Aruba Certified Network Security Professional Exam (HPE7-A02) Free Practice Test

Question 1

A company has several use cases for using its AOS-CX switches ' HPE Aruba Networking Network Analytics Engine (NAE).
What is one guideline to keep in mind as you plan?

A. When you use custom scripts, you can create as many agents from each script as you want.

B. You can install multiple scripts on a switch, but you can deploy only one agent per script.

C. The switch will permit you to deploy as many NAE agents as you want, but they might degrade the switch functionality.

D. Each switch model has a maximum number of supported monitors, and one agent might have multiple monitors.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

An AOS-CX switch has this admin user account configured on it:
netadmin in the operators group.
You have configured these commands on an AOS-CX switch:
tacacs-server host cp.example.com key plaintext & 12xl,powmay7855
aaa authentication login ssh group tacacs local
aaa authentication allow-fail-through
A user accesses the switch with SSH and logs in as netadmin with the correct password. When the switch sends a TACACS+ request to the ClearPass server at cp.example.com, the server does not send a response.
Authentication times out.
What happens?

A. The user is logged in and granted operator access.

B. The user is logged in and allowed to enter auditor commands only.

C. The user is not allowed to log in.

D. The user is logged in and granted administrators access.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A company has wired VolP phones, which transmit tagged traffic and connect to AOS-CX switches. The company wants to tunnel the phones ' traffic to an HPE Aruba Networking gateway for applying security policies.
What is part of the correct configuration on the AOS-CX switches?

A. A UBT reserved VLAN set to a VLAN dedicated for that purpose

B. A VXLAN VNI mapped to the VLAN assigned to the VolP phones

C. UBT mode set to VLAN extend

D. VLANs assigned to the VolP phones configured on the switch uplinks

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

You need to set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to provide certificate-based authentication of 802.1X supplicants. How should you upload the root CA certificate for the supplicants' certificates?

A. As a ClearPass Server certificate with the Database usage.

B. As a Trusted CA with the EAP usage.

C. As a ClearPass Server certificate with the RADIUS/EAP usage.

D. As a Trusted CA with the AD/LDAP usage.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

You are deploying a virtual Data Collector for use with HPE Aruba Networking ClearPass Device Insight (CPDI). You have identified VLAN 101 in the data center as the VLAN to which the Data Collector should connect to receive its IP address and connect to HPE Aruba Networking Central.
Which Data Collector virtual ports should you tell the virtual admins to connect to VLAN 101?

A. The one with the highest MAC address

B. The one with the lowest port ID

C. The one with the lowest MAC address

D. The one with the highest port ID

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application).
You have identified a device, which is currently
classified as one type, but you want to classify it as a custom type. You also want to classify all devices with similar attributes as this type, both already-discovered devices and new devices discovered later.
What should you do?

A. In the device details, select filter, create a user tag based on the device attributes, and save the tag.

B. Create a user rule from the Generic Devices page, select the desired attributes for the rule, and choose " Save. "

C. Create a user tag from the Generic Devices page, select the desired attributes for the tag, and save the tag.

D. In the device details, select reclassify, create a user rule based on its attributes, and choose " Save & Reclassify. "

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

A company has HPE Aruba Networking infrastructure devices. The devices authenticate clients to HPE Aruba Networking ClearPass Policy Manager (CPPM). You want CPPM to track information about clients, such as their IP addresses and their network bandwidth utilization. What should you set up on the network infrastructure devices to help that happen?

A. An IF-MAP interface with CPPM as the destination.

B. Dynamic authorization enabled in the RADIUS settings for CPPM.

C. RADIUS accounting to CPPM, including interim updates.

D. Logging with CPPM configured as a Syslog server.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

How can HPE Aruba Networking User-Based Tunneling (UBT) help companies implement a Zero Trust Security strategy?

A. By controlling wired and wireless clients with consistent identity- and context-based access policies

B. By applying best-practice data center security technologies, such as VXLAN, all the way to the internal edge

C. By extending internal security zones through integration with cloud-based security solutions

D. By applying strong encryption to all traffic that flows through the corporate LAN

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

A company has AOS-CX switches and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company wants switches to implement 802.1X authentication to CPPM and download user roles.
What is one task that you must complete on the switches to support this use case?

A. Install the root CA certificate for CPPM ' s RADIUS certificate in a TA profile on the switches.

B. Specify a ClearPass username and password that match the name and RADIUS secret in a CPPM network device entry.

C. Configure empty user-roles with names that match enforcement profile names on CPPM.

D. Specify CPPM as the RADIUS server with the exact CN in CPPM ' s HTTPS certificate.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

A company is using HPE Aruba Networking Central SD-WAN Orchestrator to establish a hub-spoke VPN between branch gateways (BGWs) at 1444 site and VPNCs at multiple data centers.
What is part of the configuration that admins need to complete?

A. At the global level, create default IPsec policies for the SD-WAN Orchestrator to use.

B. In VPNCs ' groups, establish VPN pools to control which branches connect to which VPNCs.

C. In BGWs ' groups, select the VPNCs to which to connect in a DC preference list.

D. In BGWs ' and VPNCs ' groups, create default IKE policies for the SD-WAN Orchestrator to use.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 11

Which use case is fulfilled by applying a time range to a firewall rule on an AOS device?

A. Enforcing the rule only during the specified time range

B. Tuning the session timeout for sessions established with this rule

C. Setting the time range over which hit counts for the rule are aggregated

D. Locking clients that violate the rule for the specified time range

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

You have configured an AOS-CX switch to implement 802.1X on edge ports. Assume ports operate in the default auth-mode. VolP phones are assigned to the
" voice " role and need to send traffic that is tagged for VLAN 12.
Where should you configure VLAN 12?

A. As a trunk allowed VLAN on edge ports and the trunk native VLAN in the " voice " role

B. As the allowed trunk VLAN in the " voice " role (and not in the edge port settings)

C. As the trunk native VLAN on edge ports and the trunk native VLAN on the " voice " role

D. As the trunk native VLAN in the " voice " role (and not in the edge port settings)

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 13

A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). In the CPDI security settings, Security Analysis is On, the Data Source is ClearPass Device Insight, and Enable Posture Assessment is On. You see that a device has a Risk Score of 90.
What can you know from this information?

A. The posture is unhealthy, and CPDI has also detected at least one vulnerability on the device.

B. The posture is unknown, and CPDI has detected exactly four vulnerabilities on the device.

C. The posture is unhealthy, but CPDI has not detected any vulnerabilities on the device.

D. The posture is healthy, but CPDI has detected multiple vulnerabilities on the device.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

HP Aruba Certified Network Security Professional (HPE7-A02) Free Practice Test