Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).Switches are using local port-access policies.The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.The plan for the enforcement policy and profiles is shown below: The gateway cluster has two gateways with these IP addresses:• Gateway 1o VLAN 4085 (system IP) = 10.20.4.21o VLAN 20 (users) = 10.20.20.1o VLAN 4094 (WAN) = 198.51.100.14• Gateway 2o VLAN 4085 (system IP) = 10.20.4.22o VLAN 20 (users) = 10.20.20.2o VLAN 4094 (WAN) = 198.51.100.12• VRRP on VLAN 20 = 10.20.20.254The customer requires high availability for the tunnels between the switches and the gateway cluster.If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.You are setting up the UBT zone on an AOS-CX switch.Which IP addresses should you define in the zone?

Primary controller = 10.20.4.21; backup controller = 10.20.4.22

[Primary controller = 198.51.100.14; backup controller = 10.20.4.21

Primary controller = 10 20 4 21: backup controller not defined

Primary controller = 10.20.20.254; backup controller, not defined

Refer to the scenario.A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22Denied access to other 10.0.0.0/8 subnetsPermitted access to the InternetDenied access to the WLAN for a period of time if they send any SSH trafficDenied access to the WLAN for a period of time if they send any Telnet trafficDenied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.The exhibits below show the configuration for the role. There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, "medical-mobile" rule 1 is "ipv4 any any svc-dhcp permit," and rule 8 is "ipv4 any any any permit".)

In the "medical-mobile" policy, change the subnet mask in rule 3 to 255.255.248.0.

In the "medical-mobile" policy, move rules 2 and 3 between rules 7 and 8.

In the "medical-mobile" policy, change the subnet mask in rule 3 to 255.255.248.0.

Move the rule in the "apprf-medical-mobile-sacl" policy between rules 7 and 8 in the "medicalmobile" policy.

In the "medical-mobile" policy, change the source in rule 8 to "user."

A company has an Aruba ClearPass server at 10.47.47.8, FQDN radius.acnsxtest.local. This exhibit shows ClearPass Policy Manager's (CPPM's) settings for an Aruba Mobility Controller (MC). The MC is already configured with RADIUS authentication settings for CPPM, and RADIUS requests between the MC and CPPM are working. A network admin enters and commits this command to enable dynamic authorization on the MC:aaa rfc-3576-server 10.47.47.8But when CPPM sends CoA requests to the MC, they are not working. This exhibit shows the RFC 3576 server statistics on the MC: How could you fix this issue?

Change the UDP port in the MCs' RFC 3576 server config to 3799.

Enable RadSec on the MCs' RFC 3676 server config.

Configure the MC to obtain the time from a valid NTP server.

Make sure that CPPM is using an ArubaOS Wireless RADIUS CoA enforcement profile.

Refer to the scenario.A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22Denied access to other 10.0.0.0/8 subnetsPermitted access to the InternetDenied access to the WLAN for a period of time if they send any SSH trafficDenied access to the WLAN for a period of time if they send any Telnet trafficDenied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.The exhibits below show the configuration for the role. What setting not shown in the exhibit must you check to ensure that the requirements of the scenario are met?

That AppRF and WebCC are enabled globally and on the medical-mobile role

That denylisting is enabled globally on the MCs' firewalls

That stateful handling of traffic is enabled globally on the MCs' firewalls and on the medicalmobile role.

That AppRF and WebCC are enabled globally and on the medical-mobile role

That the MCs are assigned RF Protect licenses

Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).Switches are using local port-access policies.The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.The plan for the enforcement policy and profiles is shown below: The gateway cluster has two gateways with these IP addresses:• Gateway 1o VLAN 4085 (system IP) = 10.20.4.21o VLAN 20 (users) = 10.20.20.1o VLAN 4094 (WAN) = 198.51.100.14• Gateway 2o VLAN 4085 (system IP) = 10.20.4.22o VLAN 20 (users) = 10.20.20.2o VLAN 4094 (WAN) = 198.51.100.12• VRRP on VLAN 20 = 10.20.20.254The customer requires high availability for the tunnels between the switches and the gateway cluster.If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.Assume that you have configured the correct UBT zone and port-access role settings. However, the solution is not working.What else should you make sure to do?

