Aruba Certified Network Security Professional (HPE… Practice Exam

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

118Practice Questions

3Study Modes

Free

TopicSort

Question 1

Define security terminology

Which statement describes Zero Trust Security?

A Companies must apply the same access controls to all users, regardless of identity.
B Companies that support remote workers cannot achieve zero trust security and must determine if the benefits outweigh the cost.
C Companies should focus on protecting their resources rather than on protecting the boundaries of their internal network.
D Companies can achieve zero trust security by strengthening perimeter security to detect a wider range of threats.

Question 2

Threat detection

Question 3

Secure wired AOS-CX

Question 4

Threat detection

Question 5

Endpoint classification

Question 6

Endpoint classification

Question 7

Threat detection

Question 8

Secure wired AOS-CX

Question 9

Endpoint classification

Question 10

Endpoint classification

Question 11

Threat detection

Question 12

Forensics

Question 13

Endpoint classification

Question 14

Troubleshooting

Question 15

Secure wired AOS-CX

Question 16

Secure wired AOS-CX

Question 17

Forensics

Question 18

Secure the WAN

Question 19

Secure WLAN

Question 20

Secure wired AOS-CX

Question 21

Secure WLAN

Question 22

Secure WLAN

Question 23

Secure WLAN

Question 24

Endpoint classification

Question 25

Forensics

Page 1 of 5 • Questions 1-25 of 118

1 2 3 4 5

→

Know a question that should be here? Contribute to this exam

Refer to the exhibit.

Question Image

(Note that the HPE Aruba Networking Central interface shown here might look slightly different from what you see in your HPE Aruba Networking Central interface as versions change; however, similar concepts continue to apply.)
An HPE Aruba Networking 9x00 gateway is part of an HPE Aruba Networking Central group that has the settings shown in the exhibit. What would cause the gateway to drop traffic as part of its IDPS settings?

A Its site-to-site VPN connections failing
B Traffic matching a rule in the active ruleset
C Its IDPS engine failing
D Traffic showing anomalous behavior

An AOS-CX switch has been configured to implement UBT to two HPE Aruba Networking gateways that implement VRRP on the users’ VLAN.
What correctly describes how the switch tunnels UBT users’ traffic to those gateways?

A The switch always sends the users’ traffic to the VRRP master.
B The switch always sends all users’ traffic to the primary gateway configured in the UBT zone.
C The switch always load shares the users’ traffic across both gateways.
D The switch always sends all users’ traffic to the gateway assigned as the active device designed gateway.

HPE Aruba Networking Central displays an alert about an Infrastructure Attack that was detected. You go to the Security> RAPIDS events and see that the attack was “Detect adhoc using Valid SSID.”
What is one possible next step?

A Make sure that you have tuned the threshold for that check, as false positives are common for it.
B Make sure that clients have updated drivers, as faulty drivers are a common explanation for this attack type.
C Use HPE Aruba Networking Central floorplans or the detecting AP identities to locate the general area for the threat.
D Look for the IP address associated with the offender and then check for that IP address among HPE Aruba Networking Central clients.

A company uses both HPE Aruba Networking ClearPass Manager (CPPM) and HPE Aruba Networking ClearPass Device Insight (CPDI).
What is one way integrating the two solutions can help the company implement Zero Trust Security?

A CPPM can inform CPDI that it has assigned a particular Aruba-User-Role to a client, CPDI can then use that information to reclassify the client.
B CPDI can use tags to inform CPPM that clients are using prohibited applications; CPPM can then tell the network infrastructure to quarantine those clients.
C CPPM can provide CPDI with custom device fingerprint definitions in order to enhance the company’s total visibility.
D CPDI can provide CPPM with extra information about user’s identity; CPPM can then use that information to apply the correct identify-based enforcement.

Question 6

Endpoint classification

Question 7

Threat detection

Question 8

Secure wired AOS-CX

Question 9

Endpoint classification

Question 10

Endpoint classification

Question 11

Threat detection

Question 12

Forensics

Question 13

Endpoint classification

Question 14

Troubleshooting

Question 15

Secure wired AOS-CX

Question 16

Secure wired AOS-CX

Question 17

Forensics

Question 18

Secure the WAN

Question 19

Secure WLAN

Question 20

Secure wired AOS-CX

Question 21

Secure WLAN

Question 22

Secure WLAN

Question 23

Secure WLAN

Question 24

Endpoint classification

Question 25

Forensics

You have created a Web-based Health Check Service that references a posture policy. You want the service to trigger a RADIUS change of authorization (CoA) when a client receives a Healthy or Quarantine posture.
Where do you configure those rules?

A In a RADIUS enforcement policy
B In the Agents and Software Updates > OnGuard Settings
C In the posture policy
D In a WEBAUTH enforcement policy

Which issue can an HPE Aruba Networking Secure Web Gateway (SWG) solution help customers address?

