Test
Mobility
Este test tiene tiempo límite, así que se abre en el reproductor de siempre.
Preguntas del test (173)
1What is the best practice regarding licensing for a backup master to support Master Redundancy in a network without centralized licensing?
- ABackup master only requires the AP license
- BSupported limits and installed licenses should be the same on primary master and
backup Master - CLicenses are pushed from the primary to the backup Master along with the configuration
- DThe Backup Master does not require licenses to support master redundancy
- EOn the backup only one license of each type,is needed.
2Centralized licensing is not enabled in a network of 1 Master and 2 Local controllers, what
should be the license count on all controllers to terminate 8 APs on each Local controller
and support Local redundancy?- A16 AP license on all controllers
- B8 AP license on Master and 16 AP license on both locals
- C8 AP license on all controllers
- D1 AP license on Master and 16 AP license on both locals
- E16 AP licenses on the Locals
3By default Centralized licensing messages between master and local controllers are sent
___________________.- AIn the clear unencrypted since the master and local controllers already share IPSEC
tunnels. - BUsing CPSec
- CUsing IPSec site to site VPN tunnels
- DEncrypted using GRE
- EPAPI
- AIn the clear unencrypted since the master and local controllers already share IPSEC
4Which of the following licenses can be included in the licensing pool for centralized
licensing? (Choose three)- AFactory default licenses
- BMaster Controller licenses
- CEvaluation licenses
- DLocal Controller licenses
- EPEFV license
5Centralized licensing is not in use on an Aruba based network which has a Master and
three local controllers. No APs terminate on the Master controller. Roles and Firewall
policies need to be created and applied, hence PEF-NG license is required
On which controller should the license be installed?- AOnly the master controller since role and firewall policies are created here.
- Bonly the local controllers since firewall policies are applied here
- Cthe master and all three local controllers
- Dthis isn't the correct license for this purpose, use PEF-VPN license
- Ethis is not needed because PEF-NG is part of base OS
6Which of the following will occur if a master license server fails with no standby server
present? (Choose two)- ALocal controllers licenses will continue to be valid for 30 days
- BLocal controllers will immediately remove all installed licenses
- CNo licenses will be sent to any new controllers that come online
- DAll licenses go back into the pool for redistribution
- EA Local Controller elects itself master license server
7Which of the following APs do NOT support dual radio operations?
- AAP 93
- BAP 105
- CRAP 3WN
- DAP 224
- EAP 135
8A network administrator wants to terminate VPN sessions on a local controller in the DMZ.
Which statement is true about the PEF-VPN license?- AIt is only applied to the master controller
- BIt is only applied to the DMZ controller.
- CIt is based on the number of APs
- DOne license is needed on the master and the DMZ local
- EIt is distributed by the license server as needed
9An AP135 has been configured with 3 SSIDs supported on both 2.4Ghz and 5Ghz bands.
How many GRE tunnels will be created between the AP 135 and the controller?- A3
- B4
- C6
- D7
- E8
10Which of the following licenses are consumed by Mesh APs advertising an SSIDs?
- AAP license
- BMesh license
- CPEF-V license
- DNo license is required
- ERAP License
11What are the PEF-NG license limits based on?
- ANumber of APs
- BOne license per controller
- CNumber of users
- DNumber of local controllers
- EMaster Controller total user count
12The following licenses have been installed on these controllers:
Master-1: 8 AP licenses
Local-2 : 8 AP licenses
Local-3 : 5 Evaluation AP Licenses
Local-4 : 10 Factory installed AP licenses
Central Licensing is enabled. What is the AP Pool capacity on the Central License Server?- A8
- B16
- C21
- D26
- E31
13The permanent licenses on the controller will be deleted with the use of which command?
- Adelete license
- Bwrite erase
- CLicenses cannot be deleted once activated
- Dwrite erase all
- Ereboot delete all
14Which dual radio access point models support concurrent operations in the 2.4Ghz band as
well as the 5Ghz band? (Choose three)- AAP-92
- BAP-93
- CAP-105
- DAP-224
- EAP-135
15A evaluation License is valid for a maximum of ________?
- A30 Days
- B60 Days
- C90 Days
- D6 Months
- E12 Months
16What information do you need to generate a feature license key for an Aruba controller?
- AThe controller's MAC address and the feature description.
- Bcontroller's MAC address and the certificate number
- Ccontroller's Serial Number and the feature description
- Dcontroller's Serial Number and the certificate number
- Econtroller's MAC address and Serial Number
17What is the first role a user is given when a user associates to an open WLAN?
- Athe guest post authentication role
- Bthe initial role in the captive portal profile
- Cthe role in the server group profile
- Dthe initial role in the AAA profile
- EThe initial role in the 802.1x profile
18What are valid methods of blacklisting a device? (Choose three)
- AManually
- BFirewall Rule
- CFirewall Policy
- DAuthentication Failures
- EData Rate Thresholds
19What is the blacklist default time?
- A30 seconds
- B1800 seconds
- C3600 seconds
- Dno default time, it must be done manually
- E1 day
20ip access-list session anewone
user network 10.1.1.0 255.255.255.0 any permit
user host 10.1.1.1 any deny
user any any permit
Referring to the above portion of a Mobility Controller configuration file, what can you
conclude? (Choose two)- AThis is a session firewall policy.
- BThis is an extended Access Control List (ACL).
- CAny traffic going to destination 10.1.1.1 will be denied.
- DAny traffic going to destination 10.2.2.2 will be denied.
- EAny traffic going to destination 172.16.100.100 will be permitted.
21What are aliases used for?
- Aimprove controller performance
- Bsimplify the configuration process
- Ctie IP addresses to ports
- Dassign rules to policies
- Eassign policies to roles
22The Aruba Policy Enforcement Firewall (PEF) module supports source network address
translation (src-nat).
Which is a use of this statement in an Aruba configuration?- Aprovide a single source IP address for users in a role
- Bredirect Captive Portal HTTP sessions
- Credirect Access Points to another Aruba controller
- Dprovide IP addresses to clients
- Eredirects clients to Aruba Firewall
23Review the following truncated output from an Aruba controller for this item.
(example) #show rights logon
access-list List
----------------
Position Name Location
-------- ---- --------
1 logon-control
2 captiveportal
logon-control
-------------
Priority Source Destination Service Action
-------- ------ ----------- ------- ------
1 user any udp 68 deny
2 any any svc-icmp permit
3 any any svc-dns permit
4 any any svc-dhcp permit
5 any any svc-natt permit
captiveportal
-------------
Priority Source Destination Service Action
-------- ------ ----------- ------- ------
1 user controller svc-https dst-nat 8081
2 user any svc-http dst-nat 8080
3 user any svc-https dst-nat 8081
4 user any svc-http-proxy1 dst-nat 8088
5 user any svc-http-proxy2 dst-nat 8088
6 user any svc-http-proxy3 dst-nat 8088
Based on the above output from an Aruba controller, an unauthenticated user assigned to
the logon role attempts to start an http session to IP address 172.16.43.170.
