Aruba Certified Network Security Expert Written Exam (HPE6-A84) Free Practice Test

Question 1

Refer to the exhibit.

You have been given this certificate to install on a ClearPass server for the RADIUS/EAP and RadSec usages.
What is one issue?

A. The certificate has a wildcard in the subject common name.

B. The certificate does not have an IP subject alternative name

C. The certificate does not have a URI subject alternative name

D. The certificate uses a fully qualified the '.local" domain name.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Refer to the scenario.
A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).
The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).
The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.
Assume that the Azure AD deployment has the proper prerequisites established.
You are planning the CPPM authentication source that you will reference as the authentication source in
802.1X services.
How should you set up this authentication source?

A. AS HTTP type, referencing Azure AD's FODN

B. As HTTP type, referencing the Intune extension

C. As Kerberos type

D. As Active Directory type

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

You are working with a developer to design a custom NAE script for a customer. You are helping the developer find the correct REST API resource to monitor.
Refer to the exhibit below.

What should you do before proceeding?

A. Make sure that your browser is set up to store authentication tokens and cookies.

B. Enable the switch to listen to REST API calls on the default VRF.

C. Use your Aruba passport account and collect a token to use when trying out API calls.

D. Go to the v1 API documentation interface instead of the v10.10 interface.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Refer to the scenario.
A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).
Switches are using local port-access policies.
The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.
The plan for the enforcement policy and profiles is shown below:

The gateway cluster has two gateways with these IP addresses:
* Gateway 1
o VLAN 4085 (system IP) = 10.20.4.21
o VLAN 20 (users) = 10.20.20.1
o VLAN 4094 (WAN) = 198.51.100.14
* Gateway 2
o VLAN 4085 (system IP) = 10.20.4.22
o VLAN 20 (users) = 10.20.20.2
o VLAN 4094 (WAN) = 198.51.100.12
* VRRP on VLAN 20 = 10.20.20.254
The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.
Assume that you are using the "myzone" name for the UBT zone.
Which is a valid minimal configuration for the AOS-CX port-access roles?

A. port-access role eth-internet gateway-zone zone myzone gateway-role eth-internet vlan access 20

B. port-access role internet-only gateway-zone zone myzone gateway-role eth-internet vlan access 20

C. port-access role eth-internet gateway-zone zone myzone gateway-role eth-user

D. port-access role internet-only gateway-zone zone myzone gateway-role eth-internet

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

A customer has an AOS 10-based mobility solution, which authenticates clients to Aruba ClearPass Policy Manager (CPPM). The customer has some wireless devices that support WPA2 in personal mode only.
How can you meet these devices' needs but improve security?

A. Use MPSK on the WLAN to which the devices connect.

B. Enable dynamic authorization (RFC 3576) in the AAA profile for the devices.

C. Connect these devices to the same WLAN to which 802.1X-capable clients connect, using MAC-Auth fallback.

D. Configure WIDS policies that apply extra monitoring to these particular devices.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Refer to the scenario.
A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.
In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as
"Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.
You want a fast way to find a list of all the IoT clients that have used SSH.
What step can you take?

A. Create and apply a Central client profile tag that selects the SSH application and the clients' category.

B. Use Central's Live Events monitoring tool to detect which clients meet the desired criteria.

C. Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources.

D. Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

HP Aruba Certified Network Security Expert Written (HPE6-A84) Free Practice Test