This page was exported from Exams Labs Braindumps [ http://blog.examslabs.com ]

Export date:Tue Dec 3 17:54:43 2024 / +0000 GMT

___________________________________________________


Title: [Jun-2024] Valid Way To Pass HP Exam Dumps with HPE6-A84 Exam Study Guide [Q25-Q44]

---------------------------------------------------



 [Jun-2024] Valid Way To Pass HP Exam Dumps with HPE6-A84 Exam Study Guide
All HPE6-A84 Dumps and Aruba Certified Network Security Expert Written Exam Training Courses Help candidates to study and pass the Exams hassle-free!


Q25. Which element helps to lay the foundation for solid network security forensics?
 Enable BPDU protection and loop protection on edqe switch ports
 Enabling debug-level information for network infrastructure device logs
 Implementing 802.1X authentication on switch ports that connect to APs
 Ensuring that all network devices use a correct, consistent clock
ExplanationThis is because network forensics relies on the analysis of network traffic data, which is often time-stamped by the devices that generate or transmit it. Having a synchronized and accurate clock across all network devices helps to establish a reliable timeline of events and correlate different sources of evidence12A: Enable BPDU protection and loop protection on edge switch ports is not related to network security forensics, but rather to preventing network loops and topology changes caused by rogue switches or bridges3B: Enabling debug-level information for network infrastructure device logs might provide more details about the network activity, but it also consumes more resources and storage, and might not be relevant or useful for forensic analysis. Moreover, debug-level information might not be available for long-term retention or legal purposes4C: Implementing 802.1X authentication on switch ports that connect to APs is a good security practice to prevent unauthorized access to the network, but it does not directly help with network security forensics. 802.1X authentication does not capture or record network traffic data, which is the main source of evidence for network forensicsQ26. A customer has an AOS 10-based solution, including Aruba APs. The customer wants to use Cloud Auth to authenticate non-802.1X capable IoT devices.What is a prerequisite for setting up the device role mappings?
 Configuring a NetConductor-based fabric
 Configuring Device Insight (client profile) tags in Central
 Integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight
 Creating global role-to-role firewall policies in Central
ExplanationAccording to the Aruba Cloud Authentication and Policy Overview1, one of the prerequisites for configuring Cloud Authentication and Policy is to configure Device Insight (client profile) tags in Central. Device Insight tags are used to identify and classify IoT devices based on their behavior and characteristics. These tags can then be mapped to client roles, which are defined in the WLAN configuration for IAPs2. Client roles are used to enforce role-based access policies for the IoT devices. Therefore, option B is the correct answer.Option A is incorrect because NetConductor is not related to Cloud Authentication and Policy. NetConductor is a cloud-based network management solution that simplifies the deployment and operation of Aruba Instant networks.Option C is incorrect because integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight is not a prerequisite for setting up the device role mappings. CPPM and Device Insight can work together to provide enhanced visibility and control over IoT devices, but they are not required for Cloud Authentication and Policy.Option D is incorrect because creating global role-to-role firewall policies in Central is not a prerequisite for setting up the device role mappings. Global role-to-role firewall policies are used to define the traffic rules between different client roles across the entire network, but they are not required for Cloud Authentication and Policy.Q27. Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients.The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:EAP-TLS to authenticate users on mobile clients registered in IntuneTEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client’s username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:Clients with certificates issued by Onboard are assigned the “mobile-onboarded” role Clients that have passed TEAP Method 1 are assigned the “domain-computer” role Clients in the AD group “Medical” are assigned the “medical-staff” role Clients in the AD group “Reception” are assigned to the “reception-staff” role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:Assign medical staff on mobile-onboarded clients to the “medical-mobile” firewall role Assign other mobile-onboarded clients to the “mobile-other” firewall role Assign medical staff on domain computers to the “medical-domain” firewall role All reception staff on domain computers to the “reception-domain” firewall role All domain computers with no valid user logged in to the “computer-only” firewall role Deny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.