Updated HPE7-A02 Exam Dumps (V11.02) 2026: Your Best Resource for the HPE Network Security Professional Exam Preparation

It’s great that the HPE7-A02 exam dumps from DumpsBase have been updated. The most current version is V11.02, containing 156 practice questions and answers, which is essential for success on the first attempt. These updated HPE7-A02 exam questions are structured to fit seamlessly into busy schedules while delivering maximum results. Whether you prefer studying on your computer, tablet, or even printing the PDF for offline review, the HPE7-A02 dumps support flexible learning that adapts to your lifestyle. This accessibility ensures you can maintain consistent progress without disrupting your professional or personal commitments. The content is regularly refreshed to align with the latest exam objectives, making these updated HPE7-A02 dumps (V11.02) one of the most reliable resources available for 2026 candidates aiming for the ACP – Network Security certification. The path to becoming HPE Network Security Professional certified requires the right tools and a solid plan. With DumpsBase’s updated HPE7-A02 exam dumps (V11.02), you gain access to comprehensive, exam-oriented content that empowers you to study smarter, not harder.

Below are our HPE7-A02 free dumps to help you check the quality before downloading the full version:

1. A company needs you to integrate HPE Aruba Networking ClearPass Policy Manager (CPPM) with HPE Aruba Networking ClearPass Device Insight (CPDI).

What is one task you should do to prepare?

Install the root CA for CPPM's HTTPS certificate as trusted in the CPDI application.

Configure WMI, SSH, and SNMP external accounts for device scanning on CPP

Enable Insight in the CPPM server configuration settings.

Collect a Data Collector token from HPE Aruba Networking Central.

2. Refer to Exhibit.





(Note that the HPE Aruba Networking Central interface shown here might look slightly different from what you see in your HPE Aruba Networking Central interface as versions change; however, similar concepts continue to apply.)

An HPE Aruba Networking 9x00 gateway is part of an HPE Aruba Networking Central group that has the settings shown in the exhibit.

What would cause the gateway to drop traffic as part of its IDPS settings?

Its site-to-site VPN connections failing

Traffic matching a rule in the active ruleset

Its IDPS engine failing

Traffic showing anomalous behavior

3. A company has HPE Aruba Networking APs running AOS-10 and managed by HPE Aruba Networking Central. The company also has AOS-CX switches. The security team wants you to capture traffic from a particular wireless client. You should capture this client's traffic over a 15 minute time period and then send the traffic to them in a PCAP file.

What should you do?

Go to the client's AP in HPE Aruba Networking Central. Use the "Security" page to run a packet capture.

Access the CLI for the client's A

Set up a mirroring session between its radio and a management station running Wireshark.

Access the CLI for the client's AP's switch. Set up a mirroring session between the AP's port and a management station running Wireshark.

Go to that client in HPE Aruba Networking Central. Use the "Live Events" page to run a packet capture.

4. You have set up a mirroring session between an AOS-CX switch and a management station, running Wireshark. You want to capture just the traffic sent in the mirroring session, not the management station's other traffic.

What should you do?

Apply this capture filter: ip proto 47

Edit protocol preferences and enable ARUBA_ER

Edit protocol preferences and enable HPE_ER

Apply this capture filter: udp port 5555

5. A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) as a TACACS+ server to authenticate managers on its AOS-CX switches. The company wants CPPM to control which commands managers are allowed to enter. You see there is no field to enter these commands in ClearPass.

How do you start configuring the command list on CPPM?

Add the Shell service to the managers' TACACS+ enforcement profiles.

Edit the TACACS+ settings in the AOS-CX switches' network device entries.

Create an enforcement policy with the TACACS+ type.

Edit the settings for CPPM's default TACACS+ admin roles.

6. A company is implementing HPE Aruba Networking Wireless IDS/IPS (WIDS/WIPS) on its AOS-10 APs, which are managed in HPE Aruba Networking Central.

What is one requirement for enabling detection of rogue APs?

