HPE Network Security Expert v1.0
Question 1
A customer has an AOS-10 architecture that is managed by HPE Aruba Networking Central. HPE Aruba Networking infrastructure devices authenticate clients to an HPE Aruba Networking ClearPass cluster.
In HPE Aruba Networking Central, you are examining network traffic flows on a wireless IoT device that is categorized as "Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.
Refer to the scenario.
You want a relatively easy way to communicate the information that an IoT client has used SSH to HPE Aruba Networking CPPM.
What is one prerequisite?
- A. Obtain a data collector token from HPE Aruba Networking Central's platform integration settings.
- B. Create an API application and token within the REST API settings.
- C. In CPPM’s CA trust list, add the HPE Aruba Networking Infrastructure usage to the DigiCert certificate.
- D. Enable event processing on subscribers in the ClearPass cluster.
Answer : B
Question 2
A customer has an AOS-10 architecture that is managed by HPE Aruba Networking Central. HPE Aruba Networking infrastructure devices authenticate clients to an HPE Aruba Networking ClearPass cluster.
In HPE Aruba Networking Central, you are examining network traffic flows on a wireless IoT device that is categorized as "Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.
Refer to the scenario.
You are helping the customer assess ways to mitigate the potential threat you have detected. The customer would like to temporarily block misbehaving clients for a penalty period. If the client reconnects and no longer sends SSH traffic, it should be allowed to remain connected.
What approach should you take?
- A. Create a tag on HPE Aruba Networking Central to select IoT clients using SSH. Add a rule to the relevant CPPM enforcement policy that selects this tag and applies a quarantine profile.
- B. Configure global firewall settings on HPE Aruba Networking Central-managed APs and gateways to denylist clients that violate control plane (CP) policies.
- C. Create a post-authentication profile on CPPM that updates endpoints attributes based on information from Central. Then, add a rule to the relevant CPPM enforcement policy that selects those attributes and applies a quarantine profile.
- D. Create a rule in the clients’ AOS user role that matches all SSH traffic from the client and applies denylisting.
Answer : D
Question 3
Refer to the exhibit.
Which device should you record as possibly malicious and needing more investigation?
- A. 10.1.26.1
- B. 50:81:40:9f:2b:25
- C. 10.1.26.152
- D. fe80:9927:5869:add
Answer : B
Question 4
Refer to the exhibit.
You have been given this certificate to install on an HPE Aruba Networking ClearPass server for the RADIUS/EAP and RadSec usages.
What is one issue?
- A. The certificate does not have a URI subject alternative name (SAN).
- B. The certificate has a wildcard in the subject common name.
- C. The certificate uses a fully qualified the ".local" domain name.
- D. The certificate does not have an IP subject alternative name (SAN).
Answer : B
Question 5
Your company has HPE Aruba Networking AOS-10 APs and gateways, as well as AOS-CX switches, all managed by HPE Aruba Networking Central. Within HPE Aruba Networking Central, you need to collect a packet capture on a client connected to an AP.
What is a prerequisite?
- A. The AP tunnels the client's SSID to a gateway with application visibility enabled.
- B. The AP tunnels the client's SSID to a gateway with DPI enabled.
- C. The AP has one radio configured in monitor mode.
- D. The AP is assigned to an HPE Aruba Networking Central site.
Answer : D
Question 6
You need to install a certificate on a standalone HPE Aruba Networking Mobility Controller (MC). The MC will need to use the certificate for the Web Ul and for implementing RadSec with HPE Aruba Networking ClearPass Policy Manager. You have been given a certificate with these settings: o Subject: CN=mc49.site30.example.com o No SANs o Issuer: CN=ca89.example.com o EKUs: Server Authentication, Client Authentication
What issue does this certificate have for the purposes for which the certificate is intended?
- A. It specifies domain info in the CN field instead of the DC field.
- B. It lacks a DNS SAN.
- C. It has conflicting EKUs.
- D. It is issued by a private CA.
Answer : B
Question 7
Your company has an HPE Aruba Networking AOS-10 architecture managed by HPE Aruba Networking Central. A ClearPass Policy Manager (CPPM) cluster provides authentication. The company also has a Palo Alto firewall. You want to set up the HPE Aruba Networking infrastructure to quarantine clients about which the firewall sends Syslog Threat messages to CPPM.