Create a new VLAN on the AOS-CX switch and configure that VLAN as the UBT client VLAN.

Assign VLAN 20 as the access VLAN on any edge ports to which tunneled clients might connect.

Create a new VLAN on the AOS-CX switch and configure that VLAN as the UBT client VLAN.

Assign sufficient VIA licenses to the gateways based on the number of wired clients that will connect.

Change the port-access auth-mode mode to client-mode on any edge ports to which tunneled clients might connect.

A company has Aruba gateways and wants to start implementing gateway IDS/IPS. The customer has selected Block for the Fail Strategy.What might you recommend to help minimize unexpected outages caused by using this particular fall strategy?

Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors

Configuring a relatively high threshold for the gateway threat count alerts

Making sure that the gateways have formed a cluster and operate in default gateway mode

Setting the IDS or IPS policy to the least restrictive option, Lenient

Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors

A company has Aruba gateways that are Implementing gateway IDS/IPS in IDS mode. The customer complains that admins are receiving too frequent of repeat email notifications for the same threat.The threat itself might be one that the admins should investigate, but the customer does not want the email notification to repeat as often.Which setting should you adjust in Aruba Central?

Alert duration and threshold settings

The IDS policy setting (strict, medium, or lenient)

The allowlist settings in the IDS policy

Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.Assume that the Azure AD deployment has the proper prerequisites established.You are planning the CPPM authentication source that you will reference as the authentication source in 802.1X services.How should you set up this authentication source?

AS HTTP type, referencing Azure AD's FODN

As HTTP type, referencing the Intune extension

AS HTTP type, referencing Azure AD's FODN

Refer to the scenario.A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22Denied access to other 10.0.0.0/8 subnetsPermitted access to the InternetDenied access to the WLAN for a period of time if they send any SSH trafficDenied access to the WLAN for a period of time if they send any Telnet trafficDenied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.The exhibits below show the configuration for the role. There are multiple issues with the configuration.What is one of the changes that you must make to the policies to meet the scenario requirements?(In the options, rules in a policy are referenced from top to bottom. For example, "medical-mobile" rule 1 is "ipv4 any any svc-dhcp permit," and rule 8 is "ipv4 any any any permit'.)

In the "medical-mobile" policy, move rules 6 and 7 to the top of the list.

In the "medical-mobile" policy, change the source in rule 1 to "user."

In the "medical-mobile" policy, change the subnet mask in rule 3 to 255.255.248.0.

In the "medical-mobile" policy, move rules 6 and 7 to the top of the list.

Move the rule in the "apprf-medical-mobile-sacl" policy between rules 7 and 8 in the "medicalmobile" policy.

What is a common characteristic of a beacon between a compromised device and a command and control server?

Periodic transmission of small, identically sized packets

Use of IPv6 addressing instead of IPv4 addressing

Use of less common protocols such as SNAP

Periodic transmission of small, identically sized packets

Refer to the scenario.A hospital has an AOS10 architecture that is managed by Aruba Central. The customer has deployed a pair of Aruba 9000 Series gateways with Security licenses at each clinic. The gateways implement IDS/IPS in IDS mode.The Security Dashboard shows these several recent events with the same signature, as shown below: Which step could give you valuable context about the incident?

View the RAPIDS Security Dashboard and see if the threat sources are listed as rogues.

View firewall sessions on the APs and record the threat sources' type and OS.

View the user-table on APs and record the threat sources' 802.11 settings.

View the RAPIDS Security Dashboard and see if the threat sources are listed as rogues.

Find the Central client profile for the threat sources and note their category and family.

Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).Switches are using local port-access policies.The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.The plan for the enforcement policy and profiles is shown below: The gateway cluster has two gateways with these IP addresses:• Gateway 1o VLAN 4085 (system IP) = 10.20.4.21o VLAN 20 (users) = 10.20.20.1o VLAN 4094 (WAN) = 198.51.100.14• Gateway 2o VLAN 4085 (system IP) = 10.20.4.22o VLAN 20 (users) = 10.20.20.2o VLAN 4094 (WAN) = 198.51.100.12• VRRP on VLAN 20 = 10.20.20.254The customer requires high availability for the tunnels between the switches and the gateway cluster.If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.What is one change that you should make to the solution?

Remove VLAN assignments from role configurations on the gateways.

Change the ubt-client-vlan to VLAN 13.

Configure edge ports in VLAN trunk mode.

Remove VLAN assignments from role configurations on the gateways.

Configure the UBT solution to use VLAN extend mode.

Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).Switches are using local port-access policies.The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.The plan for the enforcement policy and profiles is shown below: The gateway cluster has two gateways with these IP addresses:• Gateway 1o VLAN 4085 (system IP) = 10.20.4.21o VLAN 20 (users) = 10.20.20.1o VLAN 4094 (WAN) = 198.51.100.14• Gateway 2o VLAN 4085 (system IP) = 10.20.4.22o VLAN 20 (users) = 10.20.20.2o VLAN 4094 (WAN) = 198.51.100.12• VRRP on VLAN 20 = 10.20.20.254The customer requires high availability for the tunnels between the switches and the gateway cluster.If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.Assume that you are using the "myzone" name for the UBT zone.Which is a valid minimal configuration for the AOS-CX port-access roles?

port-access role internet-only gateway-zone zone myzone gateway-role eth-internet

port-access role eth-internet gateway-zone zone myzone gateway-role eth-user

port-access role internet-only gateway-zone zone myzone gateway-role eth-internet

port-access role eth-internet gateway-zone zone myzone gateway-role eth-internet vlan access 20

port-access role internet-only gateway-zone zone myzone gateway-role eth-internet vlan access 20

Refer to the scenario.A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22Denied access to other 10.0.0.0/8 subnetsPermitted access to the InternetDenied access to the WLAN for a period of time if they send any SSH trafficDenied access to the WLAN for a period of time if they send any Telnet trafficDenied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.The line below shows the effective configuration for the role. There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, "medical-mobile" rule 1 is "ipv4 any any svc-dhcp permit," and rule 6 is "ipv4 any any any permit'.)

In the "medical-mobile* policy, change the subnet mask in rule 5 to 255.255.252.0.

Apply the "apprf-medical-mobile-sjcT policy explicitly to the 'medical-mobile' user-role under the 'medical-mobile" policy.

In the "medical-mobile" policy, change the action for rules 2 and 3 to reject.

In the "medical-mobile" policy, move rule 5 under rule 6.

In the "medical-mobile* policy, change the subnet mask in rule 5 to 255.255.252.0.

A customer requires a secure solution for connecting remote users to the corporate main site. You are designing a client-to-site virtual private network (VPN) based on Aruba VIA and Aruba Mobility Controllers acting as VPN Concentrators (VPNCs). Remote users will first use the VIA client to contact the VPNCs and obtain connection settings.The users should only be allowed to receive the settings if they are the customer's "RemoteEmployees" AD group. After receiving the settings, the VIA clients will automatically establish VPN connections, authenticating to CPPM with certificates.What should you do to help ensure that only authorized users obtain VIA connection settings?

Set up the VPNCs' VIA web authentication profile to use CPPM as the authentication server; set up a service on CPPM that uses AD as the authentication source.

Set up the VPNCs' VIA web authentication profile to use an AD domain controller as the LDAP server.

Set up the VPNCs' VIA connection profile to use two authentication profiles, one RADIUS profile to CPPM and one LDAP profile to AD.

Set up the VPNCs' VIA connection profile to use one authentication profile, which is set to the AD domain controller's hostname.

Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.The customer wants you to configure CPPM to collect information from Intune on demand during the authentication process.What should you tell the Intune admins about the certificates issued to clients?

