What is one use case that companies can fulfill using HPE Aruba Networking ClearPass Policy Manager's (CPPM's) Device Profiler?

Leveraging artificial intelligence to more accurately identify Internet of Things (loT) devices

OIdentifying device security vulnerabilities by CVE ID and receiving remediation recommendations

Leveraging artificial intelligence to more accurately identify Internet of Things (loT) devices

Quarantining devices that do not have the required antivirus software installed on them

Assigning different AOS firewall roles to users on computers and the same users on smartphones

A company is implementing HPE Aruba Networking Wireless IDS/IPS (WIDS/WIPS) on its AOS-10 APs, which are managed in HPE Aruba Networking Central.What is one requirement for enabling detection of rogue APs?

A Foundation with Security license for each of the APs

Each VLAN in the network assigned on at least one AP's or AM's port

A Foundation with Security license for each of the APs

One AM deployed for every one AP deployed

A manual radio profile that enables non-regulatory channels

A company uses HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application option). In the details for a generic device cluster, you see a recommendation for 'Windows 8/10' with 70% accuracy.What does this mean?

CPDI has detected that these devices match about 70% of the system rule for defining 'Windows 8/10' devices.

CPDI has matched these devices against several, conflicting system rules. 70% of those rules are for 'Windows 8/10' devices.

CPDI has grouped this cluster with similar classified devices. 70% of those classified devices are 'Windows 8/10.'

CPDI has used MAC OUI to group these devices together. The average device's MAC address matches 70% of the 'Windows 8/10' OUI.

Refer to the Exhibit. All of the switches in the exhibit are AOS-CX switches.What is the preferred configuration on Switch-2 for preventing rogue OSPF routers in this network?

Configure OSPF authentication on Lag 1 in MD5 mode.

Disable OSPF entirely on VLANs 10-19.

Configure OSPF authentication on VLANs 10-19 in password mode.

Configure OSPF authentication on Lag 1 in MD5 mode.

Configure passive-interface as the OSPF default and disable OSPF passive on Lag 1.

A company has HPE Aruba Networking gateways that implement gateway IDS/IPS. Admins sometimes check the Security Dashboard, but they want a faster way to discover if a gateway starts detecting threats in traffic.What should they do?

Set up email notifications using HPE Aruba Networking Central's global alert settings.

Use Syslog to integrate the gateways with HPE Aruba Networking ClearPass Policy Manager (CPPM) event processing.

Integrate HPE Aruba Networking ClearPass Device Insight (CPDI) with Central and schedule hourly reports.

Set up email notifications using HPE Aruba Networking Central's global alert settings.

Set up Webhooks that are attached to the HPE Aruba Networking Central Threat Dashboard.

What is a use case for the HPE Aruba Networking ClearPass OnGuard dissolvable agent?

Implementing a one-time compliance scan

Continuously monitoring Windows domain clients for compliance

Implementing a one-time compliance scan

Auto-remediating posture issues on clients

Periodically scanning Linux clients for security issues

Which use case is fulfilled by applying a time range to a firewall rule on an AOS device?

Enforcing the rule only during the specified time range

Tuning the session timeout for sessions established with this rule

Locking clients that violate the rule for the specified time range

Setting the time range over which hit counts for the rule are aggregated

A company wants HPE Aruba Networking ClearPass Policy Manager (CPPM) to respond to Syslog messages from its Palo Alto Next Generation Firewall (NGFW)by quarantining clients involved in security incidents.Which step must you complete to enable CPPM to process the Syslogs properly?

Configure the Palo Alto as a context server on CPPM.

Install a Palo Alto Extension through ClearPass Guest.

Enable Insight and ingress event processing on the CPPM server.

Configure CPPM to trust the root CA certificate for the NGFW.

A company is implementing a client-to-site VPN based on tunnel-mode IPsec.Which devices are responsible for the IPsec encapsulation?