# ClearPass cluster IP addressing and hostnamesA customer’s ClearPass cluster has these IP addresses:Publisher = 10.47.47.5Subscriber 1 = 10.47.47.6Subscriber 2 = 10.47.47.7Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer’s DNS server has these entriescp.acnsxtest.com = 10.47.47.5cps1.acnsxtest.com = 10.47.47.6cps2.acnsxtest.com = 10.47.47.7radius.acnsxtest.com = 10.47.47.8onboard.acnsxtest.com = 10.47.47.8The customer has now decided that it needs CPPM to assign certain mobile-onboarded devices to a“nurse-call” AOS user role. These are mobile-onboarded devices that are communicating with IP address10.1.18.12 using port 4343.What are the prerequisites for fulfilling this requirement?
 Setting up traffic classes and role mapping rules within Central’s global settings
 Creating server-based role assignment rules on APs that apply roles to clients based on traffic destinations
 Creating server-based role assignment rules on gateways that apply roles to clients based on traffic destinations
 Creating a tag on Central to select the proper destination connection and integrating CPPM with Device Insight
Q28. Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).Switches are using local port-access policies.The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the “eth-internet” role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.The plan for the enforcement policy and profiles is shown below:The gateway cluster has two gateways with these IP addresses:* Gateway 1o VLAN 4085 (system IP) = 10.20.4.21o VLAN 20 (users) = 10.20.20.1o VLAN 4094 (WAN) = 198.51.100.14* Gateway 2o VLAN 4085 (system IP) = 10.20.4.22o VLAN 20 (users) = 10.20.20.2o VLAN 4094 (WAN) = 198.51.100.12* VRRP on VLAN 20 = 10.20.20.254The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.Assume that you have configured the correct UBT zone and port-access role settings. However, the solution is not working.What else should you make sure to do?
 Assign VLAN 20 as the access VLAN on any edge ports to which tunneled clients might connect.
 Create a new VLAN on the AOS-CX switch and configure that VLAN as the UBT client VLAN.
 Assign sufficient VIA licenses to the gateways based on the number of wired clients that will connect.
 Change the port-access auth-mode mode to client-mode on any edge ports to which tunneled clients might connect.
Q29. Refer to the scenario.A customer requires these rights for clients in the “medical-mobile” AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22 Denied access to other 10.0.0.0/8 subnets Permitted access to the Internet Denied access to the WLAN for a period of time if they send any SSH traffic Denied access to the WLAN for a period of time if they send any Telnet traffic Denied access to all high-risk websites External devices should not be permitted to initiate sessions with “medical-mobile” clients, only send return traffic.The exhibits below show the configuration for the role.There are multiple issues with the configuration.What is one of the changes that you must make to the policies to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, “medical-mobile” rule 1 is “ipv4 any any svc-dhcp permit,” and rule 8 is “ipv4 any any any permit’.)
 In the “medical-mobile” policy, change the source in rule 1 to “user.”
 In the “medical-mobile” policy, change the subnet mask in rule 3 to 255.255.248.0.
 In the “medical-mobile” policy, move rules 6 and 7 to the top of the list.
 Move the rule in the “apprf-medical-mobile-sacl” policy between rules 7 and 8 in the “medical-mobile” policy.
