HPE7-A10: HPE Network Security Expert Written ExamDemo

By HP · Question Mode

QuestionQ49

Protect and Defend

A customer uses an AOS-10 architecture that includes HPE Aruba Networking APs. The customer recently enabled WIDS at the High level on the APs. Administrators observe many "detect disconnect station" events.

What should you explain?

  • A The WIDS solution is likely malfunctioning, causing APs to disassociate each other’s clients. You will check the configuration immediately.
  • B A hacker is likely targeting the customer s network for a DoS attack. You will locate the source MAC address associated with the event and remove the device.
  • C The WLAN is likely misconfigured with legacy security settings. You will check the WLAN configuration immediately.
  • D Client drivers and interference can cause false positives of this event. You will look out for other stronger signs of attack such as rogue APs and disassociation broadcasts.
Explanation

The disconnect-station detector can report false positives caused by client drivers and RF interference. Although the detector is designed to identify station-disconnection attacks involving spoofed deauthentication frames, a large number of alerts alone does not establish an attack. Corroborating evidence, such as rogue APs or deauthentication and disassociation broadcasts, is needed before treating the alerts as malicious activity.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!