Each VLAN in the network assigned on at least one AP's or AM's port

A Foundation with Security license for each of the APs

One AM deployed for every one AP deployed

A manual radio profile that enables non-regulatory channels

7. A security team needs to track a device's communication patterns and identify patterns such as how many destinations the device is accessing.

Which Aruba solution can show this information at a glance?

HPE Aruba Networking ClearPass Insight Endpoints and Network Dashboards

HPE Aruba Networking ClearPass Policy Manager (CPPM) live monitoring Access Tracker

HPE Aruba Networking ClearPass Device Insight (CPDI) under a device's network activity

AOS-CX Analytics Dashboard using the system-installed NAE agent

8. The security team needs you to show them information about MAC spoofing attempts detected by HPE Aruba Networking ClearPass Policy Manager (CPPM).

What should you do?

Export the Access Tracker records on CPPM as an XML file.

Use ClearPass Insight to run an Active Endpoint Security report.

Integrate CPPM with ClearPass Device Insight (CPDI) and run a security report on CPD

Show the security team the CPPM Endpoint Profiler dashboard.

9. What is one use case that companies can fulfill using HPE Aruba Networking ClearPass Policy Manager's (CPPM's) Device Profiler?

Identifying device security vulnerabilities by CVE ID and receiving remediation recommendations

Leveraging artificial intelligence to more accurately identify Internet of Things (loT) devices

Quarantining devices that do not have the required antivirus software installed on them

Assigning different AOS firewall roles to users on computers and the same users on smartphones

10. You need to create a rule in an HPE Aruba Networking ClearPass Policy Manager (CPPM) role mapping policy that references a ClearPass Device Insight Tag.

Which Type (namespace) should you specify for the rule?

Application

Tips

Device

Endpoint

11. A company wants to apply a standard configuration to all AOS-CX switch ports and have the ports dynamically adjust their configuration based on the identity of the user or device that connects. They want to centralize configuration of the identity-based settings as much as possible.

What should you recommend?

Having HPE Aruba Networking ClearPass Policy Manager (CPPM) send standard RADIUS AVPs to customize port settings

Having switches pull port configurations dynamically from HPE Aruba Networking Activate

Having switches download user-roles from HPE Aruba Networking gateways

Having switches download user-roles from HPE Aruba Networking ClearPass Policy Manager (CPPM)

12. A company has HPE Aruba Networking APs running AOS-10 that connect to AOS-CX switches.

The APs will:

- Authenticate as 802.1X supplicants to HPE Aruba Networking ClearPass Policy Manager (CPPM)

- Be assigned to the "APs" role on the switches

- Have their traffic forwarded locally

What information do you need to help you determine the VLAN settings for the "APs" role?

Whether the APs have static or DHCP-assigned IP addresses

Whether the switches are using local user-roles (LURs) or downloadable user-roles (DURs)

Whether the switches have established tunnels with an HPE Aruba Networking gateway

Whether the APs bridge or tunnel traffic on their SSIDs

13. What is a use case for running periodic subnet scans on devices from HPE Aruba Networking ClearPass Policy Manager (CPPM)?

Using DHCP fingerprints to determine a client's device category and OS

Detecting devices that fail to comply with rules defined in CPPM posture policies

Identifying issues with authenticating and authorizing clients

Using WMI to collect additional information about Windows domain clients

14. A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) and HPE Aruba Networking ClearPass Device Insight (CPDI) and has integrated the two. CPDI admins have created a tag. CPPM admins have created rules that use that tag in the wired 802.1X and wireless 802.1X services' enforcement policies.

The company requires CPPM to apply the tag-based rules to a client directly after it learns that the client has that tag.

What is one of the settings that you should verify on CPPM?

The "Device Sync" setting is set to 1 in the ClearPass Device Insight Integration settings.

Both 802.1X services have the "Profile Endpoints" option enabled and an appropriate CoA profile selected in the Profiler tab.

Both 802.1X services have the "Use cached Role and Posture attributes from the previous sessions" setting.

The "Polling Interval" is set to 1 in the ClearPass Device Insight Integration settings.

