HP HP Certifications HPE6-A84 Questions & Answers

• Question 51:

  You need to install a certificate on a standalone Aruba Mobility Controller (MC). The MC will need to use the certificate for the Web UI and for implementing RadSec with Aruba ClearPass Policy Manager. You have been given a certificate with these settings:

  1.

  Subject: CN=mc41.site94.example.com

  2.

  No SANs

  3.

  Issuer: CN=ca41.example.com

  4.

  EKUs: Server Authentication, Client Authentication

  What issue does this certificate have for the purposes for which the certificate is intended?

  A. It has conflicting EKUs.

  B. It is issued by a private CA.

  C. It specifies domain info in the CN field instead of the DC field.

  D. It lacks a DNS SAN.

  Correct Answer: D

  A DNS SAN (Subject Alternative Name) is an extension of the X.509 certificate standard that allows specifying additional hostnames or IP addresses that the certificate can be used for. A DNS SAN is useful for validating the identity of the server or client that presents the certificate, especially when the common name (CN) field does not match the hostname or IP address of the server or client. In this case, the certificate has a CN of mc41.site94.example.com, which is the fully qualified domain name (FQDN) of the standalone Aruba Mobility Controller (MC). However, this CN may not match the hostname or IP address that the MC uses for the Web UI or for implementing RadSec with Aruba ClearPass Policy Manager. For example, if the MC uses a different FQDN, such as mc41.example.com, or an IP address, such as 192.168.1.41, for these purposes, then the certificate would not be valid for them. Therefore, the certificate should have a DNS SAN that includes all the possible hostnames or IP addresses that the MC may use for the Web UI and RadSec.

• Question 52:

  Which element helps to lay the foundation for solid network security forensics?

  A. Enable BPDU protection and loop protection on edqe switch ports

  B. Enabling debug-level information for network infrastructure device logs

  C. Implementing 802.1X authentication on switch ports that connect to APs

  D. Ensuring that all network devices use a correct, consistent clock

  Correct Answer: D

  This is because network forensics relies on the analysis of network traffic data, which is often time-stamped by the devices that generate or transmit it. Having a synchronized and accurate clock across all network devices helps to establish a reliable timeline of events and correlate different sources of evidence12 A. Enable BPDU protection and loop protection on edge switch ports is not related to network security forensics, but rather to preventing network loops and topology changes caused by rogue switches or bridges3

  B. Enabling debug-level information for network infrastructure device logs might provide more details about the network activity, but it also consumes more resources and storage, and might not be relevant or useful for forensic analysis. Moreover, debug-level information might not be available for long-term retention or legal purposes4 C. Implementing 802.1X authentication on switch ports that connect to APs is a good security practice to prevent unauthorized access to the network, but it does not directly help with network security forensics. 802.1X authentication does not capture or record network traffic data, which is the main source of evidence for network forensics

• Question 53:

  Refer to the scenario.

  This customer is enforcing 802.1X on AOS-CX switches to Aruba ClearPass Policy Manager (CPPM). The customer wants switches to download role settings from CPPM. The "reception-domain" role must have these settings:

  -- Assigns clients to VLAN 14 on switch 1, VLAN 24 on switch 2, and so on.

  -- Filters client traffic as follows:

  -- Clients are permitted full access to 10.1.5.0/24 and the Internet

  -- Clients are denied access to 10.1.0.0/16 The switch topology is shown here:

  

  How should you configure the VLAN setting for the reception role?

  A. Assign a consistent name to VLAN 14, 24, or 34 on each access layer switch and reference that name in the enforcement profile VLAN settings.

  B. Configure the enforcement profile as a downloadable role, but specify only the role name and leave the VLAN undefined. Then define a 'reception' role with the correct VLAN setting on each individual access layer switch.

  C. Assign a number-based ID to the access layer switches. Then use this variable in the enforcement profile VLAN settings: %(NAS-ID]4.

  D. Create a separate enforcement profile with a different VLAN ID for each switch. Add all profiles to the profile list in the appropriate enforcement policy rule.

