HPE7-A10: HPE Network Security Expert Written ExamDemo

Question

A customer uses an AOS-10 architecture managed by HPE Aruba Networking Central. HPE Aruba Networking infrastructure devices authenticate clients against an HPE Aruba Networking ClearPass cluster.

In HPE Aruba Networking Central, you are reviewing network traffic flows for a wireless IoT device categorized as a “Raspberry Pi” client. You observe SSH traffic. You then inspect several additional wireless IoT clients and find that they are also sending SSH.

Refer to the scenario.

What potential issue does this indicate?

A A hacker might have inserted a rogue network device between these clients and the authorized router, creating a man-in-the-middle attack.
B The clients are likely responding to port scanning requests by a hacker attempting to conduct network reconnaissance.
C Network admins are not using proper management protocols when accessing user devices.
D These clients might be controlled by hackers through reverse SSH tunnels.

Explanation

Repeated outbound SSH traffic from multiple IoT endpoints can indicate that the devices are compromised and are maintaining reverse SSH tunnels. A reverse tunnel lets an attacker reach a device from outside the network through an outbound SSH connection, bypassing the usual restriction on unsolicited inbound connections.

Learn more

HPE Aruba Networking Central Application Visibility

HPE7-A10: HPE Network Security Expert Written ExamDemo

AstroTutor

Notes

Readiness

QuestionQ20

Community Discussion