The remote clients and a gateway at the main site

Gateways at the remote clients' locations and devices accessed by the clients at the main site

The remote clients and devices accessed by the clients at the main site

The remote clients and a gateway at the main site

Gateways at the remote clients' locations and a gateway at the main site

You are using OpenSSL to obtain a certificate signed by a Certification Authority (CA). You have entered this command:openssl req -new -out file1.pem -newkey rsa:3072 -keyout file2.pemEnter PEM pass phrase: **********Verifying - Enter PEM pass phrase: **********Country Name (2 letter code) [AU]:USState or Province Name (full name) [Some-State]:CaliforniaLocality Name (eg, city) []:SunnyvaleOrganization Name (eg, company) [Internet Widgits Pty Ltd]:example.comOrganizational Unit Name (eg, section) []:InfrastructureCommon Name (e.g. server FQDN or YOUR name) []:radius.example.comWhat is one guideline for continuing to obtain a certificate?

You should submit file1.pem, but not file2.pem, to the desired CA to sign.

You should use a third-party tool to encrypt file2.pem before sending it and file1.pem to the CA.

You should concatenate file1.pem and file2.pem into a single file, and submit that to the desired CA to sign.

You should submit file1.pem, but not file2.pem, to the desired CA to sign.

You should submit file2.pem, but not file1.pem, to the desired CA to sign.

A company needs you to integrate HPE Aruba Networking ClearPass Policy Manager (CPPM) with HPE Aruba Networking ClearPass Device Insight (CPDI).What is one task you should do to prepare?

Enable Insight in the CPPM server configuration settings.

Install the root CA for CPPM's HTTPS certificate as trusted in the CPDI application.

Configure WMI, SSH, and SNMP external accounts for device scanning on CPPM.

Enable Insight in the CPPM server configuration settings.

Collect a Data Collector token from HPE Aruba Networking Central.

You have installed an HPE Aruba Networking Network Analytic Engine (NAE) script on an AOS-CX switch to monitor a particular function.Which additional step must you complete to start the monitoring?

Create an agent from the script.

Enable NAE, which is disabled by default.

Edit the script to define monitor parameters.

Create an agent from the script.

A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) and HPE Aruba Networking ClearPass Device Insight (CPDI) and has integrated the two. CPDI admins have created a tag. CPPM admins have created rules that use that tag in the wired 802.1X and wireless 802.1X services' enforcement policies.The company requires CPPM to apply the tag-based rules to a client directly after it learns that the client has that tag.What is one of the settings that you should verify on CPPM?

Both 802.1X services have the 'Profile Endpoints' option enabled and an appropriate CoA profile selected in the Profiler tab.

The 'Device Sync' setting is set to 1 in the ClearPass Device Insight Integration settings.

Both 802.1X services have the 'Profile Endpoints' option enabled and an appropriate CoA profile selected in the Profiler tab.

Both 802.1X services have the 'Use cached Role and Posture attributes from the previous sessions' setting.

The 'Polling Interval' is set to 1 in the ClearPass Device Insight Integration settings.

A company has HPE Aruba Networking APs and AOS-CX switches, as well as HPE Aruba Networking ClearPass. The company wants CPPM to have HTTP User-Agent strings to use in profiling devices.What can you do to support these requirements?

Add the CPPM server's IP address to the IP helper list in all client VLANs on routing switches.

Schedule periodic subnet scans of all client subnets on CPPM.

Configure mirror sessions on the APs and switches to copy client HTTP traffic to CPPM.

On the APs and switches, configure a redirect to ClearPass Guest in the role for devices being profiled.

Which statement describes Zero Trust Security?

Companies should focus on protecting their resources rather than on protecting the boundaries of their internal network.

Companies must apply the same access controls to all users, regardless of identity.

Companies that support remote workers cannot achieve zero trust security and must determine if the benefits outweigh the cost.

Companies can achieve zero trust security by strengthening their perimeter security to detect a wider range of threats.

What is a use case for running periodic subnet scans on devices from HPE Aruba Networking ClearPass Policy Manager (CPPM)?