What will happen?- Athe user's traffic will be passed to the IP address because of the policy statement:user
any svc-http dst-nat 8080 - Bthe user's traffic will be passed to the IP address because of the policy statement:user
any svc-https dst-nat 8081 - Cthe user's traffic will be passed to the IP address because of the policy statement:user
any svc-http-proxy1 dst-nat 8088 - Dthe user will not reach the IP address because of the policy statement:user any svc-http
dst-nat 8080 - Ethe user will not reach the IP address because of the implicit deny any any at the end of
the policy.
- Athe user's traffic will be passed to the IP address because of the policy statement:user
24Which describe "roles" as used on Aruba Mobility Controllers? (Choose two)
- ARoles are assigned to users.
- BRoles are applied to interfaces.
- CPolicies are built from roles.
- DA user can belong to only one role at a time.
- ERoles are a set of authentication rules
25ip access-list session anewone
user network 10.1.1.0 255.255.255.0 any permit
user any any permit
host 10.1.1.1 host 10.2.2.2 any deny
A user sends a frame with the following attributes:
Source IP: 10.1.1.1 Destination IP: 10.2.2.2 Destination Port: 25
Based on the above Mobility Controller configuration file segment, what will this policy do with the user frame?- AThe frame is discarded because of the implicit deny all at the end of the policy.
- BThe frame is discarded because of the statement:user host 10.1.1.1 host 10.2.2.2 deny.
- CThe frame is accepted because of the statement:user any any permit.
- DThe frame is accepted because of the statement:user network 10.1.1.0 255.255.255.0
any permit. - EThis is not a valid policy.
26What is true about Global Session ACL? (Choose two)
- AAny rules will apply to all users in the AP-group
- BAny rules will apply to all users in the Network
- CAny rules will apply to all users in the controller
- DIs in the first position in all roles
- EWhen added it is in the first position in selected Role
27Which netdestination aliases are built into the controller? (Choose three)
- Alogon
- Bany
- Cuser
- Dguest
- Elocalip
28Refer to the following configuration segment for this item.
netdestination "internal"
no invert
network 172.16.43.0 255.255.255.0 position 1
range 172.16.11.0 172.16.11.16 position 2
Question No : 26 - (Topic 2)
Question No : 27 - (Topic 2)
Question No : 28 - (Topic 2)
!
ip access-list session "My-Policy"
alias "user" alias "internal" service_any permit queue low
!
A user frame is evaluated against this firewall policy with the following attributes:
Source IP: 172.17.49.3 Destination IP: 10.100.86.37 Destination Port: 80
Referring to the above file segment, how will the frame be handled by this firewall policy?- AThe frame will be dropped because of the implicit deny all at the end of the netdestination definition.
- BThe frame will be dropped because of the implicit deny all at the end of the firewall policy.
- CThe frame will be forwarded because of the implicit permit all at the end of the firewall policy
- DThe frame will be passed because there is no service specified in the firewall policy.
- EThe frame will be dropped because there is no service specified in the firewall policy.
29When creating a firewall rule what are valid choices for the Service/Application field?
(Choose three)- AApplications
- BApplications Category
- CInternet Protocol
- DInternet Category
- EProtocol
30An administrator creates a WLAN with an unmodified default AAA profile. What is the default role the user is placed in?
- Adefault-logon
- Blogon
- Cguest-logon
- Ddefault-ap
- EAP-Role
31Which of the following firewall rules allows a user to initiate an ICMP session to other devices?(Choose two)
- Alocalip any svc-icmp permit
- Buser any svc-icmp permit
- Cuser user svc-icmp permit
- Dany any svc-icmp permit
- Emswitch any svc-icmp permit
32The Aruba Policy Enforcement Firewall (PEF-NG) module supports destination network address translation (dst-nat).
Which is the default use of this statement in an Aruba controller configuration?- Asource the IP addresses of users to specific IP address
- Bredirect HTTP sessions to Captive Portal
- Credirect Access Points to another Aruba controller
- Dprovide a telnet connection to the controller
- Eredirect a SSH session to terminate on the controller
33Refer to the following configuration segment for this item.
ip access-list session anewone
user network 172.16.1.0 255.255.255.0 any permit
user host 172.16.1.1 any deny
user any any permit
An administrator wants users to have access to all destinations except 172.16.1.1. Based on the above Aruba Mobility Controller configuration segment, which statements best describe this policy? (Choose two)- AThe rule user host 172.16.1.1 any deny is redundant because of the implicit deny all at the end.
- BThe rule user network 172.16.1.0 255.255.255.0 any permit is redundant.
- CThe two rules user network 172.16.1.0 255.255.255.0 any permit and user host 172.16.1.1 any deny need to be re-sequenced.
- DThe last statement user any any permit is not required
- EThe last statement should be any any any deny
34When creating a firewall rule on an Aruba controller, which parameter is optional?
- ADestination
- BService
- CSource
- DLog
- EAction
35Which may be applied directly to an VLAN interface? (Choose three)
- AAccess List (ACL)
- BFirewall Policy
- CRoles
- DAAA profiles
- ERF Plan Map
36Which of the following could be used to set a user's post-authentication role or VLAN association? (Choose two)
- AAAA default role for authentication method
- BServer Derivation Rule
- CVendor Specific Attributes
- DAP Derivation Rule
- EThe Global AAA profile
37Ver imagenes 1 y 2
A user associated to an SSID with 802.1x using this server group. RadiusNY returned a standard radius attribute of filter-Id with a value of "employee". The user was placed in the guest Role. What statements below are correct?(Choose two)- AThe user was placed in the 802.1x authentication default Role guest
- BThe user was placed in the initial Role guest
- CRole derivation failed because roles are case sensitive
- DRole derivation failed because the incorrect operation "value-of" was used
- E802.1x authentication failed so the user was automatically placed in the guest Role
38A user connected to a Captive Portal VAP successfully. When the user opens their browser and tries to access their homepage, they get redirected as expected to another URL on the Aruba Controller. However, they see an error message that web authentication has been disabled. What might be a cause of this?
- ACaptive Portal has not been assigned in the SSID profile.
- BThe Captive portal profile has not been assigned to the AAA profile.
- CA server group has not been assigned to the captive portal profile.
- DAn initial role has not been assigned to the AAA profile.
- EThe Captive portal profile has not been assigned to the initial role.
39Ver imagen 3
Referring to the above screen capture, if an administrator desires to change a specific AP into a Spectrum Monitor without assigning the AP to a new group, which menus could be used?- ANetwork > Controller
- BWireless > AP Configuration
- CWireless > AP Installation
- DAdvanced Services > Wireless
- EWizards > WIP Wizard
40Which profiles are required in an AP Group to enable an SSID with VLAN 1, WPA2 and LMSIP?(Choose three)
- AVirtual-AP profile
- BWLAN profile
- C802.1x authentication profile
- DAP System Profile
- ESSID Profile
41Which ARM feature addresses the issue of sticky clients by moving clients to associate to APs with better 802.11 signal quality?