They must include the Intune ID in the subject name.

They must be issued by a well-known, trusted CA.

They must include the Intune ID in the subject name.

They must include the client MAC address in the subject name.

They must be issued by a ClearPass Onboard CA.

Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.You are planning to use Azure AD as the authentication source in 802.1X services.What should you make sure that the customer understands is required?

An app registration on Azure AD that references the CPPM's FQDN

CPPM's RADIUS certificate was imported as trusted in the Azure AD directory

You are configuring gateway IDS/IPS settings in Aruba Central.For which reason would you set the Fail Strategy to Bypass?

To permit traffic if the IPS engine falls to inspect It

To enable the gateway to honor the allowlist settings configured in IDS/IPS policies

To tell gateways to stop enforcing IDS/IPS policies if they lose connectivity to the Internet

To avoid wasting IPS engine resources on filtering traffic for unauthenticated clients

How does Aruba Central handle security for site-to-site connections between AOS 10 gateways?

It automatically establishes IPsec tunnels for all site-to-site (all HUBs and Branches) connections using keys securely distributed by Central.

It uses an Aruba proprietary integrity and encryption technologies to secure site-to-site connections, making them resistant to zero day attacks.

It automatically establishes IPsec tunnels for all site-to-site (all HUBs and Branches) connections using keys securely distributed by Central.

It automatically steers traffic away from Internet-based connections to more secure MPLS connections to reduce encryption overhead.

It automatically establishes simple-to-manage and highly secure TLSv1.3 tunnels between gateways.

Refer to the exhibit. Which security issue is possibly indicated by this traffic capture?

A command and control channel established with DNS tunneling

An attempt at a DoS attack by a device acting as an unauthorized DNS server

A port scan being run on the 10.1.7.0/24 subnet

A command and control channel established with DNS tunneling

An ARP poisoning or man-in-the-middle attempt by the device at 94:60:d5:bf:36:40

You are working with a developer to design a custom NAE script for a customer. You are helping the developer find the correct REST API resource to monitor.Refer to the exhibit below. What should you do before proceeding?

Use your Aruba passport account and collect a token to use when trying out API calls.

Go to the v1 API documentation interface instead of the v10.10 interface.

Use your Aruba passport account and collect a token to use when trying out API calls.

Enable the switch to listen to REST API calls on the default VRF.

Make sure that your browser is set up to store authentication tokens and cookies.

A customer has an AOS 10 architecture, consisting of Aruba AP and AOS-CX switches, managed by Aruba Central. The customer wants to obtain information about the clients, such as their general category and OS.What should you explain?

Aruba Central will automatically derive this information using telemetry from the Aruba devices.

The customer must deploy Aruba gateways in order to receive any client profiling information.

You will need to set up Aruba Central as a secondary IP helper for client VLANs, but this will not interfere with existing operations.

Aruba Central will automatically derive this information using telemetry from the Aruba devices.

The customer should set up a dedicated switch VSX group to sniff packets and direct them to Aruba Central.

You are reviewing an endpoint entry in ClearPass Policy Manager (CPPM) Endpoints Repository.What is a good sign that someone has been trying to gain unauthorized access to the network?

The entry shows a profile conflict of having a new profile of Computer for a profiled Printer.

The entry shows multiple DHCP options under the fingerprints.

The entry shows an Unknown status.

The entry shows a profile conflict of having a new profile of Computer for a profiled Printer.

The entry lacks a hostname or includes a hostname with long seemingly random characters.

Refer to the scenario.A customer is using an AOS 10 architecture with Aruba APs and Aruba gateways (two per site).Admins have implemented auto-site clustering for gateways with the default gateway mode disabled. WLANs use tunneled mode to the gateways.The WLAN security is WPA3-Enterprise with authentication to an Aruba ClearPass Policy Manager (CPPM) cluster VIP. RADIUS communications use RADIUS, not RadSec.CPPM is using the service shown in the exhibits. Which step can you take to improve operations during a possible gateway failover event?