Q30. Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients.The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:* EAP-TLS to authenticate users on mobile clients registered in Intune* TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client’s username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:* Clients with certificates issued by Onboard are assigned the “mobile-onboarded” role* Clients that have passed TEAP Method 1 are assigned the “domain-computer” role Clients in the AD group “Medical” are assigned the “medical-staff” role Clients in the AD group “Reception” are assigned to the “reception-staff” role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:* Assign medical staff on mobile-onboarded clients to the “medical-mobile” firewall role* Assign other mobile-onboarded clients to the “mobile-other” firewall role* Assign medical staff on domain computers to the “medical-domain” firewall role* All reception staff on domain computers to the “reception-domain” firewall role* All domain computers with no valid user logged in to the “computer-only” firewall role* Deny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.# ClearPass cluster IP addressing and hostnamesA customer’s ClearPass cluster has these IP addresses:* Publisher = 10.47.47.5* Subscriber 1 = 10.47.47.6* Subscriber 2 = 10.47.47.7* Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer’s DNS server has these entries* cp.acnsxtest.com = 10.47.47.5* cps1.acnsxtest.com = 10.47.47.6* cps2.acnsxtest.com = 10.47.47.7* radius.acnsxtest.com = 10.47.47.8* onboard.acnsxtest.com = 10.47.47.8You have started to create a CA to meet the customer’s requirements for issuing certificates to mobile clients, as shown in the exhibit below.What change will help to meet those requirements and the requirements for authenticating clients?
 Change the EST authentication method to use an external validator.
 Change the EST Digest Algorithm to SHA-512.
 Recreate the CA as a registration authority under Azure AD.
 Specify an OCSP responder, setting the hostname to localhost.
Q31. Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients’ privileges, ClearPass also should use information collected by Intune to make access control decisions.Assume that the Azure AD deployment has the proper prerequisites established.You are planning the CPPM authentication source that you will reference as the authentication source in802.1X services.How should you set up this authentication source?
 As Kerberos type
 As Active Directory type
 As HTTP type, referencing the Intune extension
 AS HTTP type, referencing Azure AD’s FODN
Q32. You need to install a certificate on a standalone Aruba Mobility Controller (MC). The MC will need to use the certificate for the Web UI and for implementing RadSec with Aruba ClearPass Policy Manager. You have been given a certificate with these settings:Subject: CN=mc41.site94.example.comNo SANsIssuer: CN=ca41.example.comEKUs: Server Authentication, Client AuthenticationWhat issue does this certificate have for the purposes for which the certificate is intended?
 It has conflicting EKUs.
 It is issued by a private CA.
 It specifies domain info in the CN field instead of the DC field.
 It lacks a DNS SAN.
Q33. You are reviewing an endpoint entry in ClearPass Policy Manager (CPPM) Endpoints Repository.What is a good sign that someone has been trying to gain unauthorized access to the network?
 The entry shows multiple DHCP options under the fingerprints.
 The entry shows an Unknown status.
 The entry shows a profile conflict of having a new profile of Computer for a profiled Printer.
 The entry lacks a hostname or includes a hostname with long seemingly random characters.
ExplanationA profile conflict occurs when ClearPass Policy Manager (CPPM) detects a change in the device category or OS family of an endpoint that has been previously profiled. This could indicate that someone has spoofed the MAC address of a legitimate device and is trying to gain unauthorized access to the network. For example, if an endpoint that was previously profiled as a Printer suddenly shows a new profile of Computer, this could be a sign of an attack. You can find more information about profile conflicts and how to resolve them in the ClearPass Policy Manager User Guide1. The other options are not necessarily signs of unauthorized access, as they could have other explanations. For example, multiple DHCP options under the fingerprints could indicate that the device has connected to different networks or subnets, an Unknown status could indicate that the device has not been authenticated yet, and a lack of hostname or a random hostname could indicate that the device has not been configured properly or has been reset to factory settings.Q34. Refer to the scenario.An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.You are helping the developer understand how to develop an NAE script for this use case.The developer explains that they plan to define the rule with logic like this:monitor > valueHowever, the developer asks you what value to include.What should you recommend?