A The organization needs a faster way to quarantine clients that have generated threats, as detected by third-party firewalls.
B Hybrid workers are exposing their computers to risky internet sites and infection by malware when they work from home.
C Remote workers need access to private data center applications without exposing those applications to unauthorized users.
D The organization currently has no way to prevent users from exfiltrating sensitive data from SaaS applications.

A company has a third-party security appliance deployed in its data center. The company wants to pass all traffic for certain clients through that device before forwarding that traffic toward its ultimate destination.
Which AOS-CX switch technology fulfills this use case?

A Virtual Network Based Tunneling (VNBT)
B MC-LAG
C Network Analytics Engine (NAE)
D Device profiles

What is a use case for running periodic subnet scans on devices from HPE Aruba Networking ClearPass Policy Manager (CPPM)?

A Detecting devices that fail to comply with rules defined in CPPM posture policies.
B Identifying issues with authenticating and authorizing clients
C Using WMI to collect additional information about Windows domain clients
D Using DHCP fingerprints to determine a client’s device category and OS

A company has a variety of HPE Aruba Networking solutions, including an HPE Aruba Networking infrastructure and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company passes traffic from the corporate LAN destined to the data center through a third-party SRX firewall. The company would like to further protect itself from internal threats.
What is one solution that you can recommend?

A Have the third-party firewall send Syslogs to CPPM, which can work with network devices to lock internal attackers out of the network.
B Add ClearPass Device Insight (CPDI) to the solution, integrate it with the third-party firewall to develop more complete device profiles.
C Configure CPPM to poll the third-party firewall for a broad array of information about internal clients, such as profile and posture.
D Use tunnel mode SSIDs and user-based tunneling (UBT) on AOS-CX switches to pass all internal traffic directly through the third-party firewall.

You want to examine the applications that a device is using and look for any changes in application usage over several different ranges.
In which HPE Aruba Networking solution can you view this information in an easy-to-view format?

A HPE Aruba Networking ClearPass OnGuard agent installed on the device
B HPE Aruba Networking Central within a device’s Live Monitoring page
C HPE Aruba Networking ClearPass Insight using an Active Endpoint Security report
D HPE Aruba Networking ClearPass Device Insight (CPDI) in the device’s network activity

A company has HPE Aruba Networking APs running AOS-10 and managed by HPE Aruba Networking Central. The company also has AOS-CX switches. The security team wants you to capture traffic from a particular wireless client. You should capture this client’s traffic over a 15-minute time period and then send the traffic to them in a PCAP file.
What should you do?

A Access the CLI for the client’s AP. Set up a mirroring session between its radio and a management station running Wireshark.
B Go to the client’s AP in HPE Aruba Networking Central. Use the “Security” page to run a packet capture.
C Go to that client in HPE Aruba Networking Central. Use the “Live Events” page to run a packet capture.
D Access the CLI for the client’s AP’s switch. Set up a mirroring session between the AP’s port and a management station running Wireshark.

A company wants you to create a custom device fingerprint on CPPM with rules for profiling a group of specialized devices.
What is one requirement?

A Connecting a known device of this type and getting it discovered in CPPM’s Endpoints Repository
B Enabling HPE Aruba Networking ClearPass Device Insight integration with the correct Data Collector token
C Pre-defining the desired attributes and rules in a XML format file
D Disabling the Automatically download Endpoint Profiler Fingerprints feature in cluster-wide parameters.

You are using Wireshark to view packets captures from HPE Aruba Networking infrastructure, but you’re not sure that the packets are displaying correctly. In which circumstances does it make sense to configure Wireshark to ignore protection bits with the IV for the 802.11 protocol?

A When the traffic was captured on the data plane of an HPE Aruba Networking gateway and sent to a remote IP
B When the traffic was mirrored from an AOS-CX switch port connected to an AP
C When the traffic was captured from an AP with HPE Aruba Networking Central
D When the traffic was captured on the control plane of an HPE Aruba Networking MC and set to a remote IP

A company has AOS-CX switches, which authenticate clients to HPE Aruba Networking ClearPass Policy Manager (CPPM). CPPM is set up to receive a variety of information about clients’ profile and posture. New information can mean that CPPM should change a client’s reinforcement profile.
What should you set up on the switches to help the solution function correctly?

A Enable RADIUS accounting to CPPM, including interim RADIUS accounting.
B Configure a RADIUS track that references CPPM’s FQDN or IP address.
C Enable dynamic authorization, and specify CPPM as a dynamic authorization client.
D Re-configure the authentication sever on the switch, specifying CPPM as a TACACS server.

A company wants to apply role-based access control lists (ACLs) on AOS-CX switches, which are implementing authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM). The company wants to centralize configuration as much as possible.
Which correctly describes your options?

A You can configure the role on CPPM; however, the CPPM role must reference a policy name that is configured on the switch.
B You can configure the role name on CPPM; however, the role settings, including policy and classes, must be configured locally on the switch.
C You can configure the role, its policy, and the classes referenced in the policy all on CPPM.
D You can configure the role and its policy on CPPM; however, the classes referenced in the policy must be configured locally on the switch.