- ACo-Channel interference mitigation
- BAirtime Fairness
- CClientMatch
- DCoordinated access to a single channel
- EBand Steering
42Which of the following metrics does the ARM feature use to calculate the optimal channel and power level for Access Points? (Choose two)
- ARF Spectrum Index
- BPriority Index
- CInterference Index
- DCoverage Index
- EFrequency Index
43What is the function of Band Steering?
- ABalancing clients across APs on different channels within the same band
- BEncourages clients, 5GHz capable, to connect on the 5GHz spectrum
- CCoordinate access to the same channel across multiple APs
- DEnables selection of 20 vs. 40 MHz mode of operation per band
- EEnables acceptable coverage index on both the "b/g" and "a" spectrums
44By default, which CLI based remote access method is enabled on Aruba controllers?
- ARHS
- BTelnet
- CSSH
- DTelnet and SSH
- ETelnet, SSH and RSH
45When direct consoled to an AP, what is the command sequence to factory default the AP and re-bootstrap?
- Asetenv bootstat init
- Bsetenv master init, boot
- Cpurge, save, boot
- Dinit, save, boot
- Eprintenv, purge, boot
46What can NOT be configured from the Aruba controller configuration wizards?
- AController IP
- BBoot Partition
- CUser firewall policy.
- DUser derivation rules.
- ERadius Servers
47An administrator is setting up a factory default controller. No new AP groups were created.
When adding a WLAN SSID in the Campus WLAN wizard what AP group is available?- AThe air-monitors AP group
- BThe logon AP group
- CThe default AP group
- DThe initial AP group
- EThe Spectrum AP group
48A campus AP has been provisioned with a VAP in bridge forwarding and standard operation modes. Which of the following authentication types are supported? (Choose two)
- A802.1X authentication
- BOpen System authentication
- CLocal authentication
- DCaptive portal authentication
- EVPN authentication
49The Controller wizard enables which of the following controller clock configurations?(Choose three)
- ANTP to a time server
- BSet time zone
- CDaylight savings time
- DOnly GMT can be configured
- EManual configuration of date and time
50What settings need to be changed on a factory default AP in order for it to use ADP to discover the Aruba Controller?
- ADNS of the controller
- BStatic route
- CAP group
- Denable multicast
- Eno changes needed
51Ver 4 y 5
The screen captures above show the 802.1X authentication profile and AAA profile settings for a VAP.
If machine authentication passes and user authentication fails, which role will be assigned?- Aemployee
- Bdenyall
- Cguest
- Dlogon
- Eno role is assigned
52Which command will show all client association history?
- Ashow mobile trail current (ip address)
- Bshow ip mobile trail (ip address)
- Cshow ap client status (mac address)
- Dshow current client ip (ip address)
- Eshow client ip (ip address) mobility
53Masters communicate configuration information with locals using which tunnel type?
- AGRE
- BIP in IP
- CProvision Tunnel Protocol
- DIPSec
- EPPTP
54By default, how long will an AP scan a single channel when ARM is enabled?
- A80 milliseconds
- B90 milliseconds
- C100 milliseconds
- D110 milliseconds
- E200 milliseconds
55Ver imagen 6
In the above screen capture, the administrator notes that most of the configuration options are grayed out and have no action.
What is the cause of the problem?- Aattempting to make global changes on a Master Controller
- Battempting to make global changes on a Local Controller
- Cthis change can only be performed via the CLI
- Ddoes not have the correct software license
- Ethere is an error in the configuration
56When an 802.11 client roams what device decides when to move the client to another AP?
- AAruba AP
- BAruba Controller
- CClient
- DRadius Server
- ERouter
57Ver imagen 7
In the diagram provided for this question, the wireless user's laptop is associated with an Aruba AP in tunnel forwarding mode. The AP terminates on the local controller.
When the client transmits, where will the 802.11 headers be removed?- AAP
- BL2 Switch
- CRouter
- DLocal Controller
- EInternet
58When configuring ports in the Controller wizard, which of the following are NOT configuration options?(Choose two)
- AInter-VLAN routing
- BSpeed
- CTrusted
- DLACP
- ETrunk
59A customer forgot all passwords for a controller. What method could you use to reset the passwords?
- ATelnet to the controller and login to the password recovery account
- BSSH to the controller and login to the password recovery account
- CConnect directly to the serial console and login to the password recovery account
- DInterrupt the boot process at CP-boot and select password recovery
- EOpen the controller and press the reset switch
60Ver 8
View the Server group screen shot above.
A company has provisioned the same VAP, AAA and SSID profiles at both its Miami and NY offices. This Server Group is applied for 802.1x authentication at both locations. The user's credentials are only found in the Miami Radius server "RadiusMiami". There is no Radius synchronization and both servers are reachable. What happens when the user attempts to authenticate?- AThe controller recognizes the users Domain and sends the authentication request directly to RadiusMiami.
- BThe request is initially sent to RadiusNY1 then RadiusNY1 redirects the controller to send the authentication request to RadiusMiami
- CRadiusNY1 receives the request and returns a deny. No other action is taken.
- DRadiusNY1 receives the request and returns a deny. The authentication request will then be sent to RadiusMiami.
- EThe RadiusNY1 sends the request to RadiusMiami that replies to the controller
61In an Aruba controller based system, the L3 mobility tunnel exists between the home agent and which other element?
- Athe default gateway
- Bthe remote AP
- Cthe foreign agent
- Dthe mobile node
- Ethe foreign switch
62In a campus environment, where are encryption keys sent or stored when users roam between tunneled mode APs on the same controller using 802.1X?
- Asent to the new AP via GRE
- Bsent to the new AP via IPSec
- Cstored on the controller
- Dstored on the RADIUS server
- Eoriginal AP sends keys to new AP
63Which actions does ARM (Adaptive Radio Management) perform? (Choose two)
- Aallows controllers to provision the AP Radio type
- Ballows controllers to provision the best channel for APs
- Callows controllers to provision the best power setting for APs
- Dallows controllers to provision allowed Radio bands
- Eallows controllers to provision lower power when unauthorized APs are detected
64Which match condition can be used by a server derivation rule?(Choose two)
- Agreater than
- Bless than
- Cinverse of
- Dcontains
- Eequals
65Which of the following statements is true of Spectrum Mode?
- ANo licenses are required to run an AP in Spectrum mode
- BSpectrum mode can only be configured for one AP at a time
- CAn AP can be in spectrum mode for both 2.4 and 5G bands at the same time
- DAn AP can be placed in Spectrum Mode via the Spectrum Profile
- ESpectrum mode can be configured from the GUI under AP installation
66What is true about client match? (Choose two)
- ADoes Load balancing
- BDoes Spectrum load balancing
- CDoes Band Steering/Band Balancing
- DMoves higher traffic devices to adjacent APs
- ESends QRT frames to neighbor APs
67A network needs to implement L3 roaming. On the Master Controller, the administrator, enabled IP mobility, created a Domain and created the HAT table with all the IP addresses of the local controllers. He then enabled Mobility on the VAPs. The configuration was then saved.