 Checking one of the access switches’ RADIUS statistics and adding 10 to the number listed for rejects
 Defining a baseline and referring to it for the value
 Using 10 (per hour) as a good starting point for the value
 Defining a parameter and referring to it (self ^ramsfname]) for the value
Q35. Refer to the exhibit.Aruba ClearPass Policy Manager (CPPM) is using the settings shown in the exhibit. You reference the tag shown in the exhibit in enforcement policies related to NASes of several types, including Aruba APs, Aruba gateways, and AOS-CX switches.What should you do to ensure that clients are reclassified and receive the correct treatment based on the tag?
 Change the RADIUS action to [Aruba Wireless -Terminate Session] which is supported by all the NASes in question.
 Change the RADIUS action to [Aruba Wireless – Bounce Switch Port] which is supported by all the NASes in question.
 Enable profiling in each service using one of these enforcement profiles. Set the profiling action to the correct one for the NASes using that service.
 Set the Tags Update Action to No Action. Then instead enable the RADIUS CoAs using enforcement profiles in the rules that match clients with the tag shown in the exhibit.
ExplanationAccording to the ClearPass Policy Manager User Guide1, the tag shown in the exhibit is a Device Insight tag, which is used to classify and identify devices based on their behavior and characteristics. Device Insight tags can be used as conditions in enforcement policies to apply different actions or roles to devices based on their tags. However, in order to ensure that devices are reclassified and receive the correct treatment based on their tags, profiling must be enabled in each service that uses one of these enforcement profiles. Profiling is a feature that allows ClearPass to dynamically discover and profile devices on the network, and update their attributes and tags accordingly. Profiling also allows ClearPass to send RADIUS Change of Authorization (CoA) messages to the network access servers (NASes) that control the access of the devices, and instruct them to reauthenticate or terminate the sessions of the devices that have changed their tags. The profiling action must be set to the correct one for the NASes using that service, as different NASes may support different types of CoA messages. Therefore, option C is the correct answer.Q36. When would you implement BPDU protection on an AOS-CX switch port versus BPDU filtering?
 Use BPDU protection on edge ports to protect against rogue devices when the switch implements MSTP; use BPDU filtering to protect against rogue devices when the switch implements PVSTP+.
 Use BPDU protection on edge ports to prevent rogue devices from connecting; use BPDU filtering on inter-switch ports for specialized use cases.
 Use BPDU protection on inter-switch ports to ensure that they are selected as root; use BPDU filtering on edge ports to prevent rogue devices from connecting.
 Use BPDU protection on edge ports to permanently lock out rogue devices; use BPDU filtering on edge ports to temporarily lock out rogue devices.
ExplanationBPDU (Bridge Protocol Data Unit) is a message that is exchanged between switches to maintain the spanning tree topology and prevent loops. BPDU protection and BPDU filtering are two features that can be configured on AOS-CX switch ports to enhance security and performance.BPDU protection is a feature that disables a port if it receives a BPDU, indicating that an unauthorized switch or device has been connected to the port. BPDU protection is typically used on edge ports, which are ports that connect to end devices such as PCs or printers, and are not expected to receive BPDUs. BPDU protection prevents rogue devices from connecting to the network and affecting the spanning tree topology.BPDU filtering is a feature that prevents a port from sending or receiving BPDUs, effectively isolating the port from the spanning tree topology. BPDU filtering is typically used on inter-switch ports, which are ports that connect to other switches, for specialized use cases such as creating a separate spanning tree domain or reducing the overhead of BPDUs. BPDU filtering should be used with caution, as it can create loops or inconsistencies in the network.You can find more information about how to configure BPDU protection and BPDU filtering on AOS-CX switch ports in the [Configuring Spanning Tree Protocol – Aruba] page and the [AOS-CX Switching Configuration Guide] page. The other options are not correct because they either use BPDU protection or BPDU filtering on the wrong type of ports or for the