ACMP_6.4

ACMP_6.4 practice questions, page 7 of 7, with answer review and explanations.

Question 31

The Aruba Policy Enforcement Firewall (PEF) module supports source network address translation (src-nat). Which is a use of this statement in an Aruba configuration?

  1. provide a single source IP address for users in a role
  2. redirect Captive Portal HTTP sessions
  3. redirect Access Points to another Aruba controller
  4. provide IP addresses to clients
  5. redirects clients to Aruba Firewall

Question 32

Review the following truncated output from an Aruba controller for this item. (example) #show rights logon access-list List ---------------- Position Name Location - -------- ---- -------- 1 logon-control 2 captiveportal logon-control ------------- Priority Source Destination Service Action -------- ------ ----------- ------- ------ 1 user any udp 68 deny 2 any any svc-icmp permit 3 any any svc-dns permit 4 any any svc-dhcp permit 5 any any svc-natt permit captiveportal ------------- Priority Source Destination Service Action -------- ------ ----------- ------- ------ 1 user controller svc-https dst-nat 8081 2 user any svc-http dst-nat 8080 3 user any svc-https dst-nat 8081 4 user any svc-http-proxy1 dst-nat 8088 5 user any svc-http-proxy2 dst-nat 8088 6 user any svc-http-proxy3 dst-nat 8088 Based on the above output from an Aruba controller, an unauthenticated user assigned to the logon role attempts to start an http session to IP address 172.16.43.170. What will happen?

  1. the user's traffic will be passed to the IP address because of the policy statement:user any svc-http dst-nat 8080
  2. the user's traffic will be passed to the IP address because of the policy statement:user any svc-https dst-nat 8081
  3. the user's traffic will be passed to the IP address because of the policy statement:user any svc-http-proxy1 dst-nat 8088
  4. the user will not reach the IP address because of the policy statement:user any svc-http dst-nat 8080
  5. the user will not reach the IP address because of the implicit deny any any at the end of the policy.

Question 33

Refer to the following configuration segment for this item. ip access-list session anewone user network 172.16.1.0 255.255.255.0 any permit user host 172.16.1.1 any deny user any any permit An administrator wants users to have access to all destinations except 172.16.1.1. Based on the above Aruba Mobility Controller configuration segment, which statements best describe this policy? (Choose two)

  1. The rule user host 172.16.1.1 any deny is redundant because of the implicit deny all at the end.
  2. The rule user network 172.16.1.0 255.255.255.0 any permit is redundant.
  3. The two rules user network 172.16.1.0 255.255.255.0 any permit and user host 172.16.1.1 any deny need to be re-sequenced.
  4. The last statement user any any permit is not required
  5. The last statement should be any any any deny

Question 34

Refer to the following configuration segment for this item. netdestination "internal" no invert network 172.16.43.0 255.255.255.0 position 1 range 172.16.11.0 172.16.11.16 position 2 ! ip access-list session "My-Policy" alias "user" alias "internal" service_any permit queue low ! A user frame is evaluated against this firewall policy with the following attributes: Source IP: 172.17.49.3 Destination IP: 10.100.86.37 Destination Port: 80 Referring to the above file segment, how will the frame be handled by this firewall policy?

  1. The frame will be dropped because of the implicit deny all at the end of the netdestination definition.
  2. The frame will be dropped because of the implicit deny all at the end of the firewall policy.
  3. The frame will be forwarded because of the implicit permit all at the end of the firewall policy.
  4. The frame will be passed because there is no service specified in the firewall policy.
  5. The frame will be dropped because there is no service specified in the firewall policy.