  Correct Answer: A

  According to the AOS-CX User Guide, one way to configure the VLAN setting for the reception role is to assign a consistent name to VLAN 14, 24, or 34 on each access layer switch and reference that name in the enforcement profile VLAN settings. This way, the switches can download the role settings from CPPM and apply the correct VLAN based on the name, rather than the ID. For example, the enforcement profile VLAN settings could be:

  

  And the VLAN configuration on each switch could be:

  

• Question 54:

  Refer to the scenario.

  A hospital has an AOS10 architecture that is managed by Aruba Central. The customer has deployed a pair of Aruba 9000 Series gateways with Security licenses at each clinic. The gateways implement IDS/IPS in IDS mode.

  The Security Dashboard shows these several recent events with the same signature, as shown below:

  

  Which step could give you valuable context about the incident?

  A. View firewall sessions on the APs and record the threat sources' type and OS.

  B. View the user-table on APs and record the threat sources' 802.11 settings.

  C. View the RAPIDS Security Dashboard and see if the threat sources are listed as rogues.

  D. Find the Central client profile for the threat sources and note their category and family.

  Correct Answer: C

  The RAPIDS Security Dashboard is a feature of Aruba Central that provides a comprehensive view of the network security status, including IDS/IPS events, rogue APs, and wireless intrusion detection. By viewing the RAPIDS Security Dashboard, you can see if the threat sources are rogue APs that are spoofing legitimate DNS servers or clients. This can give you valuable context about the incident and help you identify the root cause of the attack1 Reference: Aruba Central User Guide

• Question 55:

  Refer to the scenario.

  # Introduction to the customer

  You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

  The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is

  shown here.

  

  

  The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.

  # Requirements for issuing certificates to mobile clients

  The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be

  provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.

  The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.

  # Requirements for authenticating clients

  The customer requires all types of clients to connect and authenticate on the same corporate SSID.

  The company wants CPPM to use these authentication methods:

  1.

  EAP-TLS to authenticate users on mobile clients registered in Intune

  2.

  TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:

  1.

  Their certificate is valid and is not revoked, as validated by OCSP

  2.

  The client's username matches an account in AD # Requirements for assigning clients to roles After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:

  1.

  Clients with certificates issued by Onboard are assigned the "mobile-onboarded" role

  2.

  Clients that have passed TEAP Method 1 are assigned the "domain-computer" role

  3.

  Clients in the AD group "Medical" are assigned the "medical-staff" role

  4.

  Clients in the AD group "Reception" are assigned to the "reception-staff" role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:

  1.

  Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall role

  2.

  Assign other mobile-onboarded clients to the "mobile-other" firewall role

  3.

  Assign medical staff on domain computers to the "medical-domain" firewall role

  4.

  All reception staff on domain computers to the "reception-domain" firewall role

  5.

  All domain computers with no valid user logged in to the "computer-only" firewall role

  6.

  Deny other clients access # Other requirements Communications between ClearPass servers and on-prem AD domain controllers must be encrypted. # Network topology For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not

  managed by Central at this point.

  

  # ClearPass cluster IP addressing and hostnames A customer's ClearPass cluster has these IP addresses:

  1.

  Publisher = 10.47.47.5

  2.

  Subscriber 1 = 10.47.47.6

  3.

  Subscriber 2 = 10.47.47.7

  4.

  Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8

  The customer's DNS server has these entries

  1.

  cp.acnsxtest.com = 10.47.47.5

  2.

  cps1.acnsxtest.com = 10.47.47.6

  3.

  cps2.acnsxtest.com = 10.47.47.7

  4.

  radius.acnsxtest.com = 10.47.47.8

  5.

  onboard.acnsxtest.com = 10.47.47.8

  The customer has now decided that it needs CPPM to assign certain mobile-onboarded devices to a "nurse-call" AOS user role. These are mobile-onboarded devices that are communicating with IP address 10.1.18.12 using port 4343.

  What are the prerequisites for fulfilling this requirement?

