Quiz IT certification exam

Question 1

Refer to the exhibit.<img alt="HP HPE6-A84 image Question 41 14737 09162024180727000000"   width="1258" height="665" src="https://examgecko.com/getfile/5129bb22-f893-4f07-a807-cb1f631200b4">Aruba ClearPass Policy Manager (CPPM) is using the settings shown in the exhibit. You reference the tag shown in the exhibit in enforcement policies related to NASes of several types, including Aruba APs, Aruba gateways, and AOS-CX switches.What should you do to ensure that clients are reclassified and receive the correct treatment based on the tag?

Accepted Answer

Enable profiling in each service using one of these enforcement profiles. Set the profiling action to the correct one for the NASes using that service.

Answer

Change the RADIUS action to [Aruba Wireless -Terminate Session] which is supported by all the NASes in question.

Answer

Change the RADIUS action to [Aruba Wireless - Bounce Switch Port] which is supported by all the NASes in question.

Answer

Set the Tags Update Action to No Action. Then instead enable the RADIUS CoAs using enforcement profiles in the rules that match clients with the tag shown in the exhibit.

Question 2

You are setting up Aruba ClearPass Policy Manager (CPPM) to enforce EAP-TLS authentication with Active Directory as the authentication source. The company wants to prevent users with disabled accounts from connecting even if those users still have valid certificates.As the first part of meeting these criteria, what should you do to enable CPPM to determine where accounts are enabled in AD or not?

Accepted Answer

Add a custom attribute for userAccountControl to the filters in the AD authentication source.

Answer

Add an Endpoint Context Server to the domain controller with actions for querying the domain controller for account status.

Answer

Enable OCSP in the EAP-TLS authentication method settings and configure an OCSP override to the domain controller FQDN.

Answer

Install a Microsoft Active Directory extension in Aruba ClearPass Guest and set up an HTTP authentication source that points to that extension.

Question 3

Refer to the scenario.This customer is enforcing 802.1X on AOS-CX switches to Aruba ClearPass Policy Manager (CPPM).The customer wants switches to download role settings from CPPM. The "reception-domain" role must have these settings:— Assigns clients to VLAN 14 on switch 1, VLAN 24 on switch 2, and so on.— Filters client traffic as follows:— Clients are permitted full access to 10.1.5.0/24 and the Internet— Clients are denied access to 10.1.0.0/16The switch topology is shown here:<img alt="HP HPE6-A84 image Question 43 14739 09162024180727000000"   width="812" height="603" src="https://examgecko.com/getfile/4fe90859-21bb-4f78-9f63-1f3964841a96">How should you configure the VLAN setting for the reception role?

Accepted Answer

Assign a consistent name to VLAN 14, 24, or 34 on each access layer switch and reference that name in the enforcement profile VLAN settings.

Answer

Configure the enforcement profile as a downloadable role, but specify only the role name and leave the VLAN undefined. Then define a 'reception' role with the correct VLAN setting on each individual access layer switch.

Answer

Assign a number-based ID to the access layer switches. Then use this variable in the enforcement profile VLAN settings: %(NAS-ID]4.

Answer

Create a separate enforcement profile with a different VLAN ID for each switch. Add all profiles to the profile list in the appropriate enforcement policy rule.

Question 4

Which element helps to lay the foundation for solid network security forensics?

Accepted Answer

Ensuring that all network devices use a correct, consistent clock

Answer

Enable BPDU protection and loop protection on edqe switch ports

Answer

Enabling debug-level information for network infrastructure device logs

Answer

Implementing 802.1X authentication on switch ports that connect to APs

Question 5

Refer to the exhibit. HP HPE6-A84 image Question 45 14741 09162024180727000000

A customer requires protection against ARP poisoning in VLAN 4. Below are listed all settings for VLAN 4 and the VLAN 4 associated physical interfaces on the AOS-CX access layer switch: HP HPE6-A84 image Question 45 14741 09162024180727000000

What is one issue with this configuration?

Accepted Answer

Edge ports are not configured as untrusted for ARP inspection.

Answer

ARP proxy is not enabled on VLAN 4.

Answer

LAG 1 is configured as trusted for ARP inspection but should be untrusted.

Answer

DHCP snooping is not enabled on VLAN 4.

Question 6

Refer to the scenario.A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as "Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.You want a relatively easy way to communicate the information that an IoT client has used SSH to Aruba CPPM.What is one prerequisite?

Accepted Answer

Obtain a data collector token from Central's platform integration settings.

Answer

Enable event processing on subscribers in the ClearPass cluster.

