Centralized Role Configuration on CPPM:

CPPM can assign roles to clients dynamically during authentication.

However, the actual ACL policies (e.g., firewall policies) must already exist and be referenced locally on the switch.

CPPM cannot directly configure ACL details on AOS-CX switches.

Option Analysis:

Option A: Correct. The role is defined on CPPM, but it references a policy pre-configured on the switch.

Option B: Incorrect. This does not align with Aruba's centralized role-based access control design.

Option C: Incorrect. CPPM cannot configure the ACL policies and classes directly; they must exist locally.

Option D: Incorrect. Policies can be referenced centrally but not fully configured on CPPM.