  A. Setting up traffic classes and role mapping rules within Central's global settings

  B. Creating server-based role assignment rules on APs that apply roles to clients based on traffic destinations

  C. Creating server-based role assignment rules on gateways that apply roles to clients based on traffic destinations

  D. Creating a tag on Central to select the proper destination connection and integrating CPPM with Device Insight

  Correct Answer: C

• Question 56:

  Refer to the scenario.

  A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.

  In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as "Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also. You want a fast way to find a list of all the IoT clients that have used SSH.

  What step can you take?

  A. Create and apply a Central client profile tag that selects the SSH application and the clients' category.

  B. Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information.

  C. Use Central's Live Events monitoring tool to detect which clients meet the desired criteria.

  D. Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources.

  Correct Answer: C

  This is because the Live Events monitoring tool is a feature that allows you to view and filter real-time events and alerts from your network devices and clients on Aruba Central. You can use the Live Events monitoring tool to detect which IoT clients have used SSH by applying the following filters: Category: IoT Application: SSH The Live Events monitoring tool will then display a list of all the IoT clients that have used SSH, along with other information such as their IP address, MAC address, hostname, SSID, AP name, etc. You can also export the list as a CSV file for further analysis or reporting.

  A. Create and apply a Central client profile tag that selects the SSH application and the clients' category. This is not the fastest way to find a list of all the IoT clients that have used SSH because creating and applying a client profile tag is a

  process that involves several steps and might take some time to take effect. A client profile tag is a feature that allows you to group and classify clients based on various criteria, such as device type, OS, category, application, etc. To create

  and apply a client profile tag that selects the SSH application and the clients' category, you need to do the following:

  Navigate to Clients > Client Profile Tags on Aruba Central. Click Add Tag and enter a name and description for the tag. Click Add Rule and select Application as the attribute and SSH as the value. Click Add Rule again and select Category as

  the attribute and IoT as the value.

  Click Save to create the tag.

  Navigate to Clients > Client List on Aruba Central. Select the clients that you want to apply the tag to and click Assign Tag.

  Select the tag that you created and click Apply.

  After applying the tag, you can then filter the client list by the tag name and see a list of all the IoT clients that have used SSH. However, this method might not be as fast or accurate as using the Live Events monitoring tool, as it depends on

  how often the client profile tags are updated and synchronized with Aruba Central.

  B. Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information. This is not the fastest way to find a list of all the IoT clients that have used SSH because running a search in CPPM's

  accounting information is a process that involves accessing another system and querying a large amount of data. Accounting information is a feature that allows CPPM to collect and store data about network sessions, such as start time, end

  time, duration, bytes sent/received, etc. To run a search for SSH traffic and IoT client IDs in CPPM's accounting information, you need to do the following:

  Log in to CPPM and navigate to Monitoring > Live Monitoring > Accounting. Click on Advanced Search and enter SSH as the value for Service Name. Click on Add Filter and enter IoT as the value for Endpoint Category.

  Click on Search to run the query.

  The query will then return a list of all the network sessions that involved SSH traffic and IoT clients. However, this method might not be as fast or convenient as using the Live Events monitoring tool, as it requires logging in to another system

  and searching through a large amount of data that might not be relevant or current. D. Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources. This is not a valid way to find a list of all the IoT clients that

  have used SSH because the Gateway IDS/IPS Security Dashboard is a feature that only applies to wired network devices connected to Aruba gateways, not wireless devices connected to Aruba APs. The Gateway IDS/IPS Security

  Dashboard is a feature that allows you to monitor and manage security events and alerts from your wired network devices on Aruba Central. You can use the Gateway IDS/IPS Security Dashboard to search for security events related to SSH,

  such as brute force attacks or unauthorized access attempts, but not for normal SSH traffic from wireless IoT devices. Therefore, this method will not help you find a list of all the IoT clients that have used SSH.

• Question 57:

  Refer to the scenario.

  A customer is using an AOS 10 architecture with Aruba APs and Aruba gateways (two per site). Admins have implemented auto-site clustering for gateways with the default gateway mode disabled. WLANs use tunneled mode to the gateways.