Network infrastructure devices already have a “quarantine” role configured on them.
You have checked the CPPM’s event dictionary and found an entry for Palo Alto Syslog Threats that includes:
• Prefix: PANW-Threat
• Attributes such as syslogtimestamp and logtype
What is a correct part of the configuration on ClearPass server settings?
- A. Insight server enabled
- B. CA that signed the firewall's certificate installed as trusted
- C. Syslog scanning configured
- D. CoA delay of 5 seconds or greater
Answer : C
Question 8
A customer has an HPE Aruba Networking ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM).
Switches are using local port-access policies.
The customer wants to start tunneling wired clients that pass user authentication only to an HPE Aruba Networking gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.
The plan for the enforcement policy and profiles is shown below:
The gateway cluster has two gateways with these IP addresses:
• Gateway 1
o VLAN 4085 (system IP) = 10.20.4.21
o VLAN 20 (users) = 10.20.20.1
o VLAN 4094 (WAN) = 198.51.100.14
• Gateway 2
o VLAN 4085 (system IP) = 10.20.4.22
o VLAN 20 (users) = 10.20.20.2
o VLAN 4094 (WAN) = 198.51.100.12
• VRRP on VLAN 20 = 10.20.20.254
The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway fails, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.
Refer to the scenario.
Assume that you have configured the correct UBT zone and port-access role settings. However, the solution is not working.
What else should you make sure to do?
- A. Assign VLAN 20 as the access VLAN on any edge ports to which tunneled clients might connect.
- B. Assign sufficient VIA licenses to the gateways based on the number of wired clients that will connect.
- C. Create a new VLAN on the AOS-CX switch and configure that VLAN as the UBT client VLAN.
- D. Change the port-access auth-mode mode to client-mode on any edge ports to which tunneled clients might connect.
Answer : D
Question 9
A customer has an HPE Aruba Networking ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM).
Switches are using local port-access policies.
The customer wants to start tunneling wired clients that pass user authentication only to an HPE Aruba Networking gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.
The plan for the enforcement policy and profiles is shown below:
The gateway cluster has two gateways with these IP addresses:
• Gateway 1
o VLAN 4085 (system IP) = 10.20.4.21
o VLAN 20 (users) = 10.20.20.1
o VLAN 4094 (WAN) = 198.51.100.14
• Gateway 2
o VLAN 4085 (system IP) = 10.20.4.22
o VLAN 20 (users) = 10.20.20.2
o VLAN 4094 (WAN) = 198.51.100.12
• VRRP on VLAN 20 = 10.20.20.254
The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway fails, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.
Refer to the scenario.
Assume that you are using the "myzone" name for the UBT zone.
Which is a valid minimal configuration for the AOS-CX port-access roles?
- A. port-access role internet-only gateway-zone zone myzone gateway-role eth-internet vlan access 20
- B. port-access role internet-only gateway-zone zone myzone gateway-role eth-internet
- C. port-access role eth-internet gateway-zone zone myzone gateway-role eth-internet vlan access 20
- D. port-access role eth-internet gateway-zone zone myzone gateway-role eth-user
Answer : B
Question 10
A customer has an HPE Aruba Networking ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM).
Switches are using local port-access policies.
The customer wants to start tunneling wired clients that pass user authentication only to an HPE Aruba Networking gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.
The plan for the enforcement policy and profiles is shown below:
The gateway cluster has two gateways with these IP addresses:
• Gateway 1
o VLAN 4085 (system IP) = 10.20.4.21
o VLAN 20 (users) = 10.20.20.1
o VLAN 4094 (WAN) = 198.51.100.14
• Gateway 2
o VLAN 4085 (system IP) = 10.20.4.22
o VLAN 20 (users) = 10.20.20.2
o VLAN 4094 (WAN) = 198.51.100.12
• VRRP on VLAN 20 = 10.20.20.254
The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway fails, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.
Refer to the scenario.
You are setting up the UBT zone on an AOS-CX switch.
Which IP addresses should you define in the zone?
- A. Primary controller = 10.20.4.21; backup controller, not defined
- B. Primary controller = 10.20.4.21; backup controller = 10.20.4.22
- C. Primary controller = 10.20.20.254; backup controller, not defined
- D. Primary controller = 198.51.100.14; backup controller = 10.20.4.21
Answer : B
Question 11
A customer has an HPE Aruba Networking ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM).
