Aruba Certified Mobility Expert 8 Written Exam v1.0

Refer to the exhibits.

Exhibit 1 -

Exhibit 2 -

A network administrator deploys role-based tunneled node in a corporate network to unify the security policies enforcement. When users authenticate with 802.1X,
ClearPass shows Accept results, and sends the HPE-User-Role attribute as expected. However, the switch always applies the denyall role.
Why does the switch fail to allocate the tunnel-employee role?

A company currently offers guest access with an open SSID and no authentication. A network administrator needs to integrate a web login page for visitors.
To accomplish this integration, the network administrator fully deploys a guest solution with self-registration in ClearPass, and defines the Mobility Controller (MC) as a RADIUS client. Then, the network administrator defines ClearPass as a RADIUS server and adds it into a server group in the MC.
Which two actions must the network administrator do next on the MC side to complete the deployment? (Select two.)

Refer to the exhibit.

A network administrator receives a call from a contractor that was recently given wireless access to the network. The user reports that the response time is slow and suggests there might be a problem with the WLAN. The network administrator checks RF performance in AirWave to find the user and sees the output shown in the exhibit.
What can the network administrator conclude after analyzing the data?

Refer to exhibit.

A company has a multiple Arua implementation with three different locations named Headquarter, Branch, and Telecommuters.
The network design includes the following:
-> Headquarter APs terminate at the Mobility Controller (MC) cluster and propagate Corporate, Guest, and Voice SSIDs
-> Branch APs terminate at the Branch Office Controller (BOC) and propagate Corporate and Voice SSIDs
-> BOC reaches the Mobility Master (MM) through a VPNC.
-> Telecommuter RAPs terminate at VPNC and propagate Corporate and Voice SSIDs.
-> The Corporate SSID on the RAPs is split-tunnel, all other SSIDs are tunnel.
The network design requires minimal AP group and VAP configuration effor, while preventing unnecessary VAP propagation to lower hierarchy levels.
Following Aruba node hierarchy desing recommendations, which group hierarchy design helps meet these requirements?

Refer to the exhibit.

Based on the output shown in the exhibitm with which Aruba devices has Access-1 established tunnels?

A foreign exchange broker in a shared office space uses an Aruba Mobility Master (MM)-Mobility Controller (MC) architecture along with ClearPass and AirWave.
The corporate network is FXBroker121, but users report that they cannot access the FXBroker111 SSID. The team suspects that a rogue AP is in place and a malicious user tried to disguise the WLAN name.
How can the organization"™s network administrator identify and locate the potential rogue AP?

Refer to the exhibit.

A network administrator is validating client connectivity and executes the show command shown in the exhibit. Which authentication method was used by the wireless station?

A network administrator deplos a guest solution over WiFi and creates a corp_guest role for this purpose. The network administrator must configure the solution with a custom policy that permits visitors to get an IP address, perform DNS resolutions, and get internet access while blocking any attempt to reach internal resources at the 10.0.0.0/8 network. The solution should prevent visitors from acting as rogue DHCP servers, then blacklist and log the attempt if this ever happens.
Which setup meets these requirements?

Refer to the exhibits.

Exhibit 1 -

Exhibit 2 -

A network administrator deploys a test environment with two Mobility Masters (MMs), two two-member Mobility Controller (MC) clusters, and two CAPs, with the intention of testing several ArubaOS features, Cluster members run VRRP for AP boot redundancy. Based on the information shown in the exhibits, what is the current status of the APs?

Refer to the exhibit.

A network administrator wants to configure an 802.1x supplicamt for a wireless network that includes the following:
-> AES encryption
-> EAP-MSCHAP v2-based user and machine authentication
-> Validation of server certificate in Microsoft Windows 10
The network administrator creates a WLAN profile and selects the change connection settings option. Then the network administrator changes the security type to
Microsoft: Protected EAP (PEAP), and enables user and machine authentication under Additonal Settings.
What must the network administrator do next to accomplish the task?

A network administrator wants to receive a major alarm every time a controller or an Aruba switch goes down for either a local or an upstream device failure.
Which alarm definition must the network administrator create to accomplish this?
A.

B.

C.

Refer to the exhibit.

An organization provides WiFi access through a corporate SSID with an Aruba Mobility Master (MM)-Mobility Controller (MC) network that includes PEF functions.
The organization wants to have a single firewall policy configured and applied to the employee role.
This policy must allow users to reach Web, FTP, and DNS services, as shown in the exhibit. Other services should be exclusive to other roles. The client NICs should receive IP settings dynamically.
Which policy design meets the organization"™s requirements while minimizing the number of policy rules?

Refer to the exhibits.

Exhibit 1 -

Exhibit 2 -


Exhibit 3 -

A network administrator must ensure that a ClearPass server can receive the RADIUS authentication request from a single Mobility Controller (MC) managed by a
Mobility Master (MM). Based on the exhibits, what is the value of NAS-IP contained in the RADIUS access requests?

Refer to the exhibit.

A network administrator completes the task to cretae a WLAN, as shown in the exhibit. The network administrator selects the options to use guest as primary usage and Internal captive portal with authentication in the security step. Next, the network administrator creates a policy that denies access to the internal network.
Which additional step must the network administrator complete in order to prevent authenticated users from reaching internal corporate resources while allowing
Internet access?