Set up qatewav clusters manually and set VRRP IP addresses for dynamic authorization.

Chanqe the WLANs to mixed-mode forwardinq so that vou can select multiple qatewav clusters.

Set up qatewav clusters manually and set VRRP IP addresses for dynamic authorization.

Use auto-group clustering instead of auto-site clustering for the gateways.

Enable default gateway mode for the gateway clusters.

Refer to the scenario.A customer is using an AOS 10 architecture with Aruba APs and Aruba gateways (two per site).Admins have implemented auto-site clustering for gateways with the default gateway mode disabled. WLANs use tunneled mode to the gateways.The WLAN security is WPA3-Enterprise with authentication to an Aruba ClearPass Policy Manager (CPPM) cluster VIP. RADIUS communications use RADIUS, not RadSec.For which devices does CPPM require network device entries?

Forgateways' actual IP addresses and dynamic authorization VRRP addresses

For gateways' actual IP addresses and AP clusters' virtual IP addresses for dynamic authorization

ForAP clusters'virtual IP addresses

A customer wants CPPM to authenticate non-802.1X-capable devices. An admin has created the service shown in the exhibits below: What is one recommendation to improve security?

Creating and using a custom MAC-Auth authentication method

Adding an enforcement policy rule that denies access to endpoints with the Conflict flaq

Using Active Directory as the authentication source

Creating and using a custom MAC-Auth authentication method

Enabling caching of posture and roles

You are working with a developer to design a custom NAE script for a customer. The NAE agent should trigger an alert when ARP inspection drops packets on a VLAN. The customer wants the admins to be able to select the correct VLAN ID for the agent to monitor when they create the agent.What should you tell the developer to do?

Define a VLAN ID parameter; reference that parameter when defining the monitor URI.

Use this variable, %{vlan-id} when defining the monitor URI in the NAE agent script.

Define a VLAN ID parameter; reference that parameter when defining the monitor URI.

Create multiple monitors within the script from which admins can select when they create the agent.

Use a callback action to collect the ID of the VLAN on which admins have enabled NAE monitoring.

You need to install a certificate on a standalone Aruba Mobility Controller (MC). The MC will need to use the certificate for the Web UI and for implementing RadSec with Aruba ClearPass Policy Manager. You have been given a certificate with these settings:Subject: CN=mc41.site94.example.comNo SANsIssuer: CN=ca41.example.comEKUs: Server Authentication, Client AuthenticationWhat issue does this certificate have for the purposes for which the certificate is intended?

It specifies domain info in the CN field instead of the DC field.

A customer has an AOS 10-based mobility solution, which authenticates clients to Aruba ClearPass Policy Manager (CPPM). The customer has some wireless devices that support WPA2 in personal mode only.How can you meet these devices' needs but improve security?

Use MPSK on the WLAN to which the devices connect.

Configure WIDS policies that apply extra monitoring to these particular devices.

Connect these devices to the same WLAN to which 802.1X-capable clients connect, using MACAuth fallback.

Enable dynamic authorization (RFC 3576) in the AAA profile for the devices.

When would you implement BPDU protection on an AOS-CX switch port versus BPDU filtering?

Use BPDU protection on edge ports to prevent rogue devices from connecting; use BPDU filtering on inter-switch ports for specialized use cases.

Use BPDU protection on edge ports to protect against rogue devices when the switch implements MSTP; use BPDU filtering to protect against rogue devices when the switch implements PVSTP+.

Use BPDU protection on edge ports to prevent rogue devices from connecting; use BPDU filtering on inter-switch ports for specialized use cases.

Use BPDU protection on inter-switch ports to ensure that they are selected as root; use BPDU filtering on edge ports to prevent rogue devices from connecting.

Use BPDU protection on edge ports to permanently lock out rogue devices; use BPDU filtering on edge ports to temporarily lock out rogue devices.

Refer to the exhibit. You have been given this certificate to install on a ClearPass server for the RADIUS/EAP and RadSec usages.What is one issue?

The certificate uses a fully qualified the '.local" domain name.