Using DHCP fingerprints to determine a client's device category and OS

Detecting devices that fail to comply with rules defined in CPPM posture policies

Identifying issues with authenticating and authorizing clients

Using WMI to collect additional information about Windows domain clients

A company has an HPE Aruba Networking ClearPass cluster with several servers. ClearPass Policy Manager (CPPM) is set up to:. Update client attributes based on Syslog messages from third-party appliances. Have the clients reauthenticate and apply new profiles to the clients based on the updatesTo ensure that the correct profiles apply, what is one step you should take?

Tune the CoA delay on the ClearPass servers to a value of 5 seconds or greater.

Configure a CoA action for all tag updates in the ClearPass Device Insight integration settings.

Tune the CoA delay on the ClearPass servers to a value of 5 seconds or greater.

Set the cluster's Endpoint Context Servers polling interval to a value of 5 seconds or less.

Configure the cluster to periodically clean up (delete) unknown endpoints.

A company wants to turn on Wireless IDS/IPS infrastructure and client detection at the high level on HPE Aruba Networking APs. The company does not want to enable any prevention settings.What should you explain about HPE Aruba Networking recommendations?

HPE Aruba Networking recommends configuring infrastructure and client detection at a custom level and disabling or tuning some of the settings that are likely to produce false positives.

HPE Aruba Networking recommends turning on both wired and wireless prevention whenever you enable detection at high.

HPE Aruba Networking recommends using hybrid AP mode, as opposed to Air Monitors (AMs), when implementing detection without prevention.

HPE Aruba Networking recommends disabling client detection when you configure infrastructure detection at high, as infrastructure detection includes all the client checks and more.

HPE Aruba Networking recommends configuring infrastructure and client detection at a custom level and disabling or tuning some of the settings that are likely to produce false positives.

Refer to Exhibit. A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). In the CPDI interface, you go to the Generic Devices page and see the view shown in the exhibit.What correctly describes what you see?

Each cluster is a group of unclassified devices that CPDI's machine learning has discovered to have similar attributes.

Each cluster is a group of devices that match one of the tags configured by admins.

Each cluster is all the devices that have been assigned to the same category by one of CPDI's built-in system rules.

Each cluster is a group of devices that have been classified with user rules, but for which CPDI offers different recommendations.

A company has AOS-CX switches and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company wants switches to implement 802.1Xauthentication to CPPM and download user roles.What is one task that you must complete on the switches to support this use case?

Install the root CA certificate for CPPM's RADIUS certificate in a TA profile on the switches.

Specify CPPM as the RADIUS server with the exact CN in CPPM's HTTPS certificate.

Install the root CA certificate for CPPM's RADIUS certificate in a TA profile on the switches.

Configure empty user-roles with names that match enforcement profile names on CPPM.

Specify a ClearPass username and password that match the name and RADIUS secret in a CPPM network device entry.

What is a benefit of Online Certificate Status Protocol (OCSP)?

It lets a device query whether a single certificate is revoked or not.

It lets a device dynamically renew its certificate before the certificate expires.

It lets a device download all the serial numbers for certificates revoked by a CA at once.

It lets a device determine whether to trust a certificate without needing any root certificates installed.

(Note that the HPE Aruba Networking Central interface shown here might look slightly different from what you see in your HPE Aruba Networking Central interface as versions change; however, similar concepts continue to apply.)An HPE Aruba Networking 9x00 gateway is part of an HPE Aruba Networking Central group that has the settings shown in the exhibit. What would cause the gateway to drop traffic as part of its IDPS settings?

Traffic matching a rule in the active ruleset

Its site-to-site VPN connections failing

Traffic matching a rule in the active ruleset

Traffic showing anomalous behavior

A company has wired VolP phones, which transmit tagged traffic and connect to AOS-CX switches. The company wants to tunnel the phones' traffic to an HPEAruba Networking gateway for applying security policies.What is part of the correct configuration on the AOS-CX switches?

A UBT reserved VLAN set to a VLAN dedicated for that purpose

A VXLAN VNI mapped to the VLAN assigned to the VolP phones

VLANs assigned to the VolP phones configured on the switch uplinks

A UBT reserved VLAN set to a VLAN dedicated for that purpose

You are setting up an HPE Aruba Networking VIA solution for a company. You have already created a VPN pool with IP addresses for the remote clients. During tests, however, the clients do not receive IP addresses from that pool.What is one setting to check?