L3 Mobility is still not working, what could be the cause? (Choose two)- AIP Mobility must be enabled on all controllers.
- BIP-IP tunnels must be configured between controllers.
- CThe Domain must activated on each controller.
- DThe HAT table must be configured on each controller.
- EThe HAT table must be configured with each controllers supported subnets.
68What is true about an AP in Hybrid Spectrum mode?
- AScan home channel and services client traffic on home channel
- BScans all channels and services clients on home channel
- CPuts the selected band in spectrum mode and services clients on other band
- DMakes the AP a spectrum monitor, but does not affect other APs in the AP-group
- EAll APs in AP-group scan home channel and service clients
69A customer has a remote AP deployment, where each remote AP has an IPSEC VPN tunnel with L2TP to the controller. 1 of the remote APs is stuck in the user table and hasn't yet transitioned to the AP active table in the controller. The customer suspects that the AP is not setting up its VPN connection successfully. Which of the following commands might be useful in troubleshooting this? (Choose three.)
- ALogging level debugging security process localdb
- BLogging level debugging security process l2tp
- CLogging level debugging security process dot1x
- DLogging level debugging security process crypto
- ELogging level debugging security process vpn
70An Aruba controller can be accessed with which CLI based remote access methods?(Choose two)
- ARSH
- BTelnet
- CSSH
- DSFTP
- ESCP
71An administrator wants to assign a VLAN to a user based upon the
authentication process using Vendor Specific Attributes (VSA). Where are Aruba Vendor Specific Attribute (VSA) values provisioned?- Acontroller
- Bclient
- CRADIUS server
- DInternal user database
- EOption 60 of DHCP reply
72With CPSec disabled, which tunnel protocol is used between APs and Controllers in an Aruba environment?
- ABasic IP
- BGRE
- CIPinIP
- DMobile IP
- EIPSec
73ver 9
Referring to the above screen capture, on which controller can you modify APs configuration to enable ARM?- AController 10.1.10.100 only
- BController 10.1.20.100 and 10.254.1.3 only
- CAll three Controllers
- DNone of the Controllers
- EOn Controllers where ARM is enabled
74ver 10
Refer to the above screen capture. By default, which controller's internal database will be used for user authentication?- AController 10.1.10.100 only
- BController 10.1.20.100 and 10.254.1.3 only
- CAll three Controllers
- DYou can't tell from this screen
- EThe Controller with the user session
75With CPSec disabled, Aruba access points are Layer 3 connected to controllers using which protocol?
- A802.1q
- BLWAPP
- CPPTP
- DGRE
- EHTTPs
76What is the total number of charts you can simultaneously monitor in a spectrum dashboard?
- A3
- B4
- C8
- D9
- E12
77How does the ARM Band Steering feature encourage 5GHz capable clients to move/connect to the 5GHz radios of Aruba APs?
- AARM suppresses the probe responses on the 2.4 ghz radio?
- BARM utilizes third party software on the wireless clients
- CCurrent Wi-Fi chipset firmware supports this by default
- DIt's not possible the move clients to 5GHz radios when they can see both 2.4 and 5GHz APs
- EARM disables the 2.4Ghz radio for the specified client
78What is the function of Station Handoff Assist, if enabled?
- AForce device to 5Ghz band
- BForce device off AP if RSSI is below threshold
- CSend message to device to change AP
- DSend message to adjoining AP to accept device
- ESend message to adjoining AP to initiate association to the device
79ver 11
Referring to the above screen capture, on which Controller can you create a VLAN?- AController 10.1.10.100 only
- BController 10.1.20.100 and 10.254.1.3 only
- CAll three Controllers
- DNone of the Controllers
- EController 10.254.1.101 only
80ver 12 y 13
The screen captures above show the 802.1X authentication profile and AAA profile settings for a VAP.
If machine authentication fails and user authentication passes, which role will be assigned?- Aemployee
- Bguest
- Cdenyall
- Dlogon
- Eno role is assigned
81Which of the statements below are TRUE regarding ARM's Spectrum Load Balancing feature? (Choose two)
- AAvailable only on 5GHz radios
- BDisabled by default
- CBalances client load across available channels/APs
- DEnabled by default
- EAvailable only on 2.4GHz radios
82ver 14
The above diagram has one master and three local controllers. AP1 GRE terminates on
controller Local 1. All controllers are configured with the wireless user VLAN 201. A wireless user associates with AP 1. Only L2 mobility is enabled.
Which elements will know about this association?- ALocal 1 only
- BLocal 1 and the Master
- CLocal 1 and Local 2 and the Master
- DLocal 1 and AP1
- EAll Controllers
83A client Roams from one Local controller-1 to another Local controller-2. The controllers are in different subnets and L3 Mobility is enabled. How is the client traffic sent back to Local-controller-1?
- AIP-IP tunneled
- BFTP
- CMulticast
- DL2 GRE Tunnel
- ERouted locally
84ver 15 y 16
The screen captures above show the 802.1X authentication profile and AAA profile settings for a VAP.
If machine authentication fails and user authentication fails, which role will be assigned?- Aemployee
- Bguest
- CCaptive Portal
- DLogon
- Eno role will be asigned
85When configuring a server group containing 3 servers, a customer Chooses 'fail through mode'. What other configuration option has to be enabled on the controller for this to work with 802.1x authentication?
- AMachine authentication
- BEAP Termination
- CServer group fall through mode
- DMAC authentication
- ERound robin or top down mode
86Which of these are NOT a client attribute that can be configured in user derivation rules?
- AMAC address
- BDHCP option value
- CBSSID
- DFilter ID
- Eencryption
87Which settings cannot be modified directly from a local controller?
- APort VLAN setting
- BSwitch Time Zone
- CPort trusted
- DRoles
- ESNMP Enable Trap Generation
88Aruba Client Match does NOT use which of the following parameters to determine the best AP for a client connection?
- ADevice type
- BLocation
- CSignal to Noise Ratio
- DAccess Point load
- ESpectrum Analysis
89Which is a Device Specific Attribute that can be evaluated in a user derivation rule?
- Auser login name
- Bauthentication server
- Clocation by AP Name
- Dcontroller Loopback address
- Econtroller IP
90Which method is NOT supported to provision an Aruba campus AP?
- ATelnet directly to AP
- BSSH to the AP's controller
- CWeb interface to the AP's controller
- DConsole to AP
- ECLI on controller
91What are the types of user derivation rules that can be applied to a user?(Choose two)
- ASSID
- BMAC
- CVLAN
- DRole
- EAP
92With CPSec enabled, which tunnel protocol is used between APs and Controllers in an Aruba environment?
