NEW QUESTION 1
Refer to the exhibit.

Several interfaces on an AOS-Switch enforce 802.1X to a Radius server at 10.254.202.202. The interface 802.1X settings are shown in the exhibit, and 802.1X is also enabled globally. The security team have added a requirement for port security on the interfaces as well. Before administrators enable port security, which additional step must they complete to prevent issues?

• A. Set 802.1X client limit on the interfaces.
• B. Manually add legitimate MAC addresses to the switch authorized MAC list.
• C. Enable DHCP snooping on VLAN 20.
• D. Enable eavesdropping protection on the interface

Answer: C

NEW QUESTION 2
Refer to the exhibit.

An AOS-Switch connects to an unmanaged switch in a meeting room. The exhibit shows security settings for this port. Users report that they sometimes lose connectivity and then get it back.
Which best practice should network administrators follow to avoid issue?

• A. The loop protection and port security actions should be set to match.
• B. Eavesdrop prevention should be disabled when report security is in limited-continuous mode.
• C. Port security and loop protection should not be enabled on the same port.
• D. Loop protection should operate in VLAN mode, rather than port mode, when port security is enable

Answer: B

NEW QUESTION 3
Refer to the exhibit.

Switch-1 is routing traffic to 192.0.2.0/24 over a less-than-optimal path. Which issue could prevent Switch-1 from selecting the first route listed in the table as a best BGP route?

• A. It does not have AS 46501 configured on it.
• B. It has no route to 192.168.2.1 in its IP routing table.
• C. It has no network statement for 192.168.2.0/24 in its BGP configuration.
• D. It has learned the same route using OSP

Answer: B

NEW QUESTION 4
Refer to the exhibit.

A network administrator needs to alter myACL so that it permits all traffic that arrives in VLAN 2 and is destined to 10.1.10.0/24. Besides this change, the ACL must continue to act as it does now. The administrator plans this new rule: permit ip any 10.1.10.0/24

• A. Apply the new rule without a rule ID to ensure that the switch applies the automatic processing order to it.
• B. Resequence the ACL with more space, then add the new rule with a sequence ID before the ID for the current third rule.
• C. Remove the ACL from the VLAN and re-apply it as an inbound VLAN ACL (VACL). Then, add the new rule with any ID higher than 2.
• D. Enable ACL grouping on the switc
• E. Add the new rule in anew AC
• F. Then, group the new ACL with myAC

Answer: B

NEW QUESTION 5
A network administrator applies port security to a port with the send-alarm action. What does the switch do if it detects traffic from an unauthorized MAC address on the port?

• A. It disables the port, but sends no SNMP trap.
• B. It forwards the traffic, and it logs an event.
• C. It blocks the traffic, but sends no SNMP trap.
• D. It blocks the traffic, and it sends an SNMP tra

Answer: A

NEW QUESTION 6
Refer to the exhibit.
A network administrator configures connection rate filtering on interface 1 with the throttle action. Device 1 crosses the threshold and triggers the action.
What does the switch do?

• A. It temporarily drops all IP traffic from Device 1 only.
• B. It temporarily drops all IP traffic on interface 1.
• C. It drops all IP traffic from Device 1 until the host is manually unblocked.
• D. It drops all IP traffic on interface 1 until the interface is manually unblocke

Answer: A

NEW QUESTION 7
A network administrator enters this command: Switch(config)# aaa authorization user-role enable How does this affect device authentication?

• A. The local manager and operator accounts will no longer work unless they are associated with a user role on the switch.
• B. Authenticated devices must receive their dynamic settings, such as VLAN ID and ACLs, from the RADIUS server Access-Accept.
• C. Authenticated devices will be defined proper access if the RADIUS server sends any VSA except the user role VSA
• D. Role-based mode will no longer be available with tunneled node to prevent conflicts with the AAA user role

Answer: B

NEW QUESTION 8
Which benefit is provided by MD5 authentication for BGP?

• A. It validates that BGP messages arrive from an authorized device.
• B. It verifies that received BGP routes have valid next hop IP addresses.
• C. It enables users to authenticate to a server across BGP AS boundaries.
• D. It protects BGP routing information from eavesdropper

Answer: A

NEW QUESTION 9
Refer to the exhibit.

A known unicast packet is received from Switch-1 on the standby and must be forwarded to Switch-2. How does the VSF fabric decide which port in the aggregated link should forward the packet?

• A. The standby uses its own port in the link aggregation to forward the fabric.
• B. The standby sends the packet to the commander over a VSF link, and the commander decides the correct port.
• C. The standby uses the typical load sharing algorithm, and it might select either its port or the commander’s port.
• D. The standby selects the port on the designated forwarder for the aggregatio

Answer: A

NEW QUESTION 10
What is a reason to implement PIM-DM as opposed to PIM-SM?

• A. to control exactly which multicast groups are routed through the network
• B. to permit a higher density of RP routers in the network core
• C. to conserve bandwidth over WAN links
• D. to use on high-bandwidth routed connections

Answer: D

NEW QUESTION 11
Refer to the exhibits. Exhibit 1

Exhibit 2

A company does not require authentication for security, but AOS-Switches are set up to use local MAC authentication (LMA) to assign the correct VLAN and priority to IP phones. IP phones and computers belong to different VLANs. Each device is supposed to connect to a specific port, but sometimes users connect their devices to the wrong ports and cannot receive access without help from IT.
How can a network administrator configure the switches to eliminate this issue?

• A. Set the address limit to 2 on the switch ports that apply LMA.
• B. Create a user role that applies the user VLAN, and set this role as the initial role.
• C. Add the MAC addresses for computers to the myPhones MAC group.
• D. Apply LMA to all edge switch ports, and set the unauth VLAN to the user VLA

Answer: C

NEW QUESTION 12
A company has AOS-switches, Aruba ClearPass, and Aruba AirWave. A network administrator needs to find the source of a performance issue that often occurs at the start of the day and early in the afternoon. Which action is likely to give the administrator the most useful information for the investigation?

• A. Access the Network Device view on ClearPass.
• B. Use the configuration audit tool on AirWave.
• C. View the current running config on each switch.
• D. View usage patterns on the switches on AirWav

Answer: A

NEW QUESTION 13
The security plan for AOS-Switches requires protection from incoming malware traffic: generated from a wormor virus-infected host.
Which feature should be implemented to provide the required protection?

• A. DHCP snooping
• B. connection-rate filtering
• C. port security
• D. proxy ARP

Answer: B

NEW QUESTION 14
Which switches can be deployed in a mesh topology for backplane stacking?

• A. Aruba 2920 switches
• B. Aruba 2930F switches
• C. Aruba 2930M switches
• D. Aruba 3810 switches

Answer: D

NEW QUESTION 15
A network administrator applies the ACL shown in the exhibit. Which source IP address does the myList ACL deny?

• A. 10.1.0.10
• B. 10.1.1.10
• C. 10.1.2.10
• D. 10.2.1.10

Answer: D

NEW QUESTION 16
Network administrators want to gain insight into network utilization, traffic patterns, and the types of applications in use across the network over the long term.
Which technology can help them achieve this goal?

• A. RMON
• B. sFlow
• C. SNMP traps
• D. DiffServ

Answer: B

NEW QUESTION 17
AOS-Switches authenticate guests to ClearPass with captive portal. An administrator notices that some guests are unable to reach the captive portal page. What will resolve this issue?

• A. Permit DNS on the ClearPass Portal
• B. Permit DHCP on the ClearPass Portal.
• C. Permit HTTP or HTTPS on the ClearPass Portal.
• D. Permit Allow All MAC-Auth on the ClearPass Porta

Answer: A