That the pool is associated with the role to which the VIA clients are being assigned

That the pool uses valid, public IP addresses that are assigned to the company

That the pool is associated with the role to which the VIA clients are being assigned

That the pool uses an IP subnet that is different from any subnet configured on the VPNC

That the pool is referenced in the clients' VIA Connection Profile

What is a typical use case for using HPE Aruba Networking ClearPass Onboard to provision devices?

Enabling unmanaged devices to succeed at certificate-based 802.1X

Enabling managed Windows domain computers to succeed at certificate-based 802.1X

Enhancing security for loT devices that need to authenticate with MAC-Auth

Enforcing posture-based assessment on managed Windows domain computers

A company is using HPE Aruba Networking Central SD-WAN Orchestrator to establish a hub-spoke VPN between branch gateways (BGWs) at 1444 site andVPNCs at multiple data centers.What is part of the configuration that admins need to complete?

In BGWs' groups, select the VPNCs to which to connect in a DC preference list.

At the global level, create default IPsec policies for the SD-WAN Orchestrator to use.

In BGWs' groups, select the VPNCs to which to connect in a DC preference list.

In VPNCs' groups, establish VPN pools to control which branches connect to which VPNCs.

In BGWs' and VPNCs' groups, create default IKE policies for the SD-WAN Orchestrator to use.

A company has HPE Aruba Networking APs (AOS-10), which authenticate clients to HPE Aruba Networking ClearPass Policy Manager (CPPM). CPPM is set up to receive a variety of information about clients' profile and posture. New information can mean that CPPM should change a client's enforcement profile.What should you set up on the APs to help the solution function correctly?

In the RADIUS server settings for CPPM, enable Dynamic Authorization.

In the security settings, configure dynamic denylisting.

In the RADIUS server settings for CPPM, enable Dynamic Authorization.

In the WLAN profiles, enable interim RADIUS accounting.

In the RADIUS server settings for CPPM, enable querying the authentication status.

A company wants HPE Aruba Networking ClearPass Policy Manager (CPPM) to respond to Syslog messages from its Check Point firewall. You have added the firewall as an event source and set up an event service. However, test Syslog messages are not triggering the expected actions.What is one CPPM setting that you should check?

Ingress Event Dictionaries for Check Point messages are enabled.

ClearPass Device Insight integration is disabled.

The Check Point Extension is installed through ClearPass Guest.

The CoA delay value is set to 0 on the server.

Ingress Event Dictionaries for Check Point messages are enabled.

An AOS-CX switch has been configured to implement UBT to a cluster of three HPE Aruba Networking gateways.How does the switch determine to which gateways to tunnel UBT users' traffic?

The switch tunnels each user's traffic to the particular gateway assigned as that user's active user designed gateway.

The switch tunnels all users' traffic to the gateway configured as the primary gateway in the UBT zone, unless that gateway fails.

The switch tunnels each user's traffic to the particular gateway assigned as that user's active user designed gateway.

The switch load balances client traffic across the primary and standby gateway configured in the UBT zone.

The switch tunnels all users' traffic to the gateway assigned as the switch's active device designated gateway.

What correctly describes an HPE Aruba Networking AP's Device (TPM) certificate?

It is signed by an HPE Aruba Networking CA and is trusted by many HPE Aruba Networking solutions.

It works well as a captive portal certificate for guest SSIDs.

It is a self-signed certificate that should not be used in production.

It is installed on APs after they connect to and are provisioned by HPE Aruba Networking Central.

Refer to the Exhibit. You have downloaded a packet capture that you generated on HPE Aruba Networking Central. When you open the capture in Wireshark, you see the output shown in the exhibit.What should you do in Wireshark so that you can better interpret the packets?

Choose to decode UDP port 5555 packets as ARUBA_ERM and set the Aruba ERM Type to 0.