- AEAP
- BSSH
- CIPinIP
- DMobile IP
- EIPSec
93As an admin/root user, what other type of role-based management users can be created on Aruba controllers?
- AAuditing-compliance user
- BAirWave management user
- CReporting Generation user
- DGuest provisioning user
- EMaintenance user
94Which log type should be enabled to troubleshoot IPSec authentication issues on Aruba Controllers?
- ASecurity Logs
- BManagement Logs
- CWireless Logs
- DIDS Logs
- ESystem Logs
95With CPSec disabled, which encryption protocol does a tunnel mode campus AP's use on client traffic ?
- ATKIP and AES
- BIt is provisioned by the Administrator
- CWEP and AES
- DWEP, TKIP, and AES
- ENo encryption is used
96What are the Airtime Allocation Policy options for Airtime Fairness? (Choose three)
- ADefault Access
- BPriority Access
- CFair Access
- DPreferred Access
- EDistributed Access
97ver 17
Referring to the above screen capture, on which controller can you add an administrative user and assign a controller management role?- AController 10.1.10.100 only
- BController 10.1.20.100 and 10.254.1.3 only
- CAll three Controllers
- Dmust be done in the RADIUS server
- EController 10.254.1.101 only
98A Server Group has been configured with three Radius servers. Load balancing has been enabled. Choose the correct statement?
- AAll Radius request are sent round robin continuously
- B10 request are sent to first server then 10 to the next server
- COnly the first two servers are used and the third is a backup server
- DRuns average response times and balances the load accordingly
- ETo use Load Balancing EAP Termination must be enabled
99The Master fails with Central Licensing enabled. What happens to the local Controllers?
- ALocals continue to operate for 1 day
- BLocals operate for 30 days and accept new APs
- CLocals continue to operate for 90 days and accepts new APs
- DLocals can only use their originally installed Licenses
- ELocals will operate with active APs but not will accept any other APs
100Which of the following will accept named VLANs as a parameter? (Choose three)
- Aa VLAN pool
- BUser Role for single VLAN
- CRADIUS Server attributes for role derivation
- DFirewall session rule
- EPort trunk configuration
101The reusable Aruba Controller wizards are accessible in what way?
- AOnly on startup through the CLI
- BThrough the CLI, after the initial CLI wizard has been completed
- CIn the Web UI under maintenance.
- DIn the Web UI under configuration.
- EMust be initialized from CLI first.
102Which method can APs use to discover a controller?
- ADHCP
- BDynamic DNS (DDNS)
- CPnP
- DPAPI
- EHTTPS
103Where should mobility domains be enabled in a network with 1 master, 1 backup master and 5 local controllers ?
- AOnly on the master controller
- BAll the local controllers in the network
- CAll the controllers where the client is allowed to roam
- DMaster and backup master
- EOnly on the backup master
104ver 18
In the diagram provided for this question, the Aruba controller terminates one end of a GRE tunnel that carries wireless user traffic.
Where does the other end terminate?- AA
- BB
- CC
- DD
- EA or B
105ver 19
In the above diagram, the system shows two Aruba access points.
Which VLANs must be configured on trunk link D between the router and Aruba controller to support wireless users when the controller is provisioned for L2 operations?- A10 , 101 and 102
- B101 and 102
- C101, 102 and 103
- D10, 101,102 and 103
- E10 and 103
106With Fast-Failover disabled, to which IP address should the Aruba AP terminate its GRE tunnel for layer 2 controller redundancy to work and to support failover of access points?
- AVRRP IP address
- Bmanagement IP of an Aruba controller
- Cmanagement IP of the backup Aruba controller
- DHSRP IP address
- ELoopback IP address of backup Aruba controller
107A wired device is connected to an untrusted port on a controller. How can a role be assigned to the device?
- AAn initial Role can be assigned directly to the VLAN
- BRoles are assigned to devices connected to a trusted port
- CA default Role can be directly assigned to an untrusted port
- DAdding a wired AAA profile to a VLAN on the untrusted port
- EThe Role assigned to the untrusted port
108When configuring Captive Portal, which protocols are supported when accessing the Captive Portal? (Choose two.)
- AHTTPS
- BVPN
- CHTTP
- DTELNET
- ESSH
109ver 20
Referring to the diagram provided for this question, in which locations must you define the new data VLANs for wireless client traffic? (Choose two)- Ain all L2 switches where an Aruba AP is physically connected
- Bin all APs and the L2 switches to which they are connected
- Cin the Aruba controller and the router it's connected to in an L2 deployment
- Din the routers and switches where the APs are physically connected
- Eonly on the Aruba controller in an L3 deployment
110A port firewall policy is applied to a trunk port that denies controller access. An "allow all" VLAN firewall policy is applied to VLAN 33 on the same port. A user connected to VLAN 33 on that port attempts to gain access to the controller. Which of the following statements is true?
- AThe Port policy is applied, therefore no controller access
- BThe VLAN policy is applied, then the port policy, therefore no controller access
- CThe VLAN policy is applied, therefore access to the controller is allowed
- DYou cannot place a firewall policy on a Ports VLAN when the Port already has a policy, therefore no controller access
- EWhen locally connected to a controller's port you always have controller access
111When APs boot up, in which order do they Select a controller?
- ADNS, DHCP, ADP multicast, ADP unicast, static
- Bstatic, DNS, DHCP, ADP broadcast, ADP multicast
- Cstatic, DHCP, ADP broadcast, ADP multicast, DNS
- Dstatic, DHCP, DNS, ADP multicast, ADP broadcast
- EDNS, static, ADP multicast, ADP broadcast
112An AP was configured to use dynamic controller discovery and assigned to an AP group, then powered off for over a week. When the AP is redeployed, what previous configuration will it retain?
- AIts AP name and AP Group
- BIts Serial Number
- CThe controller's IP address
- DAfter a few days all configurations are lost
- EThe controller IP address and the AP Group
113Which of the following is an Aruba Layer 3 redundancy mechanism?(Choose two)
- AHA
- BBackup LMS-IP
- CVRRP
- DBackup AP group
- EARM
114Which parameter(s) does a Master controller use to determine where a provisioned AP should terminate its GRE tunnel?
- Athe IP address of the AP
- Bthe MAC address of the AP
- Cthe IP address of the switch nearest to the AP
- Dthe name and group settings of the AP
- Ethe VLAN the AP is attached to
115An access port has been placed in trusted mode. The VLAN on the port is in Untrusted mode. Which of the following statements is true?
- AThe traffic is trusted since the port is trusted
- BThe traffic is untrusted since the VLAN is untrusted
- CThis is an invalid configuration, both must be set the same
- DYou cannot set VLANs as trusted or untrusted
- EOnly traffic from that specific port is trusted, all other traffic is untrusted
116ver 21
A user logged in with the Captive Portal settings shown in the above screen capture.
What does the user need to do to logout?- Await 30 minutes then logout
- Bwait 60 minutes then logout
- Cclick Logout on the browser screen
- Dhe cannot logout
- Ewait 10 seconds for redirect
117An Aruba Controller is configured with VLAN 1,5, 200, and 4095. All VLANs have IP addresses assigned. Which is the default management VLAN on the Aruba controller?
