A network administrator creates the role employees and adds this rule to it: user any any permit
The first several wireless clients assigned to the employees role are assigned IP addresses in the 10.10.10.0/24 subnet. Several other wireless clients with the employees role are then assigned IP addresses in the 10.10.20.0/24.
When the Aruba firewall matches traffic from these clients to the user any any permit rule, what does it do? It permits traffic from wireless clients in both the 10.10.10.0/24 and 10.10.20.0/24 subnet as long as the packet has a source IP. It permits the traffic from wireless clients in the 10.10.20.0/24 subnet, but drops the traffic from wireless clients in the 10.10.10.0/24 subnet. It drops traffic from wireless clients in both the 10.10.10.0/24 and 10.10.20.0/24 subnet. It permits the traffic from wireless clients in the 10.10.10.0/24 subnet, but drops the traffic from wireless clients in the 10.10.20.0/24 subnet.
A company has many 7220 controllers in its Aruba wireless architecture. A network administrator wants to use the Traffic Analysis dashboard in order to monitor which type of applications are being used by wireless users.
What is required for this implementation? AirMatch and ClientMatch must be enabled. The solution must have active PEFNG licenses. WLANs must use the decrypt-tunnel forwarding option. Firewall policies must include application filtering rules.
A network administrator configures an Aruba Mobility Master (MM)-based solution to provide wireless access to employees. The solution must meet these criteria:
✑ Authenticate users to a network RADIUS server
✑ Enforce different Aruba firewall rules based on the user department
How can the administrator meet these criteria in the simplest way? Create a different WLAN and SSID for each department. Apply different firewall policies to each WLAN. Have the RADIUS server send different roles for users in different departments. Apply role-based firewall policies. Create multiple zones on the MM. Assign different departments are sets of firewall policies to different zones. Have the RADIUS server assign users in different departments to different VLANs. Apply firewall policies based on IP ranges.
A network administrator configures this policy:
Users to which this policy apply are unable to receive IP addresses with DHCP. How should the administrator fix the issue? Move the user any svc-dhcp permit rule to the bottom of the list. Remove the deny rule from the policy. Use the correct service alias in the user any svc-dhcp permit rule. Change user to any in the user any svc-dhcp permit rule.
An Aruba solution runs ArubaOS 8 and uses a mobility master architecture. Which feature can network administrators use to balance wireless across APs on different channels? AppRF ARM Client Match AirMatch.
What is the difference between how a network administrator can monitor clients in the Mobility (MM) interface and in the AirWave Management Platform? AirWave shows trends for the past several minutes, while MM shows longer trends. AirWave combines information from more sources, such as RADIUS authenticating servers and APs. AirWave shows the current signal level for the client connection, while MM does not show RF statistics. MM shows user and role information associated with clients, while AirWave does not.
An AP operates on channel 6. Which device causes the most significant and consistent interference with the signal? cellular phone AP operating on channel 11 wireless security camera operating on channel 8 weather radar.
What is a reason for a company to choose to deploy an Aruba 7024 Mobility Controller (MC) rather than an Aruba 7010 MC? to support a faster firewall throughput rate to support 802.11ac APs rather than only 802.11n APs to support more wireless users to support more POE devices directly connected to the MC.
The exhibit shows output from a Mobility Master (MM) dashboard. What is a valid reason for the administrator to click the akamai square under applications? to see the break down for only the roles, destinations, WLANs, and devices that use this application to download a report about the usage of this application over time to create filter rules in order to control wireless user access to this application to set up bandwidth rule in order to control wireless user access to this application.
A company has an Aruba solution that supports an employee WLAN. How can network administrators control in which subnets user receive IP addresses? Assign switch ports connected to APs to VLANs associated with the desired subnets. Set the VLANs associated with desired subnets in the WLAN settings. Configure firewall policies that permit the desired subnet, and add them to the initial role for the WLAN. In the WLAN settings, configure User role rules with the desired subnet addresses as match criteria.
A network manager wants to implement an Aruba wireless solution that accommodates 802.1X with EAP-TLS. All wireless users will utilize Active Directory (AD) accounts to authenticate.
Which device will the authenticator forward the authentication requests to in this type of solution? Mobility Master (MM) Mobility Controller (MC) RADIUS server APs.
A company wants to provide wireless access for guests with their Aruba solution. Which configuration feature requires the customer to purchase PEFNG licenses? redirection of guests to an external captive portal customization of the internal captive portal login page addition of custom rules to control access for authenticated guests provision of DHCP services to unauthenticated guests.