  The WLAN security is WPA3-Enterprise with authentication to an Aruba ClearPass Policy Manager (CPPM) cluster VIP. RADIUS communications use RADIUS, not RadSec.

  CPPM is using the service shown in the exhibits.

  

  Which step can you take to improve operations during a possible gateway failover event?

  A. Chanqe the WLANs to mixed-mode forwardinq so that vou can select multiple qatewav clusters.

  B. Set up qatewav clusters manually and set VRRP IP addresses for dynamic authorization.

  C. Use auto-group clustering instead of auto-site clustering for the gateways.

  D. Enable default gateway mode for the gateway clusters.

  Correct Answer: B

  Auto-site clustering is a feature that allows gateways in the same site and group to form a cluster automatically. However, this mode does not support VRRP IP addresses, which are required for dynamic authorization (CoA) from ClearPass Policy Manager (CPPM) to the gateways. Dynamic authorization is a mechanism that allows CPPM to change the attributes or status of a client session on the gateways without requiring re-authentication. This is useful for applying policies, roles, or bandwidth limits based on various conditions. Without VRRP IP addresses, CPPM would not be able to send CoA messages to the correct gateway in case of a failover event, resulting in inconsistent or incorrect client behavior.

  To enable VRRP IP addresses for dynamic authorization, you need to set up gateway clusters manually and assign a VRRP VLAN and a VRRP IP address to each cluster. This way, CPPM can use the VRRP IP address as the NAS IP address for RADIUS communications and CoA messages. The VRRP IP address will remain the same even if the active gateway in the cluster changes due to a failover event, ensuring seamless operations. You can find more information about how to set up gateway clusters manually and configure VRRP IP addresses in the Gateway Cluster Deployment - Aruba page and the ClearPass Policy Manager User Guide1.

• Question 58:

  A customer needs you to configure Aruba ClearPass Policy Manager (CPPM) to authenticate domain users on domain computers. Domain users, domain computers, and domain controllers receive certificates from a Windows CA. CPPM should validate these certificates and verify that the users and computers have accounts in Windows AD. The customer requires encryption for all communications between CPPM and the domain controllers.

  You have imported the root certificate for the Windows CA to the ClearPass CA Trust list.

  Which usages should you add to it based on these requirements?

  A. Radec and Aruba infrastructure

  B. EAP and AD/LDAP Server

  C. EAP and Radsec

  D. LDAP and Aruba infrastructure

  Correct Answer: C

  EAP (Extensible Authentication Protocol) is a framework that allows different authentication methods to be used for network access. EAP is used for RADIUS/EAP authentication, which is a common method for authenticating domain users on domain computers using certificates. EAP requires that the RADIUS server, such as ClearPass Policy Manager (CPPM), validates the certificates presented by the clients and verifies their identity against an identity source, such as Windows AD. Therefore, the root certificate for the Windows CA that issues the certificates to the clients should have the EAP usage in the ClearPass CA Trust list. Radsec (RADIUS over TLS) is a protocol that allows secure and encrypted communication between RADIUS servers and clients using TLS. Radsec is used for encrypting all communications between CPPM and the domain controllers, which act as RADIUS clients. Radsec requires that both the RADIUS server and the RADIUS client validate each other's certificates and establish a TLS session. Therefore, the root certificate for the Windows CA that issues the certificates to the domain controllers should have the Radsec usage in the ClearPass CA Trust list.

• Question 59:

  Refer to the exhibit.

  

  A customer requires protection against ARP poisoning in VLAN 4. Below are listed all settings for VLAN 4 and the VLAN 4 associated physical interfaces on the AOS-CX access layer switch:

  

  What is one issue with this configuration?