wrong purpose. For example, using BPDU protection on inter-switch ports would disable the ports if they receive BPDUs, which are expected in normal operation.Using BPDU filtering on edge ports would allow rogue devices to connect to the network and create loops or affect the spanning tree topology.Q37. Refer to the scenario.A customer requires these rights for clients in the “medical-mobile” AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to r* eceive IP addresses with DHCP* Permitted access to DNS services from 10.8.9.7 and no other server* Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22* Denied access to other 10.0.0.0/8 subnets* Permitted access to the Internet* Denied access to the WLAN for a period of time if they send any SSH traffic* Denied access to the WLAN for a period of time if they send any Telnet traffic* Denied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with “medical-mobile” clients, only send return traffic.The exhibits below show the configuration for the role.There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example,“medical-mobile” rule 1 is “ipv4 any any svc-dhcp permit,” and rule 8 is “ipv4 any any any permit”.)
 In the “medical-mobile” policy, move rules 2 and 3 between rules 7 and 8.
 In the “medical-mobile” policy, change the subnet mask in rule 3 to 255.255.248.0.
 Move the rule in the “apprf-medical-mobile-sacl” policy between rules 7 and 8 in the “medical-mobile” policy.
 In the “medical-mobile” policy, change the source in rule 8 to “user.”
ExplanationThe subnet mask in rule 3 of the “medical-mobile” policy is currently 255.255.252.0, which means that the rule denies access to the 10.1.12.0/22 subnet as well as the adjacent 10.1.16.0/22 subnet 1. This is not consistent with the scenario requirements, which state that only the 10.1.12.0/22 subnet should be denied access, while the rest of the 10.1.0.0/16 range should be permitted access.To fix this issue, the subnet mask in rule 3 should be changed to 255.255.248.0, which means that the rule only denies access to the 10.1.8.0/21 subnet, which includes the 10.1.12.0/22 subnet 1. This way, the rule matches the scenario requirements more precisely.Q38. The customer needs a way for users to enroll new wired clients in Intune. The clients should have limited access that only lets them enroll and receive certificates. You plan to set up these rights in an AOS-CX role named “provision.” The customer’s security team dictates that you must limit these clients’ Internet access to only the necessary sites. Your switch software supports IPv4 and IPv6 addresses for the rules applied in the “provision” role.What should you recommend?
 Configuring the rules for the “provision” role with IPv6 addresses, which tend to be more stable
 Enabling tunneling to the MCs on the “provision” role and then setting up the privileges on the MCs
 Configuring the “provision” role as a downloadable user role (DUR) in CPPM
 Assigning the “provision” role to a VLAN and then setting up the rules within a Layer 2 access control list (ACL)
Q39. You are configuring gateway IDS/IPS settings in Aruba Central.For which reason would you set the Fail Strategy to Bypass?
 To permit traffic if the IPS engine falls to inspect It
 To enable the gateway to honor the allowlist settings configured in IDS/IPS policies
 To tell gateways to stop enforcing IDS/IPS policies if they lose connectivity to the Internet
 To avoid wasting IPS engine resources on filtering traffic for unauthenticated clients
ExplanationThe Fail Strategy is a configuration option for the IPS mode of inspection on Aruba gateways. It defines the action to be taken when the IPS engine crashes and cannot inspect the traffic. There are two possible options for the Fail Strategy: Bypass and Block1 If you set the Fail Strategy to Bypass, you are telling the gateway to allow the traffic to flow without inspection when the IPS engine fails. This option ensures that there is no disruption in the network connectivity, but it also exposes the network to potential threats that are not detected or prevented by the IPS engine1 If you set the Fail Strategy to Block, you are telling the gateway to stop the traffic flow until the IPS engine resumes inspection. This option ensures that there is no compromise in the network security, but it also causes a loss of network connectivity for the duration of the IPS engine failure1Q40. Refer to the exhibit.A customer requires protection against ARP poisoning in VLAN 4. Below are listed all settings for VLAN 4 and the VLAN 4 associated physical interfaces on the AOS-CX access layer switch:What is one issue with this configuration?