15. What is one use case for implementing user-based tunneling (UBT) on AOS-CX switches?

Centralizing the distribution of wired traffic without requiring HPE Aruba Networking gateways

Tunneling traffic directly to a third-party firewall in a client data center

Adding 802.1X while continuing to use the existing VLAN and ACL structure in the Ethernet network

Applying enhanced security features such as deep packet inspection (DPI) to wired traffic

16. A company needs to enforce 802.1X authentication for its Windows domain computers to HPE Aruba Networking ClearPass Policy Manager (CPPM). The company needs the computers to authenticate as both machines and users in the same session.

Which authentication method should you set up on CPPM?

TEAP

PEAP MSCHAPv2

EAP-TTLS

EAP-TLS

17. A company has HPE Aruba Networking Central-managed APs. The company wants to block all clients connected through the APs from using YouTube.

Which steps should you take?

Deploy gateways and have the APs tunnel traffic to the gateways. Then, enable the gateway IDS/IPS engine.

Enable Client IPS at the "custom" level, and then specify the check for YouTube.

Enable WebCC on all client firewall roles. Then, create WebCC category rules that deny suspicious URLs.

Enable DP

Then, create application rules to deny YouTube on the firewall roles.

18. A company wants HPE Aruba Networking ClearPass Policy Manager (CPPM) to respond to Syslog messages from its Palo Alto Next Generation Firewall (NGFW) by quarantining clients involved in security incidents.

Which step must you complete to enable CPPM to process the Syslogs properly?

Configure the Palo Alto as a context server on CPP

Install a Palo Alto Extension through ClearPass Guest.

Enable Insight and ingress event processing on the CPPM server.

Configure CPPM to trust the root CA certificate for the NGF

19. You have installed an HPE Aruba Networking Network Analytic Engine (NAE) script on an AOS-CX switch to monitor a particular function.

Which additional step must you complete to start the monitoring?

Reboot the switch.

Enable NAE, which is disabled by default.

Edit the script to define monitor parameters.

Create an agent from the script.

20. HPE Aruba Networking ClearPass Policy Manager (CPPM) uses a service to authenticate clients. You are now adding the Endpoints Repository as an authorization source for the service, and you want to add rules to the service's policies that apply different access levels based, in part, on a client's device category. You need to ensure that CPPM can apply the new correct access level after discovering new clients' categories.

What should you enable on the service?

The Posture Compliance option in the Service tab

The Profile Endpoints option in the Service tab

The Use cached Roles and Posture attributes from previous sessions option in the Enforcement tab

The Audit End-host option in the Service tab

21. Refer to the exhibit.





All of the switches in the exhibit are AOS-CX switches.

What is the preferred configuration on Switch-2 for preventing rogue OSPF routers in this network?

Disable OSPF entirely on VLANs 10-19.

Configure OSPF authentication on VLANs 10-19 in password mode.

Configure OSPF authentication on Lag 1 in MD5 mode.

Configure passive-interface as the OSPF default and disable OSPF passive on Lag 1.

22. A company is implementing a client-to-site VPN based on tunnel-mode IPsec.

Which devices are responsible for the IPsec encapsulation?

Gateways at the remote clients' locations and devices accessed by the clients at the main site

The remote clients and devices accessed by the clients at the main site

The remote clients and a gateway at the main site

Gateways at the remote clients' locations and a gateway at the main site

23. An admin has configured an AOS-CX switch with these settings:

- port-access role employees

- vlan access name employees

This switch is also configured with CPPM as its RADIUS server.

Which enforcement profile should you configure on CPPM to work with this configuration?

RADIUS Enforcement type with HPE-User-Role VSA set to "employees"

HPE Aruba Networking Downloadable Role Enforcement type with role name set to "employees"

HPE Aruba Networking Downloadable Role Enforcement type with gateway role name set to "employees"

RADIUS Enforcement type with Aruba-User-Role VSA set to "employees"

24. You are using OpenSSL to obtain a certificate signed by a Certification Authority (CA).

You have entered this command:

openssl req -new -out file1.pem -newkey rsa:3072 -keyout file2.pem Enter PEM pass phrase: **********

Verifying - Enter PEM pass phrase: **********

Country Name (2 letter code) [AU]:US

State or Province Name (full name) [Some-State]: California

Locality Name (eg, city) []: Sunnyvale

Organization Name (eg, company) [Internet Widgits Pty Ltd]: example.com

Organizational Unit Name (eg, section) []:Infrastructure

Common Name (e.g. server FQDN or YOUR name) []: radius.example.com

What is one guideline for continuing to obtain a certificate?