  A. ARP proxy is not enabled on VLAN 4.

  B. LAG 1 is configured as trusted for ARP inspection but should be untrusted.

  C. DHCP snooping is not enabled on VLAN 4.

  D. Edge ports are not configured as untrusted for ARP inspection.

  Correct Answer: D

  This is because ARP inspection is a security feature that validates ARP packets in a network and prevents ARP poisoning attacks12 ARP inspection works by intercepting, logging, and discarding ARP packets with invalid IP-to-MAC address bindings1 To enable ARP inspection, the switch needs to know which ports are trusted and which are untrusted. Trusted ports are those that connect to authorized DHCP servers or other network devices that are not vulnerable to ARP spoofing. Untrusted ports are those that connect to end hosts or devices that might send forged ARP packets13 In the exhibit, LAG 1 is configured as a trusted port for ARP inspection, which is correct because it connects to the core switch. However, the edge ports (1/1/1-1/1/24) are not configured as untrusted ports for ARP inspection, which is incorrect because they connect to end hosts that might be compromised by an attacker. By default, all ports are untrusted for ARP inspection, but this can be changed by using the command ip arp inspection trust on the interface configuration mode3 Therefore, to protect VLAN 4 against ARP poisoning, the edge ports should be configured as untrusted for ARP inspection by using the command no ip arp inspection trust on the interface configuration mode. This way, the switch will validate the ARP packets received on these ports against the DHCP snooping database or an ARP access-list and drop any invalid packets34 A. ARP proxy is not enabled on VLAN 4. This is not an issue because ARP proxy is an optional feature that allows the switch to respond to ARP requests on behalf of hosts in different subnets5 It is not related to ARP poisoning or ARP inspection. B. LAG 1 is configured as trusted for ARP inspection but should be untrusted. This is not an issue because LAG 1 connects to the core switch, which is a trusted device that does not send forged ARP packets.

  C. DHCP snooping is not enabled on VLAN 4. This is not an issue because DHCP snooping is a separate feature that prevents rogue DHCP servers from offering IP addresses to clients6 It is not directly related to ARP poisoning or ARP inspection, although it can provide information for ARP inspection validation if enabled

• Question 60:

  Refer to the scenario.

  A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).

  Switches are using local port-access policies.

  The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth- internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.

  The plan for the enforcement policy and profiles is shown below: The gateway cluster has two gateways with these IP addresses:

  

  Gateway 1

  1.

  VLAN 4085 (system IP) = 10.20.4.21

  2.

  VLAN 20 (users) = 10.20.20.1

  3.

  VLAN 4094 (WAN) = 198.51.100.14

  Gateway 2

  1.

  VLAN 4085 (system IP) = 10.20.4.22

  2.

  VLAN 20 (users) = 10.20.20.2

  3.

  VLAN 4094 (WAN) = 198.51.100.12

  VRRP on VLAN 20 = 10.20.20.254

  The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.

  You are setting up the UBT zone on an AOS-CX switch.

  Which IP addresses should you define in the zone?

  A. Primary controller = 10.20.4.21; backup controller = 10.20.4.22

  B. [Primary controller = 198.51.100.14; backup controller = 10.20.4.21

  C. Primary controller = 10 20 4 21: backup controller not defined

  D. Primary controller = 10.20.20.254; backup controller, not defined

  Correct Answer: A

  To configure user-based tunneling (UBT) on an AOS-CX switch, you need to specify the IP addresses of the mobility gateways that will receive the tunneled traffic from the switch 1. The primary controller is the preferred gateway for the switch to establish a tunnel, and the backup controller is the alternative gateway in case the primary controller fails or becomes unreachable 1. The IP addresses of the gateways should be their system IP addresses, which are used for inter-controller communication and cluster discovery 2. In this scenario, the customer has a gateway cluster with two gateways, each with a system IP address on VLAN 4085. Therefore, the switch should use these system IP addresses as the primary and backup controllers for UBT. The IP addresses of the gateways on VLAN 20 and VLAN 4094 are not relevant for UBT, as they are used for user traffic and WAN connectivity, respectively 2. The VRRP IP address on VLAN 20 is also not applicable for UBT, as it is a virtual IP address that is not associated with any specific gateway 3. Therefore, the best option is to use 10.20.4.21 as the primary controller and 10.20.4.22 as the backup controller for UBT on the switch. This will ensure high availability and cluster discovery for the tunneled traffic from the switch to the gateway cluster.