Switches are using local port-access policies.
The customer wants to start tunneling wired clients that pass user authentication only to an HPE Aruba Networking gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.
The plan for the enforcement policy and profiles is shown below:
The gateway cluster has two gateways with these IP addresses:
• Gateway 1
o VLAN 4085 (system IP) = 10.20.4.21
o VLAN 20 (users) = 10.20.20.1
o VLAN 4094 (WAN) = 198.51.100.14
• Gateway 2
o VLAN 4085 (system IP) = 10.20.4.22
o VLAN 20 (users) = 10.20.20.2
o VLAN 4094 (WAN) = 198.51.100.12
• VRRP on VLAN 20 = 10.20.20.254
The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway fails, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.
Refer to the scenario.
What is one change that you should make to the solution?
- A. Remove VLAN assignments from role configurations on the gateways.
- B. Configure edge ports in VLAN trunk mode.
- C. Configure the UBT solution to use VLAN extend mode.
- D. Change the ubt-client-vlan to VLAN 13.
Answer : C
Question 12
A company has an HPE Aruba Networking AOS-10 mobility infrastructure. Network admins recently turned on the APs’ wireless detection, enabling checks for all infrastructure and client threats. But the admins quickly became overwhelmed. Now they want to disable most of the checks.
Admins want you to recommend the checks most likely to indicate true threats.
What is one to mention?
- A. detect overflow ie
- B. detect AP spoofing
- C. detect AP flood
- D. detect rate anomalies
Answer : B
Question 13
You configure an HPE Aruba Networking Mobility Controller with these commands: aaa rfc-3576-server 10.1.2.3 key mysecretkey&^%!7531 replay-protection window-duration 300
Later you see this output:
(host)#show aaa rfc-3576-server statistics
RADIUS RFC 3576 Statistics -
______________
Statistics 10.1.2.3 -
______________
Disconnect Requests 2534 -
Disconnect Accepts 2534 -
Disconnect Rejects 0 -
No Secret 0 -
No Session ID 0 -
Bad Authenticator 0 -
Invalid Request 0 -
Packets Dropped 1431 -
Unknown service 0 -
CoA Requests 2453 -
CoA Accepts 1022 -
CoA Rejects 0 -
No permission 0 -
Packets received from unknown clients: 0
Packets received with unknown request: 0
What should you investigate?
- A. Why so many packets are being dropped, which could be a sign that hackers are capturing and resending CoAs for their own purposes
- B. Whether an unstable network is disrupting communications between the MC and 10.1.2.3
- C. Whether the server sending the CoAs has been configured with the wrong RADIUS secret or whether this is a sign that someone is spoofing messages
- D. Why the 10.1.2.3 server is sending legacy packets that are no longer supported
Answer : A
Question 14
A customer has two AOS-10 HPE Aruba Networking gateways at a site. The gateways are part of an SD-Branch solution, managed by HPE Aruba Networking Central, and they use WLAN mode (NON-default gateway mode) for their cluster setting. You are setting up a manual HPE Aruba Networking gateway cluster for dynamic authorization. The gateways have these IP addresses on a subnet accessible by CPPM:
• Gateway 1 = 10.56.20.2
• Gateway 2 = 10.56.20.3
Which are valid choices for the VRRP IP addresses on the gateways. (Assume that all these options for IP addresses are available.)
- A. Gateway 1 = 10.56.20.4 and Gateway 2 = 10.56.20.4
- B. Gateway 1 = 10.56.20.4 and Gateway 2 = 10.56.20.5
- C. Gateway 1 = 10.56.20.3 and Gateway 2 = 10.56.20.3
- D. Gateway 1 = 10.56.20.2 and Gateway 2 = 10.56.20.2
Answer : A
Question 15
A company has HPE Aruba Networking gateways and wants to start implementing gateway IDS/IPS. The customer has selected Block for the Fail Strategy.
What might you recommend to help minimize unexpected outages caused by using this particular fail strategy?
- A. Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors
- B. Setting the IDS or IPS policy to the least restrictive option, Lenient
- C. Making sure that the gateways have formed a cluster and operate in default gateway mode
- D. Configuring a relatively high threshold for the gateway threat count alerts
Answer : A