 ARP proxy is not enabled on VLAN 4.
 LAG 1 is configured as trusted for ARP inspection but should be untrusted.
 DHCP snooping is not enabled on VLAN 4.
 Edge ports are not configured as untrusted for ARP inspection.
ExplanationThis is because ARP inspection is a security feature that validates ARP packets in a network and prevents ARP poisoning attacks12 ARP inspection works by intercepting, logging, and discarding ARP packets with invalid IP-to-MAC address bindings1 To enable ARP inspection, the switch needs to know which ports are trusted and which are untrusted. Trusted ports are those that connect to authorized DHCP servers or other network devices that are not vulnerable to ARP spoofing. Untrusted ports are those that connect to end hosts or devices that might send forged ARP packets13 In the exhibit, LAG 1 is configured as a trusted port for ARP inspection, which is correct because it connects to the core switch. However, the edge ports (1/1/1-1/1/24) are not configured as untrusted ports for ARP inspection, which is incorrect because they connect to end hosts that might be compromised by an attacker. By default, all ports are untrusted for ARP inspection, but this can be changed by using the command ip arp inspection trust on the interface configuration mode3 Therefore, to protect VLAN 4 against ARP poisoning, the edge ports should be configured as untrusted for ARP inspection by using the command no ip arp inspection trust on the interface configuration mode. This way, the switch will validate the ARP packets received on these ports against the DHCP snooping database or an ARP access-list and drop any invalid packets34A: ARP proxy is not enabled on VLAN 4. This is not an issue because ARP proxy is an optional feature that allows the switch to respond to ARP requests on behalf of hosts in different subnets5 It is not related to ARP poisoning or ARP inspection.B: LAG 1 is configured as trusted for ARP inspection but should be untrusted. This is not an issue because LAG 1 connects to the core switch, which is a trusted device that does not send forged ARP packets.C: DHCP snooping is not enabled on VLAN 4. This is not an issue because DHCP snooping is a separate feature that prevents rogue DHCP servers from offering IP addresses to clients6 It is not directly related to ARP poisoning or ARP inspection, although it can provide information for ARP inspection validation if enabledQ41. You are configuring gateway IDS/IPS settings in Aruba Central.For which reason would you set the Fail Strategy to Bypass?
 To permit traffic if the IPS engine falls to inspect It
 To enable the gateway to honor the allowlist settings configured in IDS/IPS policies
 To tell gateways to stop enforcing IDS/IPS policies if they lose connectivity to the Internet
 To avoid wasting IPS engine resources on filtering traffic for unauthenticated clients
Q42. Refer to the scenario.A customer requires these rights for clients in the “medical-mobile” AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCP* Permitted access to DNS services from 10.8.9.7 and no other server* Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22* Denied access to other 10.0.0.0/8 subnets* Permitted access to the Internet* Denied access to the WLAN for a period of time if they send any SSH traffic* Denied access to the WLAN for a period of time if they send any Telnet traffic* Denied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with “medical-mobile” clients, only send return traffic.The exhibits below show the configuration for the role.There are multiple issues with the configuration.What is one of the changes that you must make to the policies to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, “medical-mobile” rule 1 is “ipv4 any any svc-dhcp permit,” and rule 8 is “ipv4 any any any permit’.)
 In the “medical-mobile” policy, change the source in rule 1 to “user.”
 In the “medical-mobile” policy, change the subnet mask in rule 3 to 255.255.248.0.
 In the “medical-mobile” policy, move rules 6 and 7 to the top of the list.
 Move the rule in the “apprf-medical-mobile-sacl” policy between rules 7 and 8 in the “medical-mobile” policy.