You should use a third-party tool to encrypt file2.pem before sending it and file1.pem to the C

You should concatenate file1.pem and file2.pem into a single file, and submit that to the desired CA to sign.

You should submit file1.pem, but not file2.pem, to the desired CA to sign.

You should submit file2.pem, but not file1.pem, to the desired CA to sign.

25. You need to use "Tips:Posture" conditions within an 802.1X service's enforcement policy.

Which guideline should you follow?

Enable caching roles and posture attributes from previous sessions in the service's enforcement settings.

Create rules that assign postures in the service's role mapping policy.

Enable profiling in the service's general settings.

Select the Posture Policy type for the service's enforcement policy.

26. Your company wants to implement Tunneled EAP (TEAP).

How can you set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to enforce certificated-based authentication for clients using TEAP?

For the service using TEAP, set the authentication source to an internal database.

Select a service certificate when you specify TEAP as a service's authentication method.

Create an authentication method named "TEAP" with the type set to EAP-TL

Select an EAP-TLS-type authentication method for the TEAP method's inner method.

27. Admins have recently turned on Wireless IDS/IPS infrastructure detection at the high level on HPE Aruba Networking APs. When you check WIDS events, you see several RTS rate and CTS rate anomalies, which were triggered by neighboring APs.

What can you interpret from this event?

These neighboring APs are likely to be wireless clients that are inappropriately bridging their wired and wireless NICs; you should track down and remove them.

These neighboring APs might be hackers trying to launch a DoS, but are more likely operating normally; you should start by tuning the event thresholds.

These neighboring APs are actually rogue APs, and you should enable wireless tarpit containment on them.

These neighboring APs are actually rogue APs, and you should enable wireless de-authentication containment on them.

28. A company lacks visibility into the many different types of user and loT devices deployed in its internal network, making it hard for the security team to address those devices.

Which HPE Aruba Networking solution should you recommend to resolve this issue?

HPE Aruba Networking ClearPass Device Insight (CPDI)

HPE Aruba Networking Network Analytics Engine (NAE)

HPE Aruba Networking Mobility Conductor

HPE Aruba Networking ClearPass OnBoard

29. What is a use case for the HPE Aruba Networking ClearPass OnGuard dissolvable agent?

Continuously monitoring Windows domain clients for compliance

Implementing a one-time compliance scan

Auto-remediating posture issues on clients

Periodically scanning Linux clients for security issues

30. A company has a variety of HPE Aruba Networking solutions, including an HPE Aruba Networking infrastructure and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company passes traffic from the corporate LAN destined to the data center through a third-party SRX firewall. The company would like to further protect itself from internal threats.

What is one solution that you can recommend?

Have the third-party firewall send Syslogs to CPPM, which can work with network devices to lock internal attackers out of the network.

Use tunnel mode SSIDs and user-based tunneling (UBT) on AOS-CX switches to pass all internal traffic directly through the third-party firewall.

Add ClearPass Device Insight (CPDI) to the solution; integrate it with the third-party firewall to develop more complete device profiles.

Configure CPPM to poll the third-party firewall for a broad array of information about internal clients, such as profile and posture.

31. You have run an Active Endpoint Security Report on HPE Aruba Networking ClearPass. The report indicates that hundreds of endpoints have MAC addresses but no known IP addresses.

What is one step for addressing this issue?

Set up network devices to implement RADIUS accounting to CPP

Add CPPM's IP address to the IP helper list on routing switches.

Set up switches to implement ARP inspection on client VLANs.

Configure CPPM as a Syslog destination on network devices.

