HPE6-A84 Online Practice Questions and Answers

Questions 4

Refer to the scenario.

A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).

The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).

The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.

Assume that the Azure AD deployment has the proper prerequisites established.

You are planning the CPPM authentication source that you will reference as the authentication source in 802.1X services.

How should you set up this authentication source?

A. As Kerberos type

B. As Active Directory type

C. As HTTP type, referencing the Intune extension

D. AS HTTP type, referencing Azure AD's FODN

Buy Now

Questions 5

A customer's admins have added RF Protect licenses and enabled WIDS for a customer's AOS 8-based solution. The customer wants to use the built-in capabilities of APs without deploying dedicated air monitors (AMs). Admins tested rogue AP detection by connecting an unauthorized wireless AP to a switch. The rogue AP was not detected even after several hours.

What is one point about which you should ask?

A. Whether APs' switch ports support all the VLANs that are accessible at the edge

B. Whether admins enabled wireless containment

C. Whether admins set at least one radio on each AP to air monitor mode

D. Whether the customer is using non-standard Wi-Fi channels in the deployment

Buy Now

Questions 6

Refer to the scenario.

# Introduction to the customer

You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.

# Requirements for issuing certificates to mobile clients

The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be

provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.

The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.

# Requirements for authenticating clients

The customer requires all types of clients to connect and authenticate on the same corporate SSID.

The company wants CPPM to use these authentication methods:

EAP-TLS to authenticate users on mobile clients registered in Intune

TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:

Their certificate is valid and is not revoked, as validated by OCSP

The client's username matches an account in AD

# Requirements for assigning clients to roles

After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:

Clients with certificates issued by Onboard are assigned the "mobile-onboarded" role

Clients that have passed TEAP Method 1 are assigned the "domain-computer" role

Clients in the AD group "Medical" are assigned the "medical-staff" role

Clients in the AD group "Reception" are assigned to the "reception-staff" role

The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:

Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall role

Assign other mobile-onboarded clients to the "mobile-other" firewall role

Assign medical staff on domain computers to the "medical-domain" firewall role

All reception staff on domain computers to the "reception-domain" firewall role

All domain computers with no valid user logged in to the "computer-only" firewall role

Deny other clients access

# Other requirements

Communications between ClearPass servers and on-prem AD domain controllers must be encrypted.

# Network topology

For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.

# ClearPass cluster IP addressing and hostnames

A customer's ClearPass cluster has these IP addresses:

Publisher = 10.47.47.5

Subscriber 1 = 10.47.47.6

Subscriber 2 = 10.47.47.7

Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8

The customer's DNS server has these entries

cp.acnsxtest.com = 10.47.47.5

cps1.acnsxtest.com = 10.47.47.6

cps2.acnsxtest.com = 10.47.47.7

radius.acnsxtest.com = 10.47.47.8

onboard.acnsxtest.com = 10.47.47.8

You have started to create a CA to meet the customer's requirements for issuing certificates to mobile clients, as shown in the exhibit below.

What change will help to meet those requirements and the requirements for authenticating clients?

A. Change the EST authentication method to use an external validator.

B. Change the EST Digest Algorithm to SHA-512.

C. Recreate the CA as a registration authority under Azure AD.

D. Specify an OCSP responder, setting the hostname to localhost.

Buy Now

Questions 7

Refer to the exhibit.

Which IP address should you record as a possibly compromised client?

A. 10.1.26.151

B. 10.1J.100

C. 10.1.26.1

D. 10.254.1.21

Buy Now

Questions 8

Refer to the scenario.

# Introduction to the customer

You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

# Requirements for issuing certificates to mobile clients

provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.

The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.

# Requirements for authenticating clients

The customer requires all types of clients to connect and authenticate on the same corporate SSID.