A company has AOS-CX switches at the access layer, these switches are managed by the HPE Aruba Networking Central. You have identified suspicious activity on a wired client. You want to analyze the client’s traffic with Wireshark, which you have on your management station.
What should you do?

A Access the client’s switch’s CLI from your management station. Access the switch shell and run a TCP dump on the client port.
B Go to the client’s switch in HPE Aruba Networking Central. Use the “Security” page to run a packet capture.
C Set up a policy that implements a captive portal redirect to your management station. Apply that policy to the client’s port.
D Set up a mirror session on the client’s switch; set the client port as the source and your station IP address as the tunnel destination.

You are setting up policy rules in HPE Aruba Networking SSE. You want to create a single rule that permits users in a particular user group to access multiple applications. What is an easy way to meet this need?

A Associate the applications directly with the IdP used to authenticate the users; chose any for the destination in the policy rule
B Apply the same tag to the applications; select the tag as a destination in the policy rule
C Place all the applications in the same connector zone; select that zone as a destination in the policy rule
D Select the applications within a non-default web profile, select that profile in the policy rule

The following firewall role is configured on HPE Aruba Networking Central-managed APs:

Question Image

A client has authenticated and been assigned to the “employees” role. The client has IP address 10.2.2.2.
Which correctly describes behavior in this policy?

A HTTPS traffic from 10.2.2.2 to 10.5.5.5 is denied.
B HTTPS traffic from 10.2.2.2 to 203.0.113.12 is denied.
C Traffic from 10.5.3.3 in an active HTTPS session between 10.2.2.2 and 10.5.3.3 is permitted.
D Traffic from 198.51.100.12 in an active HTTP session between 10.2.2.2 and 198.51.100.12 is denied.

A company has HPE Aruba Networking APs running AOS-10 that connect to AOS-CX switches. The APs will:
-Authenticate as 802.1X supplicants to HPE Aruba Networking ClearPass Policy Manager (CPPM)
-Be assigned to the “APs” role on the switches
-Have their traffic forwarded locally
What information do you need to help you determine the VLAN settings for the “APs” role?

A Whether the switches are using local user-roles (LURs) or downloadable user-roles (DURs)
B Whether the APs bridge or tunnel traffic on their SSIDs
C Whether the switches have established tunnels with an HPE Aruba Networking gateway
D Whether the APs have static or DHCP-assigned IP addresses

A company has HPE Aruba Networking infrastructure devices. The devices authenticate clients to HPE Aruba Networking ClearPass Policy Manager (CPPM). You want CPPM to track information about clients, such as their IP addresses and their network bandwidth utilization.
What should you set up on the network infrastructure devices to help that happen?

A Logging with CPPM configured as a Syslog server
B Dynamic authorization enabled in the RADIUS settings for CPPM
C RADIUS accounting to CPPM, including interim updates
D An IF-MAP interface with CPPM as the destination

A company has HPE Aruba Networking Central-managed APs. The company wants to block all clients connected through the APs from using YouTube.
Which steps should you take?

A Enable WebCC on all client firewall roles. Then, create WebCC category rules that deny suspicious URLs.
B Enable DPI. Then, create application rules to deny YouTube on the firewall roles.
C Enable Client IPS at the “custom” level, and then specify the check for YouTube.
D Deploy gateways and have the APIs tunnel traffic to the gateways. Then, enable the gateway IDS/IPS engine.

A company has HPE Aruba Networking APs and AOS-CX switches. The APs bridge wireless traffic. They receive DHCP IP addresses on VLAN 18. Wireless users are assigned to VLAN 12. The company wants APIs to start using 802.1X authentication.
You are configuring the port-access role to which the APs are assigned post-authentication.
What is one recommended setting for that role?

A Trust for DSCP
B Access VLAN 18 with no support for VLAN 12
C Auth-mode left at client-mode
D No trust for DSCP

A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). You have identified a device, which is currently classified as one type, but you want to classify it as a custom type. You also want to classify all devices with similar attributes as this type, both already-discovered devices and new devices discovered later.
What should you do?

A Create a user tag from the Generic Devices page, select the desired attributes for the tag, and save the tag.
B In the device details, select filter, create a user tag based on the device attributes, and save the tag.
C In the device details, select reclassify, create a user rule based on its attributes, and choose “Save & Reclassify.”
D Create a user rule from the Generic Devices page, select the desired attributes for the rule, and choose “Save.”

Refer to the exhibit.

Question Image

These packets have been captured from VLAN 10, which supports clients that receive their IP addresses with DHCP.
What can you interpret from the packets that you see here?

A Someone is possibly implementing a MAC spoofing attack to again unauthorized access.
B The mirroring session that captured the packets was likely misconfigured and captured duplicate traffic.
C An admin has likely misconfigured two clients to use the same DHCP settings.
D Someone is possibly implementing an ARP poisoning and MITM attack.

Join Us Among the Stars

Aruba Certified Network Security Professional (HPE7-A02)Preview

About the Aruba Certified Network Security Professional (HPE7-A02) Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25