- AVLAN 5
- BVLAN 1
- CVLAN 200
- DNone, it must be defined
- EVLAN 4095
118ver 22
Referring to the diagram provided for this question, if the Aruba controller is configured to perform L3 switching, what will be the wireless client laptop default gateway?- AA
- BB
- CC
- DD
- EE
119A port on a controller has been configured as untrusted. No wired access AAA profile or Global AAA profile is configured. When a user connects to that port which of the following statements is true?
- ASince there is no wired access AAA profile, only port policies will be applied
- BThe user will fall into the default wired access AAA profile and will be given the initial role.
- CSince there is no wired access AAA profile or Global AAA profile the user will be given the logon role.
- DWhen configuring the port as untrusted, an error message of "no wired access AAA profile exists" Therefore this is an invalid configuration.
- Ethe user is denied all access automatically because no wired access AAA or Global AAA profile is assigned.
120Fast Failover has been implemented between Local 1 and Local 2 separated by Routers. During testing Local1 was disabled and all Campus APs backed up to Local 2 flawlessly.
But the RAPs did not, they all failed.
What could be the cause?- ARAPs should be configured in their own AP-groups
- BA VPN IP Pool must be configured on Local 2
- CThe RAP whitelist must be ported over to Local 2
- DIPSec must be enabled on Local 2
- ERAPs are not supported by Fast Failover
121ver 23
In the above diagram, the system shows two Aruba access points and a wired user.
Which VLAN(s) do NOT need to be configured on link A between the L2 switch and router to support the wireless users?- A101 and 102
- B101 and 103
- C102 and 103
- Donly 101
- Eonly 103
122ver 24 y 25
Screenshots of the Captive Portal authentication profile and server group of a guest network are displayed above.
How was the user authenticated?- Awith a radius server called Radius01
- Bwith the Internal database
- Cwith a radius server called Internal
- Dwith another form of authentication
- Euser wasn't authenticated against any server
123ver 26
In the diagram provided for this question, the client laptop is associated with the Aruba AP.
The Aruba controller is configured to perform L2 switching for this SSID.
What will be the client laptop default gateway?- AA
- BB
- CC
- DD
- EE
124When the controller is configured for Captive Portal and the user is only required to provide an email address for authentication, which option is configured in the GUI?
- Aenable termination
- Benable guest logon
- Cenable user logon
- Deap method
- Edisable CP Login
125Which protocols does the Aruba controller utilize for controller redundancy (Choose two)?
- AHSRP
- BVRRP
- CHA
- DVPN
- EIP-IP
126What are two different methods of configuring AP redundancy between 2 local controllers?(Choose two.)
- AFast-Failover
- BConfigure the locals as remote nodes
- CUse named VLANS
- DBackup LMS IP
- EAP Redundancy can only be configured between a Master and Local
127A university, has 2 departments. Department 1 has its own mobility domain with one controller. Department 2 has multiple controllers configured in a second domain. The university is planning on offering a new application and needs users to be able to roam between both mobility domains.
What is the best way to accomplish this?- AThe 2 existing domains should be left as they are. A 3rd mobility domain should then be created and all 3 controllers need to be added to it
- BMerge the controllers into the same mobility domain
- CThe IP subnets of all controllers need to be configured to match
- DThis cannot be accomplished
- ECreate a new domain between a department 1 controller and one of the department 2 controllers
128Which of the following statements is true?
- AAruba Campus APs must be physically attached to the Aruba Controller.
- BAruba Campus APs must be in the same broadcast domain as the Controller.
- CAruba Campus APs can be in different subnets from the Controller.
- DAruba Campus APs must be physically attached to the same Layer 3 switch.
- EAruba Campus APs can be connected directly to the public internet.
129How many Aruba controllers can be added to a single mobility domain?
- A64 controllers of any type
- B128 controllers supporting 2000 users
- C256 controllers with no more than 1024 subnets
- DControllers supporting up to 6000 AP's
- EThere is no controller limit
130When configuring Fast Failover what are the 3 HA roles that can be selected? (Choose three)
- APrimary
- BActive
- CDual
- DStandby
- EBackup
131In a master-local controller scenario, where is the mobility domain defined?
- Athe AP group
- Bthe master controller
- Cthe local controller
- Dthe master and the local controllers
- Ethe master and the local controllers where roaming is needed
132ver 27
As illustrated in the above diagram, a company has two campus locations and a building headquarters all located in different cities.
Following best practices, what would be the best way to construct mobility domains for the company?- ABuildings (1, 2) in one domain and Buildings (3, 4, 5, 6) in one domain
- BBuildings (1, 2) in one domain, Building (3) in one domain, and Buildings (4, 5, 6) in one domain
- CBuildings (1, 2, 4, 5, 6) in one domain and Building (3) in one domain
- DBuildings (1, 2, 3, 4, 5, 6) in one domain
- EBuildings (1) in one domain building (4) in one domain
133An AP is not communicating with the controller. Upon investigation you find that the AP is not discovering its controller through DNS. Instead, it received a DHCP reply with option 43 specifying the SIP server's IP address. How do you resolve this problem?
- AStatically configure the AP to ignore Option 43
- BOn the DHCP server implement Option 60
- CStatically configure the AP to only use DNS resolution and not other dynamic discovery methods
- DAfter failing option 43 the AP should have proceeded with ADP, therefore the AP is faulty and needs to be replaced
- EThe AP should be purged
134How is an AP redirected to a Local controller after DNS resolution returns the Master's IP address?
- AMaster looks at the AP-Group and CONTROLLER-IP attributes
- BMaster looks at the AP-Group and LMS-IP attributes
- CIn the AP-provisioning screen, the LMS-IP attribute must be set
- DThe AP must be statically configured to find the local controller
- EIn the AP-provisioning screen, set the CONTROLLER-IP attribute
135A controller is provisioned in L3 Mode for Wireless Users. What must be configured on the controller to enable DHCP requests to an external DHCP server?
- Aan IP helper command
- Bthe IP address of the DNS server
- Cthe IP address of the APs
- Dthe subnet address of the DHCP server
- Ethe DHCP server IPSEC Key
136Which of the following configurations can accept a VLAN pool?(Choose two)
- ATrunk native VLAN
- BVirtual AP profile
- CUser Role
- DServer derived role
- EFW Policies
137A Valid client laptop is attempting to associate to a Rogue AP. The AM in proximity creates a Tarpit. What are the two mechanisms that the AM can utilize to Tarpit?(Choose two)
- AFake client's BSSID
- BFake SSID
- CFake Channel
- DFake BSSID
- EFake ESSID
138Which of the following parameters can be specified in a rule for AP classification? (Choose three)
- ASSID of an AP
- BNumber of clients connected to an AP
- CSNR of an AP.