The company wants CPPM to use these authentication methods:

EAP-TLS to authenticate users on mobile clients registered in Intune

TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:

Their certificate is valid and is not revoked, as validated by OCSP

The client's username matches an account in AD # Requirements for assigning clients to roles After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:

Clients with certificates issued by Onboard are assigned the "mobile-onboarded" role

Clients that have passed TEAP Method 1 are assigned the "domain-computer" role

Clients in the AD group "Medical" are assigned the "medical-staff" role

Clients in the AD group "Reception" are assigned to the "reception-staff" role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:

Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall role

Assign other mobile-onboarded clients to the "mobile-other" firewall role

Assign medical staff on domain computers to the "medical-domain" firewall role

All reception staff on domain computers to the "reception-domain" firewall role

All domain computers with no valid user logged in to the "computer-only" firewall role

Deny other clients access # Other requirements Communications between ClearPass servers and on-prem AD domain controllers must be encrypted. # Network topology For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not

managed by Central at this point.

# ClearPass cluster IP addressing and hostnames A customer's ClearPass cluster has these IP addresses:

Publisher = 10.47.47.5

Subscriber 1 = 10.47.47.6

Subscriber 2 = 10.47.47.7

Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8

The customer's DNS server has these entries

cp.acnsxtest.com = 10.47.47.5

cps1.acnsxtest.com = 10.47.47.6

cps2.acnsxtest.com = 10.47.47.7

radius.acnsxtest.com = 10.47.47.8

onboard.acnsxtest.com = 10.47.47.8

You have imported the root certificate for the Windows CA to the ClearPass CA Trust list.

Which usages should you add to it based on the scenario requirements?

A. EAP and AD/LDAP Server

B. LDAP and Aruba infrastructure

C. Radsec and Aruba infrastructure

D. EAP and Radsec

Buy Now

Questions 9

How does Aruba Central handle security for site-to-site connections between AOS 10 gateways?

A. It uses an Aruba proprietary integrity and encryption technologies to secure site-to-site connections, making them resistant to zero day attacks.

B. It automatically establishes IPsec tunnels for all site-to-site (all HUBs and Branches) connections using keys securely distributed by Central.

C. It automatically steers traffic away from Internet-based connections to more secure MPLS connections to reduce encryption overhead.

D. It automatically establishes simple-to-manage and highly secure TLSv1.3 tunnels between gateways.

Buy Now

Questions 10

A customer has an AOS 10-based solution, including Aruba APs. The customer wants to use Cloud Auth to authenticate non-802.1X capable IoT devices.

What is a prerequisite for setting up the device role mappings?

A. Configuring a NetConductor-based fabric

B. Configuring Device Insight (client profile) tags in Central

C. Integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight

D. Creating global role-to-role firewall policies in Central

Buy Now

Questions 11

Refer to the scenario.

A hospital has an AOS10 architecture that is managed by Aruba Central. The customer has deployed a pair of Aruba 9000 Series gateways with Security licenses at each clinic. The gateways implement IDS/IPS in IDS mode.

The Security Dashboard shows these several recent events with the same signature, as shown below:

Which step could give you valuable context about the incident?

A. View firewall sessions on the APs and record the threat sources' type and OS.

B. View the user-table on APs and record the threat sources' 802.11 settings.

C. View the RAPIDS Security Dashboard and see if the threat sources are listed as rogues.

D. Find the Central client profile for the threat sources and note their category and family.

Buy Now

Questions 12

Refer to the scenario.

A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.

In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as "Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also. You want a fast way to find a list of all the IoT clients that have used SSH.

What step can you take?

A. Create and apply a Central client profile tag that selects the SSH application and the clients' category.

B. Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information.

C. Use Central's Live Events monitoring tool to detect which clients meet the desired criteria.

D. Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources.

Buy Now

Correct Answer: C

This is because the Live Events monitoring tool is a feature that allows you to view and filter real-time events and alerts from your network devices and clients on Aruba Central. You can use the Live Events monitoring tool to detect which IoT clients have used SSH by applying the following filters: Category: IoT Application: SSH The Live Events monitoring tool will then display a list of all the IoT clients that have used SSH, along with other information such as their IP address, MAC address, hostname, SSID, AP name, etc. You can also export the list as a CSV file for further analysis or reporting.