Answer

In CPPM's CA trust list, add the Aruba Infrastructure usage to the DigiCert certificate.

Answer

Create an API application and token within the REST API settings.

Question 7

Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows C

Accepted Answer

The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on themTo succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client's username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the "mobile-onboarded" roleClients that have passed TEAP Method 1 are assigned the "domain-computer" roleClients in the AD group "Medical" are assigned the "medical-staff" roleClients in the AD group "Reception" are assigned to the "reception-staff" roleThe customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall roleAssign other mobile-onboarded clients to the "mobile-other" firewall roleAssign medical staff on domain computers to the "medical-domain" firewall roleAll reception staff on domain computers to the "reception-domain" firewall roleAll domain computers with no valid user logged in to the "computer-only" firewall roleDeny other clients' access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8You have created a role mapping policy as shown in the exhibits below.What is one change that you need to make to this policy?

Answer

In rule 1 change Subject-CN to Issuer-CN.

Answer

Move rules 2 and 3 to the top of the list.

Answer

Change the rules evaluation mechanism to first applicable.

Answer

Change the default role to 'mobile-onboarded*

Question 8

Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here. HP HPE6-A84 image Question 48 14744 09162024180727000000

HP HPE6-A84 image Question 48 14744 09162024180727000000

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on themTo succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client's username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the "mobile-onboarded" roleClients that have passed TEAP Method 1 are assigned the "domain-computer" roleClients in the AD group "Medical" are assigned the "medical-staff" roleClients in the AD group "Reception" are assigned to the "reception-staff" roleThe customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall roleAssign other mobile-onboarded clients to the "mobile-other" firewall roleAssign medical staff on domain computers to the "medical-domain" firewall roleAll reception staff on domain computers to the "reception-domain" firewall roleAll domain computers with no valid user logged in to the "computer-only" firewall roleDeny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point. HP HPE6-A84 image Question 48 14744 09162024180727000000

# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8The customer needs a secure way for users to enroll their new wireless clients in Intune. You are recommending a new WLAN that will provide the users with limited access for the enrollment.You have set up captive portal for clients on this WLAN to a web page with instructions for enrolling devices. You will need to add several hostnames to the captive portal allowlist manually.What is one of those hostnames?

Accepted Answer

The ClearPass Onboard hostname referenced in an Onboard provisioninG profile

Answer

The hostname used by ClearPass Policy ManaGer's RADIUS services

Answer

The ClearPass Onboard hostname referenced in Intune SCEP profiles

Answer

The hostname used by the on-prem domain controllers

Question 9

The customer needs a way for users to enroll new wired clients in Intune. The clients should have limited access that only lets them enroll and receive certificates. You plan to set up these rights in an AOS-CX role named "provision."The customer's security team dictates that you must limit these clients' Internet access to only the necessary sites. Your switch software supports IPv4 and IPv6 addresses for the rules applied in the "provision" role.What should you recommend?

Accepted Answer

Configuring the "provision" role as a downloadable user role (DUR) in CPPM

Answer

Configuring the rules for the "provision" role with IPv6 addresses, which tend to be more stable

Answer

Enabling tunneling to the MCs on the "provision" role and then setting up the privileges on the MCs

Answer

Assigning the "provision" role to a VLAN and then setting up the rules within a Layer 2 access control list (ACL)

Question 10

Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here. HP HPE6-A84 image Question 50 14746 09162024180727000000

HP HPE6-A84 image Question 50 14746 09162024180727000000

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on themTo succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client's username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the "mobile-onboarded" roleClients that have passed TEAP Method 1 are assigned the "domain-computer" roleClients in the AD group "Medical" are assigned the "medical-staff" roleClients in the AD group "Reception" are assigned to the "reception-staff" roleThe customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall roleAssign other mobile-onboarded clients to the "mobile-other" firewall roleAssign medical staff on domain computers to the "medical-domain" firewall roleAll reception staff on domain computers to the "reception-domain" firewall roleAll domain computers with no valid user logged in to the "computer-only" firewall roleDeny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point. HP HPE6-A84 image Question 50 14746 09162024180727000000

# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8You have started to create a CA to meet the customer's requirements for issuing certificates to mobile clients, as shown in the exhibit below. HP HPE6-A84 image Question 50 14746 09162024180727000000

What change will help to meet those requirements and the requirements for authenticating clients?

Accepted Answer

Change the EST authentication method to use an external validator.

Answer

Change the EST Digest Algorithm to SHA-512.

