowing guests through a web portal, all decided by one policy engine. Which combination best fits?

  1. Static pre-shared keys for employees only
  2. A single open SSID for everyone
  3. Disabling authentication for both groups
  4. ClearPass handling EAP-TLS for employees and captive portal for guests Correct answer.

Explanation

ClearPass can run multiple authentication methods and apply different roles based on the result, supporting certificate-based employee access and portal-based guest access from one policy platform. This unifies policy while differentiating treatment.

Question 49Aruba Security Architecture and Solution Components

In a role-based access design, which element ultimately enforces the firewall rules assigned to a client role?

  1. The certificate authority
  2. The authentication server alone
  3. The network device acting as the policy enforcement point Correct answer.
  4. The client operating system

Explanation

The policy decision point determines the role, but enforcement happens at the network device that carries the client traffic, such as a controller or gateway. Separation of decision and enforcement is fundamental to the architecture.

Question 50Aruba Security Architecture and Solution Components

Which design consideration best explains why Aruba separates the policy decision point from the policy enforcement point?

  1. It allows consistent policy decisions to be applied across many distributed enforcement devices Correct answer.
  2. It guarantees zero configuration on access points
  3. It removes the need for any authentication server
  4. It eliminates the need for encryption on the network

Explanation

Centralizing decisions while distributing enforcement lets many controllers, gateways, and switches apply the same policy consistently. This scales policy management without duplicating decision logic on every device.