32. Which use case is fulfilled by applying a time range to a firewall rule on an AOS device?

Enforcing the rule only during the specified time range

Tuning the session timeout for sessions established with this rule

Locking clients that violate the rule for the specified time range

Setting the time range over which hit counts for the rule are aggregated

33. A company assigns a different block of VLAN IDs to each of its access layer AOS-CX switches. The switches run version 10.07. The IDs are used for standard purposes, such as for employees, VolP phones, and cameras. The company wants to apply 802.1X authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM) and then steer clients to the correct VLANs for local forwarding.

What can you do to simplify setting up this solution?

Assign consistent names to VLANs of the same type across the AOS-CX switches and have user-roles reference names.

Use the trunk allowed VLAN setting to assign multiple VLAN IDs to the same role.

Change the VLAN IDs across the AOS-CX switches so that they are consistent.

Avoid configuring the VLAN in the role; use trunk VLANs to assign multiple VLANs to the port instead.

34. You have created this rule in an HPE Aruba Networking ClearPass Policy Manager (CPPM) service's enforcement policy:

IF Authorization [Endpoints Repository]

Conflict EQUALS true THEN apply "quarantine_profile"

What information can help you determine whether you need to configure cluster-wide profiler parameters to ignore some conflicts?

Whether the company has rare Internet of Things (loT) devices

Whether some devices are incapable of captive portal or 802.1X authentication

Whether the company has devices that use PXE boot

Whether some devices are running legacy operating systems

35. What is a benefit of Online Certificate Status Protocol (OCSP)?

It lets a device query whether a single certificate is revoked or not.

It lets a device dynamically renew its certificate before the certificate expires.

It lets a device download all the serial numbers for certificates revoked by a CA at once.

It lets a device determine whether to trust a certificate without needing any root certificates installed.

36. A company has AOS-CX switches and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company wants switches to implement 802.1X authentication to CPPM and download user roles.

What is one task that you must complete on the switches to support this use case?

Specify CPPM as the RADIUS server with the exact CN in CPPM's HTTPS certificate.

Install the root CA certificate for CPPM's RADIUS certificate in a TA profile on the switches.

Configure empty user-roles with names that match enforcement profile names on CPP

Specify a ClearPass username and password that match the name and RADIUS secret in a CPPM network device entry.

37. A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). You have identified a device, which is currently classified as one type, but you want to classify it as a custom type. You also want to classify all devices with similar attributes as this type, both already-discovered devices and new devices discovered later.

What should you do?

Create a user tag from the Generic Devices page, select the desired attributes for the tag, and save the tag.

In the device details, select reclassify, create a user rule based on its attributes, and choose "Save & Reclassify."

In the device details, select filter, create a user tag based on the device attributes, and save the tag.

Create a user rule from the Generic Devices page, select the desired attributes for the rule, and choose "Save."

38. You are establishing a cluster of HPE Aruba Networking ClearPass servers. (Assume that they are running version 6.9.).

For which type of certificate it is recommended to install a CA-signed certificate on the Subscriber before it joins the cluster?

Database

HTTPS

RADIUS/EAP

RadSec

39. You need to set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to provide certificate-based authentication of 802.1X supplicants.

How should you upload the root CA certificate for the supplicants' certificates?

As a ClearPass Server certificate with the RADIUS/EAP usage

As a Trusted CA with the AD/LDAP usage

As a Trusted CA with the EAP usage

As a ClearPass Server certificate with the Database usage

40. You are setting up an HPE Aruba Networking VIA solution for a company. You need to configure access control policies for applications and resources that remote clients can access when connected to the VPN.

Where on the VPNC should you configure these policies?

In the tunneled network settings within the VIA Connection Profile

In the cloud security settings using IPsec maps

In the roles to which VIA clients are assigned after IKE authentication

In the roles to which VIA clients are assigned after VIA Web authentication

41. A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). In the CPDI security settings, Security Analysis is On, the Data Source is ClearPass Devices Insight, and Enable Posture Assessment is On. You see that device has a Risk Score of 90.

What can you know from this information?

The posture is unhealthy, and CPDI has also detected at least one vulnerability on the device.

