HPE7-A10: HPE Network Security Expert Written ExamDemo

By HP · Question Mode

QuestionQ32

Analyze

You must install a certificate on a standalone HPE Aruba Networking Mobility Controller (MC). The MC must use the certificate for the Web UI and to implement RadSec with HPE Aruba Networking ClearPass Policy Manager. You have received a certificate with these settings:

  • Subject: CN=mc49.site30.example.com
  • No SANs
  • Issuer: CN=ca89.example.com
  • EKUs: Server Authentication, Client Authentication

What problem does this certificate have for its intended uses?

  • A It specifies domain info in the CN field instead of the DC field.
  • B It lacks a DNS SAN.
  • C It has conflicting EKUs.
  • D It is issued by a private CA.
Explanation

A DNS Subject Alternative Name is required to identify the controller’s WebUI TLS hostname under current hostname-validation practice. The existing Server Authentication and Client Authentication EKUs appropriately support WebUI server use and RadSec client use, respectively; a private CA can be used if it is trusted. Aruba documents that RadSec requires the managed device to send a TLS client certificate.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!