A. Create and apply a Central client profile tag that selects the SSH application and the clients' category. This is not the fastest way to find a list of all the IoT clients that have used SSH because creating and applying a client profile tag is a

process that involves several steps and might take some time to take effect. A client profile tag is a feature that allows you to group and classify clients based on various criteria, such as device type, OS, category, application, etc. To create

and apply a client profile tag that selects the SSH application and the clients' category, you need to do the following:

Navigate to Clients > Client Profile Tags on Aruba Central. Click Add Tag and enter a name and description for the tag. Click Add Rule and select Application as the attribute and SSH as the value. Click Add Rule again and select Category as

the attribute and IoT as the value.

Click Save to create the tag.

Navigate to Clients > Client List on Aruba Central. Select the clients that you want to apply the tag to and click Assign Tag.

Select the tag that you created and click Apply.

After applying the tag, you can then filter the client list by the tag name and see a list of all the IoT clients that have used SSH. However, this method might not be as fast or accurate as using the Live Events monitoring tool, as it depends on

how often the client profile tags are updated and synchronized with Aruba Central.

B. Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information. This is not the fastest way to find a list of all the IoT clients that have used SSH because running a search in CPPM's

accounting information is a process that involves accessing another system and querying a large amount of data. Accounting information is a feature that allows CPPM to collect and store data about network sessions, such as start time, end

time, duration, bytes sent/received, etc. To run a search for SSH traffic and IoT client IDs in CPPM's accounting information, you need to do the following:

Log in to CPPM and navigate to Monitoring > Live Monitoring > Accounting. Click on Advanced Search and enter SSH as the value for Service Name. Click on Add Filter and enter IoT as the value for Endpoint Category.

Click on Search to run the query.

The query will then return a list of all the network sessions that involved SSH traffic and IoT clients. However, this method might not be as fast or convenient as using the Live Events monitoring tool, as it requires logging in to another system

and searching through a large amount of data that might not be relevant or current. D. Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources. This is not a valid way to find a list of all the IoT clients that

have used SSH because the Gateway IDS/IPS Security Dashboard is a feature that only applies to wired network devices connected to Aruba gateways, not wireless devices connected to Aruba APs. The Gateway IDS/IPS Security

Dashboard is a feature that allows you to monitor and manage security events and alerts from your wired network devices on Aruba Central. You can use the Gateway IDS/IPS Security Dashboard to search for security events related to SSH,

such as brute force attacks or unauthorized access attempts, but not for normal SSH traffic from wireless IoT devices. Therefore, this method will not help you find a list of all the IoT clients that have used SSH.

Questions 13

Refer to the scenario.

A customer is using an AOS 10 architecture with Aruba APs and Aruba gateways (two per site). Admins have implemented auto-site clustering for gateways with the default gateway mode disabled. WLANs use tunneled mode to the gateways.

The WLAN security is WPA3-Enterprise with authentication to an Aruba ClearPass Policy Manager (CPPM) cluster VIP. RADIUS communications use RADIUS, not RadSec.

CPPM is using the service shown in the exhibits.

Which step can you take to improve operations during a possible gateway failover event?

A. Chanqe the WLANs to mixed-mode forwardinq so that vou can select multiple qatewav clusters.

B. Set up qatewav clusters manually and set VRRP IP addresses for dynamic authorization.

C. Use auto-group clustering instead of auto-site clustering for the gateways.

D. Enable default gateway mode for the gateway clusters.

Buy Now

Exam Code: HPE6-A84

Exam Name: Aruba Certified Network Security Expert Written

Last Update: Mar 04, 2025

Questions: 60

10%OFF Coupon Code: SAVE10

PDF (Q&A)

$49.99

ADD TO CART

VCE

$55.99

ADD TO CART

PDF + VCE

$65.99

ADD TO CART