- DOperating mode of an AP
- EDiscovering APs
139ver 28
Referring to the diagram provided for this question, an employee brought an unauthorized AP from home and attached it to the cubicle Ethernet port as shown in the diagram. The APs are in VLANs as shown in the diagram. Only AP1 is within RF range.
How will the Aruba controller classify this AP?- Aan AP
- Ban AM
- Ca Rogue AP
- Dan Interfering AP
- Ea workstation
140ver 29
Referring to the diagram provided for this question, an employee brought an unauthorized AP from home and attached the LAN port to the cubicle Ethernet port. All Aruba APs and AMs as well as the employee AP are in VLAN 80 and within RF range of each other. No traffic from the wired or wireless network has passed through the unauthorized AP yet, but the AP began wireless broadcasts.
How will the Aruba system initially classify the employee's non-Aruba AP?- Aa valid AP
- Ban AM
- Ca Rogue AP
- Dan interfering AP
- Ea known interfering AP
141Which of the following functions can be configured in the Controller WIP wizard? (Choose three.)
- AConfigure APs as Air Monitors
- BConfigure rules for AP classification
- CConfigure preset levels for intrusion detection
- DBlacklisting Rules for clients
- EIdentify encryption method used in your network.
142A client has not purchased the RF Protect license. Without this license what is still supported, in the basic OS?
- AOnly Intrusion Detection but no Intrusion Protection
- BRogue Detection and Containment
- CSpectrum Analysis
- DCan only configure High, Medium and Low settings, No customization
- EWithout the License there is no Intrusion detection nor Intrusion Protection
143(group8) #show ap active
Active AP Table
---------------
Name Group IP Address 11g Clients 11g Ch/EIRP/MaxEIRP 11a Clients 11a
Ch/EIRP/MaxEIRP
---- ----- ---------- --------- ------------------- ----------- -------------------
AP1 building1 10.1.80.150 0 AM 0 AM
AP2 building1 10.1.80.151 0 AM 0 AM
A user called technical support because they cannot see any of their APs in building one.
You perform the "show" command as illustrated above.
What can you conclude about these two APs from this output?- Athe GRE for the APs terminate on two different controllers: 10.1.80.150 and 10.1.80.151
- Bthe system will not function because there is no building1 group defined
- Cthe building1 APs will not accept any user connections
- Dthe user needs to configure his client to use the b/g band
- Ethe user needs to configure his client to use the a band
144(group8) #show ap arm history ap-name AP1
Interface :wifi0
ARM History
-----------
Time of Change Old Channel New Channel Old Power New Power Reason
-------------- ----------- ----------- --------- --------- ------
2015-1-28 07:58:53 157+ 149+ 21 21 I
2015-1-28 07:52:06 149+ 157+ 21 21 M
2015-1-28 07:16:59 157+ 149+ 21 21 I
Interface :wifi1
ARM History
-----------
Time of Change Old Channel New Channel Old Power New Power Reason
-------------- ----------- ----------- --------- --------- ------
2015-1-28 08:52:53 6 1 21 21 I
Referring to the output above. What can you conclude about AP1?- AThis device is scanning channels.
- BThis device is unstable because the channel assignment changed.
- CThe device changed channels recently
- DThe device changed channels and power levels recently
- EThe device is transmitting at maximum power levels
145ver 30
Referring to the diagram provided for this question, an employee brought an unauthorized AP from home, but did not attach it to the LAN infrastructure. The APs are in the VLANs as shown in the diagram. Only AP1 is within RF range of the employee AP.
By default, how will the Aruba system classify the employee's AP?- Aan AP
- Ban AM
- Ca Rogue AP
- Dan Interfering AP
- Ea valid workstation
146What can an AM do that an AP cannot do?
- ADetect rogue APs
- BDetect an AP failure
- CScans all channels in under 1 minute
- DDetect interfering APs
- EScan all valid channels
147ver 31
Based on the above screen capture for Interfering APs, what can you conclude?- AThe APs must be connected to the Aruba network
- BThe APs are classified as interfering because they are all transmitting on channel 6.
- CThere must not be any evidence that the APs are attached to the wired corporate network.
- DThese APs are classified as interfering because they are not Aruba APs.
- EThey are classified as interfering because they are running in g mode.
148A client device associates with an SSID provisioned with 802.1X authentication. The client is set for LEAP authentication. EAP termination (AAA Fastconnect) is enabled on the controller. But the client continuously cycles through the authentication process. Which of
the following could cause this?- AThe Radius server is rejecting the client credentials
- BThe client has an expired or revoked server certificate
- CThe DHCP server is not enabled
- DThe VLAN is missing for the SSID
- EThe controller does not support LEAP in this mode
149A client attaches to a secure jack interface set to untrusted. But when the client tries to access the captive portal page, the following message appears, "Web Authentication is not enabled." What might be wrong?
- AThe client has the browser provisioned with proxy settings.
- BThe controller port needs to be set to trusted
- CA "aaa" profile needs to be selected on the Wired Access page.
- DA Captive Portal profile needs to be assigned to the initial role.
- EWeb Authentication cannot be used in this way
150ver 32
Referring to the diagram provided for this question, representing an office wireless LAN deployment, there will be approximately 250 users in the offices section of the building. All Switches are setup as L3 routers.
According to Aruba best practice, which network device is the best choice for the wireless clients' default gateway?- Adevice 'A'
- Bdevice 'B'
- Cdevice 'C'
- Ddevice 'D'
- Edevice 'C or D'
151An Aruba controller is configured with the correct IP address and gateway information and is connected to the corporate LAN via a core layer 2 switch. Control Plane Security is not enabled on the network. An access point is provisioned with AP name and group and connected to a different Layer 2 switch on the corporate LAN that has IP connectivity to the core layer 2 switch. The AP powers on and layer 2 connects to the network, but the wireless radios do not power on.
- Athe layer 2 switches have ACLs that block GRE traffic
- Bthe layer 2 switches are configured to block IPSec traffic
- Ca DHCP server is not configured for the segment to which the AP is connected
- Dthe AP's mac address needs to be configured in the Aruba controller whitelist
- Ethe AP and controller are in different subnets
152IEEE 802.11r provides support for which of the following:
- Aradio measurements within a WLAN
- Bradio measurement within an ESS
- Cfast roaming within an ESS
- Dfast roaming within a BSS
- Eroaming across controllers
153ver 33
In the diagram provided for this question, four buildings are identified on a college campus.
Most of the wireless LAN traffic will be from students accessing the internet.
According to Aruba best practices, which building is the best location to install the Aruba mobility controller?- Adata center
- Bdormitory
- Cserver farm
- Dlibrary
- E3rd party site
154Which command, when executed on a master controller, will show the APs connected to all controllers?
- Ashow stm connectivity
- Bshow ap active
- Cshow ap database
- Dshow ap bss-table
- Eshow ap controller-lms
155An Aruba based network has a Master and four local controllers deployed. But one of the locals, a new installation, is not seen by the Master. What might be wrong? (Choose two.)
