HPE7-A02 practice question 6 of 25

You have configured an AOS-CX switch to implement 802.1X on edge ports. Assume ports operate in the default auth-mode. VolP phones are assigned to the "voice" role and need to send traffic that is tagged for VLAN 12. Where should you configure VLAN 12?

Full set: 156 questions

Answer options

A: As the trunk native VLAN on edge ports and the trunk native VLAN on the "voice" role

B: As a trunk allowed VLAN on edge ports and the trunk native VLAN in the "voice" role

C: As the trunk native VLAN in the "voice" role (and not in the edge port settings)

D: As the allowed trunk VLAN in the "voice" role (and not in the edge port settings) Correct answer

Correct Answer:

D. As the allowed trunk VLAN in the "voice" role (and not in the edge port settings)

Explanation

In an ArubaOS-CX 802.1X deployment, policies for authenticated clients are applied via user roles. The default auth-mode is device-mode, which allows multiple authenticated clients on a single port, each with its own policy. Since the VoIP phone needs to send traffic tagged for VLAN 12, the "voice" role assigned to it must be configured to permit this tagged traffic. This is accomplished using the vlan trunk allowed command within the role definition. This dynamically configures the port to accept tagged frames on VLAN 12 from the authenticated phone. Configuring a native VLAN would be incorrect as that is used for untagged traffic.

Why Incorrect

A. Native VLAN is for untagged traffic. The phone is required to send tagged traffic for VLAN 12.
B. The role must specify an allowed trunk VLAN for tagged traffic, not a native (untagged) VLAN.
C. Native VLAN is for untagged traffic, which contradicts the requirement for the phone to send tagged traffic.

References

1. ArubaOS-CX 10.12 Security Guide

Page 101

"User roles" section.

The guide states

"A user role is a container for a set of policy elements that can be applied to a client." It then lists the vlan trunk allowed command

described as: "Specifies the allowed VLANs for a trunk mode client." This directly supports configuring the allowed tagged VLAN within the role.

2. ArubaOS-CX 10.12 Security Guide

Page 101

"User roles" section.

The guide also lists the vlan trunk native command

described as: "Specifies the native VLAN for a trunk mode client." This confirms that native VLAN is a separate configuration for untagged traffic

making options A

and C incorrect for a device sending tagged frames.

3. ArubaOS-CX 10.12 Security Guide

Page 87

"Port access modes" section.

This section explains that the default authentication mode is device-mode

where "each client is authenticated individually and policy is applied to each authenticated client on the port." This confirms that the policy (including VLANs) is applied via the role assigned to the specific device

not as a static port configuration.

Keep practicing

Take the free HPE7-A02 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test