What does an Aruba Mobility Master (MM) do before it deploys a configuration to a Mobility Controller (MC)? It synchronizes the configuration with templates on Aruba AirWave. It removes any commands that are not supported on that MC or have dependency errors. It obtains the current configuration, encrypts it, and backs it up to a secure archive. It encrypts the configuration to be deployed and backs it up to a secure archive.
Which role must AP 1 play? Remote AP (RAP) Mesh Portal AP Instant AP (IAP) Mesh Point AP.
A company has an Aruba solution. The company wants to host a guest login portal with this solution, and the login portal must give guests the option to create their own login accounts.
How can a network administrator help meet these criteria? Choose the Internal captive portal with email registration option for the guest WLAN Make sure to create a guest provisioning account for the guest WLAN. Disable authentication in the captive portal profile for the guest WLAN. Choose ClearPass or the other external captive portal option for the guest WLAN.
How can network administrators upgrade AirMatch on an Aruba Mobility Master (MM)? Upgrade Client Match as part of a global software upgrade, and upgrade AirMatch separately as a loadable service module (LSM) Upgrade Client Match and AirMatch separately as loadable service modules (LSMs). Upgrade AirMatch and Client Match through a global software upgrade. Upgrade AirMatch as part of a global software upgrade, and upgrade Client Match separately as a loadable service module (LSM).
How does WPA2 protect wireless user traffic in the air? It provides both data integrity and privacy with AES. It provides data integrity with TKIP and data privacy with AES. It provides data privacy with TKIP and no data integrity. It provides data integrity with AES and no data privacy.
Which settings can a Mobility Master (MM) deploy to Mobility Controllers (MCs) but master controllers CANNOT deploy to local controllers? radio profiles WLAN settings Interface settings AAA profiles.
A company has an Aruba Mobility Master (MM)-based solution and needs a new WLAN for the corporate campus. A network administrator completes the creation of this WLAN, as shown in Exhibit 1. When the administrator tries to test a connection to the WLAN in various locations, the WLAN sometimes shows up in the list of WLANs on the client but sometimes does not. The administrator can see the WLAN in the list, as shown in Exhibit 2.
What is the error? The WLAN is configured at a lower level in the Managed Network hierarchy. The configuration is not deployed to the Mobility Controller (MC). The Mobility Master (MM) does not have an active PEFNG license. The WLAN is configured as a hidden SSID.
A company has an Aruba Mobility Master (MM)-based solution. Where can a network administrator look to find a list of alerts about a variety of issues on the MM or managed devices? the top banner the MM Maintenance pages the Performance dashboard the Potential issues dashboard
.
A company has a Mobility Master (MM)-based solution. A network administrator wants to monitor the types of applications in use in the wireless network.
Which dashboard page in the MM interface should the administrator visit? Performance Network Traffic Analysis Security.
What is one difference between captive portal authentication and 802.1X authentication? 802.1X authentication always authenticates the wireless client, while captive portal authentication always authenticates the wireless user. 802.1X authentication is typically implemented without encryption, while captive authentication is often combined with WPA or WPA2. 802.1X authentication occurs at Layer 2, while captive portal authentication occurs at Layer 3. 802.1X authentication must use an LDAP server, while captive portal authentication can use a RADIUS server or an LDAP server.
A network administrator needs to specify a RADIUS server for an employee WLAN on an Aruba solution. What must the administrator enter in the Shared key field? the password defined for authorized wireless clients on the RADIUS server and also distributed to authorized wireless clients the password defined as the preshared key for the WLAN on the Mobility Master (MM) and on authorized wireless clients the password configured in a user account with administrative rights on the RADIUS server the password configured for RADIUS clients on the RADIUS server.
A company has a Mobility Master (MM)-based solution with a guest WLAN. Users can connect to the WLAN, but they receive the error shown in the Exhibit 1 then they open their browser rather than see login page. Exhibit 2 shows the status for one of the guest clients.
What is one issue that could cause the errors described? The firewall blocks DHCP traffic between the guest clients and the DHCP server. The Captive Portal is not enabled for the role to which these clients are assigned. The DHCP pool for guests does not assign users a DNS server address. The MM and Mobility Controllers (MCs) have invalid certificates.
How can network administrator provide high availability for APs deployed in an Aruba Mobility Master (MM)-based architecture? Deploy all licenses locally to APs, so that they can continue to function if they lose contact with their controller. Configure APs to convert to controller-less Instant AP mode during controller failure. Establish clusters of Mobility Controllers (MCs). Configure MM to provide backup AP tunnel termination in case of controller failure.