The posture is unhealthy, but CPDI has not detected any vulnerabilities on the device.

The posture is healthy, but CPDI has detected multiple vulnerabilities on the device.

The posture is unknown, and CPDI has detected exactly four vulnerabilities on the device.

42. A company has HPE Aruba Networking APs, which authenticate users to HPE Aruba Networking ClearPass Policy Manager (CPPM).

What does HPE Aruba Networking recommend as the preferred method for assigning clients to a role on the AOS firewall?

Configure CPPM to assign the role using a RADIUS enforcement profile with a RADIUS: IETF Username attribute.

Configure CPPM to assign the role using a RADIUS enforcement profile with an Aruba-User-Role VS

Create server rules on the APs to assign clients to roles based on RADIUS IETF attributes returned by CPP

Create user rules on the APs to assign clients to roles based on a variety of criteria.

43. A company has HPE Aruba Networking APs and AOS-CX switches, as well as HPE Aruba Networking ClearPass. The company wants CPPM to have HTTP User-Agent strings to use in profiling devices.

What can you do to support these requirements?

Add the CPPM server's IP address to the IP helper list in all client VLANs on routing switches.

Schedule periodic subnet scans of all client subnets on CPP

Configure mirror sessions on the APs and switches to copy client HTTP traffic to CPP

On the APs and switches, configure a redirect to ClearPass Guest in the role for devices being profiled.

44. Assume that an AOS-CX switch is already implementing DHCP snooping and ARP inspection successfully on several VLANs.

What should you do to help minimize disruption time if the switch reboots?

Configure the switch to act as an ARP proxy.

Create static IP-to-MAC bindings for the DHCP and DNS servers.

Save the IP-to-MAC bindings to external storage.

Configure the IP helper address on this switch, rather than a core routing switch.

45. Refer to Exhibit.





A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). In the CPDI interface, you go to the Generic Devices page and see the view shown in the exhibit.

What correctly describes what you see?

Each cluster is a group of unclassified devices that CPDI's machine learning has discovered to have similar attributes.

Each cluster is a group of devices that match one of the tags configured by admins.

Each cluster is all the devices that have been assigned to the same category by one of CPDI's built-in system rules.

Each cluster is a group of devices that have been classified with user rules, but for which CPDI offers different recommendations.

46. You have configured an AOS-CX switch to implement 802.1X on edge ports. Assume ports operate in the default auth-mode. VolP phones are assigned to the "voice" role and need to send traffic that is tagged for VLAN 12.

Where should you configure VLAN 12?

As the trunk native VLAN on edge ports and the trunk native VLAN on the "voice" role

As a trunk allowed VLAN on edge ports and the trunk native VLAN in the "voice" role

As the trunk native VLAN in the "voice" role (and not in the edge port settings)

As the allowed trunk VLAN in the "voice" role (and not in the edge port settings)

47. You need to set up an HPE Aruba Networking VIA solution for a customer who needs to support 2100 remote employees. The customer wants employees to download their VIA connection profile from the VPNC. Only employees who authenticate with their domain credentials to HPE Aruba Networking ClearPass Policy Manager (CPPM) should be able to download the profile. (A RADIUS server group for CPPM is already set up on the VPNC.)

How do you configure the VPNC to enforce that requirement?

Set up a VIA Authentication Profile that uses CPPM's server group; reference that profile in the VIA Web Authentication Profile.

Reference CPPM's server group in an AAA profile; then, apply that profile to the VPNC's Internet-facing ports.

Create a new VPN Authentication Profile and then reference CPPM's default server group in that profile.

Set up a VIA Authentication Profile that uses CPPM's server group; reference that profile in the VIA Connection Profile.

48. A company wants to turn on Wireless IDS/IPS infrastructure and client detection at the high level on HPE Aruba Networking APs. The company does not want to enable any prevention settings.

What should you explain about HPE Aruba Networking recommendations?

HPE Aruba Networking recommends turning on both wired and wireless prevention whenever you enable detection at high.

HPE Aruba Networking recommends using hybrid AP mode, as opposed to Air Monitors (AMs), when implementing detection without prevention.