Answer

Recreate the CA as a registration authority under Azure AD.

Answer

Specify an OCSP responder, setting the hostname to localhost.

Question 11

Refer to the scenario.A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as "Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.You want an easy way to communicate the information that an IoT client has used SSH to Aruba ClearPass Policy Manager (CPPM).What step should you take?

Accepted Answer

On CPPM create an Endpoint Context Server that points to the Central API.

Answer

On CPPM enable Device Insight integration.

Answer

On Central configure APs and gateways to use CPPM as the RADIUS accounting server.

Answer

On Central set up CPPM as a Webhook application.

Question 12

Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here. HP HPE6-A84 image Question 52 14748 09162024180727000000

HP HPE6-A84 image Question 52 14748 09162024180727000000

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on themTo succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client's username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the "mobile-onboarded" roleClients that have passed TEAP Method 1 are assigned the "domain-computer" roleClients in the AD group "Medical" are assigned the "medical-staff" roleClients in the AD group "Reception" are assigned to the "reception-staff" roleThe customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall roleAssign other mobile-onboarded clients to the "mobile-other" firewall roleAssign medical staff on domain computers to the "medical-domain" firewall roleAll reception staff on domain computers to the "reception-domain" firewall roleAll domain computers with no valid user logged in to the "computer-only" firewall roleDeny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point. HP HPE6-A84 image Question 52 14748 09162024180727000000

# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8On CPPM, you are creating the authentication method shown in the exhibit below: HP HPE6-A84 image Question 52 14748 09162024180727000000

You will use the method for standalone EAP-TLS and for inner methods in TEAP.What should you do?

Accepted Answer

Configure OCSP override and set the OCSP URL to localhost/onboard/mdps ocspphp/2

Answer

Enable certificate comparison.

Answer

Enable authorization.

Answer

Configure OCSP override and leave the OCSP URL blank.

Question 13

Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here. HP HPE6-A84 image Question 53 14749 09162024180727000000

HP HPE6-A84 image Question 53 14749 09162024180727000000

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on themTo succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client's username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the "mobile-onboarded" roleClients that have passed TEAP Method 1 are assigned the "domain-computer" roleClients in the AD group "Medical" are assigned the "medical-staff" roleClients in the AD group "Reception" are assigned to the "reception-staff" roleThe customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall roleAssign other mobile-onboarded clients to the "mobile-other" firewall roleAssign medical staff on domain computers to the "medical-domain" firewall roleAll reception staff on domain computers to the "reception-domain" firewall roleAll domain computers with no valid user logged in to the "computer-only" firewall roleDeny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point. HP HPE6-A84 image Question 53 14749 09162024180727000000

# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8The customer has now decided that it needs CPPM to assign certain mobile-onboarded devices to a"nurse-call" AOS user role. These are mobile-onboarded devices that are communicating with IP address 10.1.18.12 using port 4343.What are the prerequisites for fulfilling this requirement?

Accepted Answer

Creating server-based role assignment rules on gateways that apply roles to clients based on traffic destinations

Answer

Setting up traffic classes and role mapping rules within Central's global settings

Answer

Creating server-based role assignment rules on APs that apply roles to clients based on traffic destinations

Answer

Creating a tag on Central to select the proper destination connection and integrating CPPM with Device Insight

Question 14

Several AOS-CX switches are responding to SNMPv2 GET requests for the public community. The customer only permits SNMPv3. You have asked a network admin to fix this problem. The admin says, "I tried to remove the community, but the CLI output an error." What should you recommend to remediate the vulnerability and meet the customer's requirements?

Accepted Answer

Setting the snmp-server settings to "snmpv3-only"

Answer

Enabling control plane policing to automatically drop SNMP GET requests

Answer

Adding an SNMP community with a long random name

Answer

Enabling SNMPv3, which implicitly disables SNMPv1/v2

Question 15

Refer to the scenario.An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.You are helping the developer understand how to develop an NAE script for this use case.You are helping the developer find the right URI for the monitor.Refer to the exhibit.<img alt="HP HPE6-A84 image Question 55 14751 09162024180727000000"   width="710" height="847" src="https://examgecko.com/getfile/1b97d828-d675-452e-90e7-0731c7dbe854">You have used the REST API reference interface to submit a test call. The results are shown in the exhibit.Which URI should you give to the developer?