- APAPI is not enabled on the local controller
- BThe master controller can only support three local controllers
- CIPSec is blocked by the internal network between the local and the master controllers
- DThe passphrase does not match on the master and local controllers
- EGRE is blocked between the master and local controllers
156Which of the following commands is most useful in showing the traffic of an individual user?
- Ashow datapath session table
- Bshow acl hits
- Cshow rights
- Dshow firewall
- Eshow traffic client
157One hundred (100) additional APs were deployed in an existing network. But some APs are not able to connect to the lms-ip address, even though all of the APs belong to the same AP group. Which of the following are NOT potential causes? (Choose two).
- AThe problem APs are not getting an IP address
- BThe problem APs have the wrong lms-ip address setting.
- CThere is a firewall between the problem APs and the controller blocking PAPI.
- DThe controller does not support that many APs in a single AP-Group
- EThere are not enough AP licenses to support the additional quantity of APs.
158A client device associates with an SSID provisioned with 802.1X authentication. The client is set for PEAP authentication. EAP termination (AAA Fastconnect) is disabled on the controller. But the client continuously cycles through the authentication process. Which of the following could cause this? (Choose two)
- AThe client is provisioned with the wrong EAP type.
- BThe client has an expired or revoked server certificate
- CThe DHCP server is not enabled
- DThe VLAN is missing for the SSID
- EThe controller does not support PEAP in this mode.
159The corporation has deployed hundreds of RAP3 and all are working. A user has received a RAP3 from the IT department. At his home he connects the Ethernet port to his DSL modem. The corporate SSID is not advertises but an Instant SSID is. What could be the problem?
- AThis RAP was purchased as an IAP and not as a RAP
- BThe activate server does not have this RAPs configured
- CThe corporate Firewall is blocking VPN
- DThe RAP3 must be pre-staged
- EThe user must connect his laptop, get the Zero touch window and enter the URL
160Which of the following are NOT valid RAP forwarding modes (Choose two)?
- ATunnel
- BBridge
- CSplit-Tunnel
- DBackup
- EStandard
161If a Remote AP (RAP) is attempting to contact a controller that is behind a NAT device what protocol must be allowed through the NAT/Firewall?
- APAPI
- BNATT
- CIPSec
- DSSH
- EGRE
162What is the purpose of Mesh Clusters?
- ATo separate Mesh points from Mesh Portals.
- BTo ensure that mesh APs with the same VAPs are not in the same cluster.
- CTo define a group of mesh APs that create mesh links with each other.
- DTo cluster mesh APs of the same model together
- ETo enable mesh APs to join the nearest mesh portal cluster
163A Remote AP provisioned in "Split-Tunnel" Forwarding mode has which of the following characteristics?.
- ALocal traffic first goes to the controller and is then spilt back to the local network.
- BUser Traffic is CPSec encrypted before it is sent to the controller.
- CThe user role must have a "Permit" statement in order to locally bridge the traffic.
- DThe user role must have a "permit dst-nat" statement to locally bridge the traffic.
- EThe RAP uses UDP 4500 to send traffic to the controller.
164A Remote AP provisioned with an SSID in "Bridged" forwarding mode has which one of the following characteristics?
- AThe client obtains its IP address from the controller.
- BThe client's default gateway must be the controller.
- CThe client traffic is forwarded through a GRE tunnel to the controller
- DThe client's default gateway may be the Access Point or a local gateway.
- EThe client's authentication must be 802.1X
165Which of the following are valid RAP operating modes?
- AAlways, Backup, Standard, Persistent
- BAlways, Backup, Tunnel, Persistent
- CAlways, Hotel-Connect, Tunnel, Standard
- DBackup, Hotel-Connect, Standard, Persistent
- EBackup, Normal, Tunnel, Always
166When does a RAP's backup SSID begin broadcasting?
- AWhen the GRE tunnel to the controller is established
- BWhen the IPSec tunnel to the controller is established.
- CWhen the controller cannot be reached with PAPI
- DWhen bridging is required for guest users
- EWhen the controller cannot be reached with SSL
167A Remote AP provisioned in "Split-Tunnel" Forwarding mode has which characteristic?
- ALocal traffic first goes to the controller and is then spilt back to the local network
- BTraffic is IPSec encrypted before it is sent to the controller.
- CThe user role must have a "Permit" statement in order to locally bridge the traffic.
- DThe user role must have a "route dst-nat" statement to locally bridge the traffic.
- EThe RAP uses PAPI to send data traffic to the controller.
168How does an Aruba infrastructure calculate a wireless device's location?
- AGPS
- BRF Fingerprinting
- CRSSI triangulation
- DTDOA
- ELBS
169Which of the following describes a Remote AP provisioned in "Split-Tunnel" Forwarding mode?.
- ALocal user traffic first goes to the controller and is then spilt back to the local network
- BAll data and control traffic goes to the controller unsecured
- CThe user role must have a "Permit" statement in order to locally bridge the traffic.
- DThe user role must have a "route src-nat" statement to locally bridge the traffic.
- EThe RAP uses PAPI to send data traffic to the controller
170When configuring split tunnel mode on a Remote AP (RAP) where is the routing function for the split tunnel defined?
- AOn the IP routing tab in the configuration screen.
- BOn the AP provisioning screen
- CIn the RAP static routing tables
- DIn the Firewall policy
- EIn the RAP whitelist
171A company purchased an indoor mesh deployment using the 7005 controller and the AP 115 models, where 5 APs will be deployed on a floor to provide wireless internet access for users. Users may open VPN tunnels using software clients over the wireless network to a 3rd party VPN concentrator overseas. The company wants to limit wireless user access to TCP traffic locally and VPN traffic overseas.
In addition to the base AOS, which licenses will be necessary for this deployment?- AVPN, PEF-NG
- BAP Capacity, PEF-NG
- CAP Capacity, PEF-NG, VPN
- DAP Capacity
- EPEF-NG, PEF-V
172A Remote AP was properly functioning before losing its internet connection and now cannot communicate with the controller. What SSID is the AP broadcasting?
- AThe SSID in Operational mode Always and Forwarding mode Backup
- BThe SSID in Operational mode Split Tunnel and Forwarding mode Bridge
- CThe SSID in Operational mode Always and Forwarding mode Tunnel
- DThe SSID in Operational mode Standard and Forwarding mode Tunnel
- EThe SSID in Operational mode Persistent and Forwarding mode Bridge
173An AP 105 was converted into a RAP. The RAP can authenticate its IPSec tunnel to a controller using which of the following methods? (Choose two.)
- A802.1X/EAP authentication
- BCaptive Portal authentication
- CIP address authentication
- DUsername/Password authentication.
- ECertificate/MAC address authentication
Información
- Descripción
- Informática y Comunicaciones Test sobre Mobility, creado por Erick Ibarra el 27/06/2017.
- Autor
- Erick Ibarra
- Idioma
- Español
- Visitas
- 26
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test