A network administrator monitors an Aruba Mobility Controller with Aruba AirWave and sees the configuration status is Error. What should the administrator conclude? AirWave has a communication issue with the controller and cannot check the configuration. AirWave detects a mismatch with the controller configuration and software version AirWave determines that the controller configuration does not match the template for its group. AirWave checks the controller configuration and detects a syntax error.
An Aruba Remote AP (RAP) operates in split-tunnel mode. How does the AP forward traffic? It sends all user traffic in a GRE tunnel to a central Mobility Controller (MC), and it sends control traffic in an IPsec tunnel to the controller. It sends user and control traffic in two separate IPsec tunnels to the Mobility Controller (MC). It sends all employee and control traffic in a GRE tunnel to a central Mobility Controller (MC), and it bridges all guest traffic locally. It sends traffic designed to the corporate network in an IPsec tunnel to a central Mobility Controller (MC), and it bridges other traffic locally.
Network administrators need to set up a WLAN that uses WPA2 encryption and authenticates users with a preshared key (PSK) that is the same for all users.
Administrators do not see where they should specify the option for the preshared key.
What should the administrator do Click the + icon in the Authentication server section. Return to the first page in the wizard, and select the guest option. Click Personal in the side bar. Configure an L3 authentication profile after the WLAN wizard is complete.
A company has an Aruba Mobility Master (MM)-based solution and needs a new WLAN for the corporate campus. A network administrator completes the creation of this WLAN, as shown in Exhibit 1. When administrators try to test a connection to the WLAN, the WLAN does not show up in the list of WLANs on the client.
The administrator can see the WLAN in the list, as shown in Exhibit 2.
What is the error? The configuration is not deployed. The WLAN is configured at a lower level in the Managed Network hierarchy. The Mobility Master (MM) does not have an active PEFNG license. The WLAN is configured as a hidden SSID.
What describes the behavior for this WLAN? No APs broadcast the SSID. Clients cannot connect to the WLAN until administrators activate it. APs in the default group broadcast the SSID. Clients can connect to the WLAN on APs in any group. No APs broadcast the SSID. Clients can connect to the WLAN on APs in the default group only. APs in the default group broadcast the SSID. Clients can connect to the WLAN on APs in the default group only.
A company has an Aruba solution. The company wants to support a guest WLAN with the internal captive portal, but the company also wants to develop their own custom portal pages.
What correctly describes the level of customization that the internal captive portal supports? The internal captive portal must use the default pages without modification, but administrators can upload pages developed externally. The internal captive portal must use the default pages without modification, but administrators can upload pages developed externally. Administrators can modify the default internal captive portal pages, but cannot upload pages developed externally. Administrators can modify the default internal captive portal pages or upload pages developed externally.
Based on the exhibit, what is the maximum number of APs that this Mobility Master (MM) solution can support? 0 1 32 500.
What is a key difference between an Aruba Air Monitor (AM) and an Aruba Spectrum Analyzer (SA)? An AM detects threats such as rogue APs, while an SA analyzes RF conditions. An AM detects rogue APs and provides data services to clients, while an SA only detects rogue APs. An AM scans on only one 802.11 frequency band, while an SA scans on both 802.11 frequency bands. An AM both detects wireless intrusion attempts and mitigates them, while an SA only detects wireless intrusion attempts.
For which use should network administrators set up Aruba access points (APs) as multi-zone APs? The company requires high availability for its wireless services, and APs must be able to be controlled by more than once Mobility Controller (MC) in case a controller fails. The company has multiple small offices where APs at each branch office must forward internet traffic locally and corporate traffic over a secure tunnel to a centralized Mobility Controller (MC). The company has some devices that support both 5GHz and 2.4 GHz, and the APs must operate in both frequency bands. The company has a Mobility Manager (MM)-based solution that requires APs to terminate to multiple controllers that reside in different administrative domains.
Assume that administrators accept the default forwarding mode for WLANs. How does wireless user traffic flow in a master-local architecture, and how does it flow in a Mobility Master (MM) architecture? In the master-local architecture, traffic is tunneled to a local Mobility Controller (MC) to handle. In a MM architecture, all traffic is tunneled to the MM to handle. In the master-local architecture, all traffic is tunneled to the master controller to handle. In a MM architecture, all traffic is tunneled to the MM to handle. In both architectures, traffic is tunneled to a Mobility Controller (MC) to handle. In both architectures, APs forward corporate user traffic locally and tunnel guest user traffic to a Mobility Controller (MC) to handle.