The certificate has a wildcard in the subject common name.

The certificate uses a fully qualified the '.local" domain name.

The certificate does not have a URI subject alternative name

The certificate does not have an IP subject alternative name

A customer's admins have added RF Protect licenses and enabled WIDS for a customer's AOS 8-based solution. The customer wants to use the built-in capabilities of APs without deploying dedicated air monitors (AMs). Admins tested rogue AP detection by connecting an unauthorized wireless AP to a switch. The rogue AP was not detected even after several hours.What is one point about which you should ask?

Whether admins set at least one radio on each AP to air monitor mode

Whether APs' switch ports support all the VLANs that are accessible at the edge

Whether admins enabled wireless containment

Whether admins set at least one radio on each AP to air monitor mode

Whether the customer is using non-standard Wi-Fi channels in the deployment

A customer has an AOS 10-based solution, including Aruba APs. The customer wants to use Cloud Auth to authenticate non-802.1X capable IoT devices.What is a prerequisite for setting up the device role mappings?

Configuring Device Insight (client profile) tags in Central

Configuring a NetConductor-based fabric

Configuring Device Insight (client profile) tags in Central

Integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight

Creating global role-to-role firewall policies in Central

You want to use Device Insight tags as conditions within CPPM role mapping or enforcement policy rules.What guidelines should you follow?

Use the Endpoint type for the rule conditions; no extra authorization source is required for services that use policies with these rules.

Create an HTTP authentication source to the Central API that queries for the tags. To use that source as the type for rule conditions, add it an authorization source for the service in question.

Use the Application type for the rule conditions; no extra authorization source is required for services that use policies with these rules.

Use the Endpoints Repository type for the rule conditions; Add Endpoints Repository as a secondary authentication source for services that use policies with these rules.

Use the Endpoint type for the rule conditions; no extra authorization source is required for services that use policies with these rules.

A customer has an AOS 10 architecture, which includes Aruba APs. Admins have recently enabled WIDS at the high level. They also enabled alerts and email notifications for several events, as shown in the exhibit. Admins are complaining that they are getting so many emails that they have to ignore them, so they are going to turn off all notifications.What is one step you could recommend trying first?

Change the WIDS level to custom, and enable only the checks most likely to indicate real threats.

Send the email notifications directly to a specific folder, and only check the folder once a week.

Disable email notifications for Roque AP, but leave the Infrastructure Attack Detected and Client Attack Detected notifications on.

Change the WIDS level to custom, and enable only the checks most likely to indicate real threats.

Disable just the Rogue AP and Client Attack Detected alerts, as they overlap with the Infrastructure Attack Detected alert.

Refer to the scenario.A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below: What is one recommendation to make?

Create a control plane ACL to limit the sources that can access the switch with SSH.

Let the RADIUS server confiqure VLANs on LAG 1 dynamically.

Use MDS instead of SHA1 for the NTP authentication key.

Encrypt the certificate in the TA-profile.

Create a control plane ACL to limit the sources that can access the switch with SSH.

Refer to the scenario.A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below: What is one immediate remediation that you should recommend?

Changing the switch's DNS server to the mgmt VRF

Setting the clock manually instead of using NTP

Either disabling DHCPv4-snoopinq or leaving it enabled, but also enabling ARP inspection

HP HPE6-A84 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

You are designing an Aruba ClearPass Policy Manager (CPPM) solution for a customer. You learn that the customer has a Palo Alto firewall that filters traffic between clients in the campus and the data center.

Which integration can you suggest?

Sending Syslogs from the firewall to CPPM to signal CPPM to change the authentication status for misbehaving clients

Importing clients' MAC addresses to configure known clients for MAC authentication more quickly

Establishing a double layer of authentication at both the campus edge and the data center DMZ

Importing the firewall's rules to program downloadable user roles for AOS-CX switches more quickly

Comment (0)

HP HPE6-A84 Practice Test 1

Question

HP HPE6-A84 Practice Tests

Practice Tests