ExplanationRules 6 and 7 in the “medical-mobile” policy are used to deny access to the WLAN for a period of time if the clients send any SSH or Telnet traffic, as required by the scenario. However, these rules are currently placed below rule 5, which permits access to the Internet for any traffic. This means that rule 5 will override rules 6 and 7, and the clients will not be denied access to the WLAN even if they send SSH or Telnet traffic.To fix this issue, rules 6 and 7 should be moved to the top of the list, before rule 5. This way, rules 6 and 7 will take precedence over rule 5, and the clients will be denied access to the WLAN if they send SSH or Telnet traffic, as expected.Q43. Refer to the scenario.# Introduction to the customerYou are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients.The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.# Requirements for issuing certificates to mobile clientsThe company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.# Requirements for authenticating clientsThe customer requires all types of clients to connect and authenticate on the same corporate SSID.The company wants CPPM to use these authentication methods:* EAP-TLS to authenticate users on mobile clients registered in Intune* TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:Their certificate is valid and is not revoked, as validated by OCSPThe client’s username matches an account in AD# Requirements for assigning clients to rolesAfter authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:* Clients with certificates issued by Onboard are assigned the “mobile-onboarded” role* Clients that have passed TEAP Method 1 are assigned the “domain-computer” role Clients in the AD group “Medical” are assigned the “medical-staff” role Clients in the AD group “Reception” are assigned to the “reception-staff” role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:* Assign medical staff on mobile-onboarded clients to the “medical-mobile” firewall role* Assign other mobile-onboarded clients to the “mobile-other” firewall role* Assign medical staff on domain computers to the “medical-domain” firewall role* All reception staff on domain computers to the “reception-domain” firewall role* All domain computers with no valid user logged in to the “computer-only” firewall role* Deny other clients access# Other requirementsCommunications between ClearPass servers and on-prem AD domain controllers must be encrypted.# Network topologyFor the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.# ClearPass cluster IP addressing and hostnamesA customer’s ClearPass cluster has these IP addresses:* Publisher = 10.47.47.5* Subscriber 1 = 10.47.47.6* Subscriber 2 = 10.47.47.7* Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer’s DNS server has these entries* cp.acnsxtest.com = 10.47.47.5* cps1.acnsxtest.com = 10.47.47.6* cps2.acnsxtest.com = 10.47.47.7* radius.acnsxtest.com = 10.47.47.8* onboard.acnsxtest.com = 10.47.47.8You cannot see flow attributes for wireless clients.What should you check?
 Deep packet inspection is enabled on the role to which the Aruba APs assign the wireless clients.
 Firewall application visibility is enabled on the Aruba gateways, and the gateways have been rebooted.
 Gateway IDS/IPS is enabled on the Aruba gateways, and the gateways have been rebooted.
 Deep packet inspection is enabled on the Aruba Aps, and the APs have been rebooted.
Q44. Refer to the scenario.An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.You are helping the developer understand how to develop an NAE script for this use case.You are helping a customer define an NAE script for AOS-CX switches. The script will monitor statistics from a RADIUS server defined on the switch. You want to future proof the script by enabling admins to select a different hostname or IP address for the monitored RADIUS server when they create an agent from the script.What should you recommend?
 Use this variable, %{radius-ipV when defining the monitor URI in the NAE agent script.
 Define a parameter for the RADIUS server; reference that parameter instead of the server name/ip when defining the monitor URI.
 Use a callback action to collect the name of any RADIUS servers defined on the switch at the time the agent is created.
 Make the script editable so that admins can edit it on demand when they are creating scripts.
 Loading …






	
	


Get Latest [Jun-2024] Conduct effective penetration tests using ExamsLabs HPE6-A84: https://www.examslabs.com/HP/HP-ACA-Network-Security/best-HPE6-A84-exam-dumps.html

---------------------------------------------------


Images: https://blog.examslabs.com/wp-content/plugins/watu/loading.gif
https://blog.examslabs.com/wp-content/plugins/watu/loading.gif


---------------------------------------------------




---------------------------------------------------


Post date: 2024-06-29 12:32:07

Post date GMT: 2024-06-29 12:32:07

Post modified date: 2024-06-29 12:32:07

Post modified date GMT: 2024-06-29 12:32:07