A WLAN in an Aruba Mobility Master (MM)-based solution uses WPA2-Enterprise security. This WLAN currently authenticates users to Active Directory (AD), and users log in with their Windows domain credentials. Network administrators now want to authenticate the Windows clients as well, based on the client Computer
Names.
What should the administrator do on MM to achieve this goal? Set up MAC Authentication on the WLAN. Set up Machine Authentication on the WLAN. Import the computer names from AD to the MM internal database. Bind individual Mobility Controllers (MCs) to AD at the device level.
A company has an Aruba Mobility Master (MM)-based solution that runs ArubaOS 8 and uses the default AirMatch and Client Match settings. The ARM profile has been disabled for 5GHz radios.
How are channel and transmit power settings managed for these radios? with AirMatch with Rule Based Client Match with legacy ARM with legacy Client Match.
A customer has a large campus that requires 400 Aruba 335 APs to support a total of 10,000 wireless users and 12Gbps of traffic. Although the customer wants two controllers for redundancy, each controller must be able to support all of the APs and users on its own.
Which Aruba Mobility Controller models meet the customer requirements and DO NOT unnecessarily exceed them? Aruba 7030 controllers Aruba 7024 controllers Aruba 7240 controllers Aruba 7210 controllers.
The exhibit shows the AAA profile for a WLAN on an Aruba solution. This WLAN uses 802.1X authenticate users to a RADIUS server. A user successfully authenticates with 802.1X, but the RADIUS server does not send a role assignment.
How does the Aruba firewall handle the role assignment for this user? It does not assign a role. It applies the Aruba VSA role, employee. It assigns the logon role. It assigns the authenticated role.
A company currently uses Instant APs (IAPs), all managed by a virtual controller. The company expects to double in size within the next 18 months. The network manager wants to purchase additional APs to service the increased traffic load. The network manager also wants to deploy a Mobility Controller (MC) to manage all APs.
How should the network administrator adapt the current IAPs to a controlled architecture? Configure the IAPS to establish CPSec tunnels to the new MCs. Configure the IAPS to Campus APs, controlled by the new MCs. Manage both the MCs and IAP clusters with Aruba Central. Manage both the MCs and IAP clusters with a Mobility Master (MM).
How does a high-gain omni-directional antenna compare to a typical omni-directional antenna? it provides more coverage in both the horizontal and vertical directions. it provides more single-user spatial streams. it provides more coverage in the horizontal direction than in the vertical direction. it provides more multi-user spatial streams.
Which IEEE standard provides the highest transmission rates in the 2.4GHz frequency band? 802.11a 802.11ac 802.11g 802.11n.
A network administrator wants to assign an authentication server group to the WPA2-Enterprise WLAN. Which profile should the administrator modify? Virtual AP SSID AAA L2 Authentication.
What is one reason for a network administrator to visit the Dashboard > Usage window on an Aruba Mobility Master (MM)? to check license usage and determine the need for additional licenses to generate reports about traffic patterns and network usage over the past several months to view system usage statistics for the MM and troubleshoot potential issues to analyze short term trends in network usage by client, AP, and application.
A network administrator sets up the Exam_Employees WLAN on an Aruba solution with a default role of guest, as shown in the exhibit. To which users does the guest role apply? users who have connected to the SSID, but have not yet attempted authentication users who successfully authenticate and are assigned to the default role by the RADIUS server users who successfully authenticate and are not assigned a different role by the RADIUS server users who fall authentication.
A network administrator creates an employee WLAN on an Aruba solution that uses WLAN WPA2-Enterprise security and an external RADIUS server. When the administrator tests the WLAN, the test client receives limited connectivity and cannot access any resources, but the RADIUS server shows that the user authenticated successfully.
What should the administrator check as a possible source of this issue? the certificate on the RADIUS server the connectivity between the AP that the client is associated to and the MC the firewall role and policy that apply to this user the connectivity between the Master Controller (MC) for the client and the RADIUS server.
A network administrator examines a list of 2.4GHz clients with low performance in the Mobility Master (MM) dashboard. Which property should pose a concern as a potential performance issue? Radio PHY of HT 20MHz Goodput data rate of 12Mbps Max speed of 72Mbps Usage of 10 MB.
An Aruba Mobility Master (MM)-based solution has a WLAN that uses WPA2-Enterprise security. A test login on a wireless client fails.