Accepted Answer

/rest/v1/system/vrfs/mgmt/radius/servers/cp.acnsxtest.local/2083/tcp?attributes=authstatistics.acc ess_rejects

Answer

/rest/v1/system/vrfs/mgmt/radius/servers/cp.acnsxtest.local/2083/tcp?attributes=authstatistics

Answer

/rest/v1/system/vrfs/mgmt/radius/servers/cp.acnsxtest.local/2083/tcp?attributes=authstatistics?att ributes=access_rejects

Answer

/rest/v1/system/vrfs/mgmt/radius/_servers/cp.acnsxtest.local/2083/tcp

Question 16

Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here. HP HPE6-A84 image Question 56 14752 09162024180727000000

HP HPE6-A84 image Question 56 14752 09162024180727000000

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on themTo succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client's username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the "mobile-onboarded" roleClients that have passed TEAP Method 1 are assigned the "domain-computer" roleClients in the AD group "Medical" are assigned the "medical-staff" roleClients in the AD group "Reception" are assigned to the "reception-staff" roleThe customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall roleAssign other mobile-onboarded clients to the "mobile-other" firewall roleAssign medical staff on domain computers to the "medical-domain" firewall roleAll reception staff on domain computers to the "reception-domain" firewall roleAll domain computers with no valid user logged in to the "computer-only" firewall roleDeny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point. HP HPE6-A84 image Question 56 14752 09162024180727000000

# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8You cannot see flow attributes for wireless clients.What should you check?

Accepted Answer

Deep packet inspection is enabled on the role to which the Aruba APs assign the wireless clients.

Answer

Firewall application visibility is enabled on the Aruba gateways, and the gateways have been rebooted.

Answer

Gateway IDS/IPS is enabled on the Aruba gateways, and the gateways have been rebooted.

Answer

Deep packet inspection is enabled on the Aruba Aps, and the APs have been rebooted.

Question 17

Refer to the scenario.An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.You are helping the developer understand how to develop an NAE script for this use case.The developer explains that they plan to define the rule with logic like this:monitor > valueHowever, the developer asks you what value to include.What should you recommend?

Accepted Answer

Defining a parameter and referring to it (self ^ramsfname]) for the value

Answer

Checking one of the access switches' RADIUS statistics and adding 10 to the number listed for rejects

Answer

Defining a baseline and referring to it for the value

Answer

Using 10 (per hour) as a good starting point for the value

Question 18

Refer to the scenario.A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as "Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.You want a fast way to find a list of all the IoT clients that have used SSH.What step can you take?

Accepted Answer

Use Central's Live Events monitoring tool to detect which clients meet the desired criteria.

Answer

Create and apply a Central client profile tag that selects the SSH application and the clients' category.

Answer

Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information.

Answer

Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources.

Question 19

Refer to the scenario.An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.You are helping the developer understand how to develop an NAE script for this use case.You are helping a customer define an NAE script for AOS-CX switches. The script will monitor statistics from a RADIUS server defined on the switch. You want to future proof the script by enabling admins to select a different hostname or IP address for the monitored RADIUS server when they create an agent from the script.What should you recommend?

Accepted Answer

Define a parameter for the RADIUS server; reference that parameter instead of the server name/ip when defining the monitor URI.

Answer

Use this variable, %{radius-ipV when defining the monitor URI in the NAE agent script.

Answer

Use a callback action to collect the name of any RADIUS servers defined on the switch at the time the agent is created.

Answer

Make the script editable so that admins can edit it on demand when they are creating scripts.

Question 20

Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here. HP HPE6-A84 image Question 60 14756 09162024180727000000

HP HPE6-A84 image Question 60 14756 09162024180727000000

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clients The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on themTo succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client's username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the "mobile-onboarded" roleClients that have passed TEAP Method 1 are assigned the "domain-computer" roleClients in the AD group "Medical" are assigned the "medical-staff" roleClients in the AD group "Reception" are assigned to the "reception-staff" roleThe customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall roleAssign other mobile-onboarded clients to the "mobile-other" firewall roleAssign medical staff on domain computers to the "medical-domain" firewall roleAll reception staff on domain computers to the "reception-domain" firewall roleAll domain computers with no valid user logged in to the "computer-only" firewall roleDeny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point. HP HPE6-A84 image Question 60 14756 09162024180727000000

# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8You have imported the root certificate for the Windows CA to the ClearPass CA Trust list.Which usages should you add to it based on the scenario requirements?

Accepted Answer

EAP and AD/LDAP Server

Answer

LDAP and Aruba infrastructure

Answer

Radsec and Aruba infrastructure

Answer

EAP and Radsec

HP HPE6-A84 Practice Test 2

HP HPE6-A84 Practice Tests