HPE Aruba Networking recommends disabling client detection when you configure infrastructure detection at high, as infrastructure detection includes all the client checks and more.

HPE Aruba Networking recommends configuring infrastructure and client detection at a custom level and disabling or tuning some of the settings that are likely to produce false positives.

49. A company has wired VolP phones, which transmit tagged traffic and connect to AOS-CX switches. The company wants to tunnel the phones' traffic to an HPE Aruba Networking gateway for applying security policies.

What is part of the correct configuration on the AOS-CX switches?

UBT mode set to VLAN extend

A VXLAN VNI mapped to the VLAN assigned to the VolP phones

VLANs assigned to the VolP phones configured on the switch uplinks

A UBT reserved VLAN set to a VLAN dedicated for that purpose

50. A company uses HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application option). In the details for a generic device cluster, you see a recommendation for "Windows 8/10" with 70% accuracy.

What does this mean?

CPDI has detected that these devices match about 70% of the system rule for defining "Windows 8/10" devices.

CPDI has matched these devices against several, conflicting system rules. 70% of those rules are for "Windows 8/10" devices.

CPDI has grouped this cluster with similar classified devices. 70% of those classified devices are "Windows 8/10."

CPDI has used MAC OUI to group these devices together. The average device's MAC address matches 70% of the "Windows 8/10" OU

51. A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) as a TACACS+ server to authenticate managers on its AOS-CX switches. You want to assign managers to groups on the AOS-CX switch by name.

How do you configure this setting in a CPPM TACACS+ enforcement profile?

Add the Shell service and set autocmd to the group name.

Add the Shell service and set priv-Ivl to the group name.

Add the Aruba: Common service and set Aruba-Admin-Role to the group name.

Add the Aruba: Common service and set Aruba-Priv-Admin-User to the group name.

52. You are deploying a virtual Data Collector for use with HPE Aruba Networking ClearPass Device Insight (CPDI). You have identified VLAN 101 in the data center as the VLAN to which the Data Collector should connect to receive its IP address and connect to HPE Aruba Networking Central.

Which Data Collector virtual ports should you tell the virtual admins to connect to VLAN 101?

The one with the lowest MAC address

The one with the highest port ID

The one with the highest MAC address

The one with the lowest port ID

53. A company issues user certificates to domain computers using its Windows CA and the default user certificate template. You have set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to authenticate 802.1X clients with those certificates. However, during tests, you receive an error that authorization has failed because the usernames do not exist in the authentication source.

What is one way to fix this issue and enable clients to successfully authenticate with certificates?

Configure rules to strip the domain name from the username.

Change the authentication method list to include both PEAP MSCHAPv2 and EAP-TL

Add the ClearPass Onboard local repository to the authentication source list.

Remove EAP-TLS from the authentication method list and add TEAP there instead.

54. A company has an HPE Aruba Networking ClearPass cluster with several servers.

ClearPass Policy Manager (CPPM) is set up to:

. Update client attributes based on Syslog messages from third-party appliances

. Have the clients reauthenticate and apply new profiles to the clients based on the updates

To ensure that the correct profiles apply, what is one step you should take?

Configure a CoA action for all tag updates in the ClearPass Device Insight integration settings.

Tune the CoA delay on the ClearPass servers to a value of 5 seconds or greater.

Set the cluster's Endpoint Context Servers polling interval to a value of 5 seconds or less.

Configure the cluster to periodically clean up (delete) unknown endpoints.

55. HPE Aruba Networking Central displays an alert about an Infrastructure Attack that was detected. You go to the Security > RAPIDS events and see that the attack was "Detect adhoc using Valid SSID."

What is one possible next step?

Use HPE Aruba Networking Central floorplans or the detecting AP identities to locate the general area for the threat.

Look for the IP address associated with the offender and then check for that IP address among HPE Aruba Networking Central clients.

Make sure that you have tuned the threshold for that check, as false positives are common for it.

Make sure that clients have updated drivers, as faulty drivers are a common explanation for this attack type.

 Loading...