How can a network administrator determine whether the RADIUS server rejected the credentials or another issue occurred? Use the tools in the MM Dashboard > Security window. Use the MC AAA Server Test Diagnostic tool. Ping the IP address configured as the RADIUS server. View Technical Support information for the MM.
A company plans to deploy a Mobility Master (MM) solution with two MM nodes. The MM solution will manage 10 Mobility Controller (MC) appliance that will control a total of 400 APs.
How should the network administrator install the AP licenses? 40 AP licenses on the MM and no licenses on the MC 400 AP licenses on the MM and no licenses on the MC 800 AP licenses on each MC and no licenses on the MM 800 AP licenses on the MM and 40 AP licenses on each MC.
A company has an Aruba Mobility Master (MM)-based solution. Under which circumstance will an AP radio change channel without the use of the Mobility Master
(MM)? when the MM detects that a different channel has significant better quality when the AP detects a large amount of interference on its channel when the Mobility Controller (MC) detects a rogue AP on the channel when the Client Match rules indicate that nearby clients do not support the current channel.
A network administrator creates a guest WLAN on an Aruba Mobility Manager (MM). The exhibits show some of the settings for the WLAN. The administrator does not change the policies for those roles.
How does the firewall control guest clients when they first connect to the WLAN? It permits them to send any DHCP traffic and DNS and web traffic to the Internet. It redirects web traffic destined to the private network to a login portal. It does not permit them to send any traffic until they are authenticated. It permits them to send any DHCP and DNS traffic, and it redirects all web traffic to a login portal. It permits them to send any DHCP and RADIUS traffic. It redirects all web traffic destined to the Internet to a login portal and drops web traffic destined to the private network.
Which Aruba controller supports a maximum of 512 APs? Aruba 7210 Aruba 7240 Aruba 7010 Aruba 7030.
A Mobility Controller (MC) runs ArubaOS 8. What is a valid reason for an administrator to set the MC to master-local mode? The company needs to manage third-party network infrastructure devices with the use of the master controller interface. The company already has a partially hierarchical deployment based on the 6.x code and wants to keep the current architecture. The company requires a centralized licensing architecture that provides global license pools. The company wants a deployment architecture that allows administrators to configure all MC settings from a single location.
A company has a Mobility Master (MM)-based solution. There is a hardware issue with the MM appliance, and, as result, all connectivity is lost between the appliance and the network. The network manager is concerned about how this will impact licensing.
How will the Mobility Controller (MC) be affected? The MC maintains its current licenses for 30 days. The MC loses all licenses and cannot support APs or clients. The MC contacts Aruba Activate and uses the licensing limits defined there. The MC maintains only licenses that have been locally installed on it.
What is an example of Layer 2 wireless threat that a wireless intrusion detection system (WIDS) should detect? spyware RF jamming Bluetooth interference 802.11 association floods.
A company has an Aruba Mobility Master (MM)-based solution. A network administrator wants to collect and analyze information about clients and access points
(APs) over extended periods of time.
What should the administrator do to achieve this goal? Run a Traffic Analysis report on the MM. Add Aruba AirWave to the solution. Enable archival from the MM interface Maintenance windows. Make sure that MM has sufficient AppRF licenses.
A company deploys an Aruba wireless solution for the first time. In which deployment is clustering supported? deployment as Mobility Masters (MMs) deployment in 7000 Series standalone mode deployment as a standalone VMC deployment in master-local mode.
A company has an Aruba solution. Client 1 is assigned to the users1 role, and Client 2 is assigned to the users2 role. The exhibits show current firewall rules for those roles. The network1 alias used to be 10.1.1.0/24, but the network administrator now changes the network1 alias to 172.16.1.0/24. Client 1 and Client 2 both then send a packet destined to 172.16.1.10.
How does the firewall handle these packets? It denies both packets. It denies the packet from Client 1 and permits the packet from Client 2. It permits both packets. It permits the packet from Client 1 and denies the packet from Client 2.
Which task can an Aruba Spectrum Monitor (SM) perform? Prevent client connections to rogue APs. Analyze RF signals to determine the cause of non-802.11 interference. Optimize RF through the AP channel and transmit power plans. Analyze wireless traffic patterns at the application level.
A company has an Aruba solution with a guest WLAN named exam_guest. A network administrator creates the guest WLAN with the wizard and does not change any of the default roles. The authentication server does not send particular role assignments for authorized users. The company wants to deny guests access to specific IP ranges after the guest authenticate.
For which role should the administrator create the rule to deny this traffic? guest authorized exam_guest-guest-logon guest-logon.
|