Edit preferences for IEEE 802.11 and chose to ignore the Protection bit with IV.

Apply the following display filter: wlan.fc.type == 1.

Edit the Enabled Protocols and make sure that 802.11, GRE, and Aruba_ERM are enabled.

A company wants to implement Virtual Network based Tunneling (VNBT) on a particular group of users and assign those users to an overlay network with VNI3000.Assume that an AOS-CX switch is already set up to:. Implement 802.1X to HPE Aruba Networking ClearPass Policy Manager (CPPM). Participate in an EVPN VXLAN solution that includes VNI 3000Which setting should you configure in the users' AOS-CX role to apply VNBT to them when they connect?

Access VLAN set to the VLAN mapped to VNI 3000

Gateway zone set to '3000' with no gateway role set

Gateway zone set to 'vni-3000' with no gateway role set

Access VLAN set to the VLAN mapped to VNI 3000

A company uses both HPE Aruba Networking ClearPass Policy Manager (CPPM) and HPE Aruba Networking ClearPass Device Insight (CPDI).What is one way integrating the two solutions can help the company implement Zero Trust Security?

CPDI can use tags to inform CPPM that clients are using prohibited applications; CPPM can then tell the network infrastructure to quarantine those clients.

CPPM can provide CPDI with custom device fingerprint definitions in order to enhance the company's total visibility.

CPDI can provide CPPM with extra information about users' identity; CPPM can then use that information to apply the correct identity-based enforcement.

CPPM can inform CPDI that it has assigned a particular Aruba-User-Role to a client; CPDI can then use that information to reclassify the client.

CPDI can use tags to inform CPPM that clients are using prohibited applications; CPPM can then tell the network infrastructure to quarantine those clients.

What role can Internet Key Exchange (IKE)/IKEv2 play in an HPE Aruba Networking client-to-site VPN?

It helps to negotiate the IPsec SA automatically and securely.

It provides an alternative to IPsec that is suitable for legacy clients.

It provides a more modern and secure alternative to IPsec.

It helps to negotiate the IPsec SA automatically and securely.

It helps remote clients download IPsec profiles for later use.

An AOS-CX switch has this admin user account configured on it:netadmin in the operators group.You have configured these commands on an AOS-CX switch:tacacs-server host cp.example.com key plaintext &12xl,powmay7855aaa authentication login ssh group tacacs localaaa authentication allow-fail-throughA user accesses the switch with SSH and logs in as netadmin with the correct password. When the switch sends a TACACS+ request to the ClearPass server at cp.example.com, the server does not send a response. Authentication times out.What happens?

The user is logged in and granted operator access.

The user is logged in and allowed to enter auditor commands only.

The user is logged in and granted administrators access.

The user is not allowed to log in.

A port-access role for AOS-CX switches has this policy applied to it:plaintextCopy codeport-access policy mypolicy10 class ip zoneC action drop20 class ip zoneA action drop100 class ip zoneBThe classes have this configuration:plaintextCopy codeclass ip zoneC10 match tcp 10.2.0.0/16 eq httpsclass ip zoneA10 match ip any 10.1.0.0/16class ip zoneB10 match ip any 10.0.0.0/8The company wants to permit clients in this role to access 10.2.12.0/24 with HTTPS. What should you do?

Add this rule to zoneC: 5 match any 10.2.12.0/24 eq https

Add this rule to zoneA: 5 ignore tcp any 10.2.12.0/24 eq https

Add this rule to zoneB: 5 match tcp any 10.2.12.0/24 eq https

Add this rule to zoneC: 5 ignore tcp any 10.2.12.0/24 eq https

HP HPE7-A02 Practice Test 2 - Free Online Exam Prep & Questions

A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) as a TACACS+ server to authenticate managers on its AOS-CX switches. You want to assign managers to groups on the AOS-CX switch by name.

How do you configure this setting in a CPPM TACACS+ enforcement profile?

Become a Premium Member for full access

Unlock Premium Member

HP HPE7-A02 Practice Test 2

Question

HP HPE7-A02 Practice Tests

Practice Tests