Aruba Certified Network Security Professional Exam (HPE7-A02) Free Practice Test

Question 1

Refer to Exhibit. All of the switches in the exhibit are AOS-CX switches. What is the preferred configuration on Switch-2 for preventing rogue OSPF routers in this network?

A. Configure OSPF authentication on VLANs 10-19 in password mode.

B. Configure OSPF authentication on Lag 1 in MD5 mode.

C. Configure passive-interface as the OSPF default and disable OSPF passive on Lag 1.

D. Disable OSPF entirely on VLANs 10-19.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

A company has been running Gateway IDS/IPS on its gateways in IDS mode for several weeks.
The company wants to transition to IPS mode.
What is one step you should recommend?

A. Change the mode on one gateway at a time to establish a smoother transition period.

B. Disable traffic inspection and reboot before re-enabling traffic inspection with the new mode.

C. Consider applying a stricter IPS policy to minimize issues during the transition period.

D. Check for legitimate traffic that has been flagged as a threat and allow list the associated rules.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A company needs to enforce 802.1X authentication for its Windows domain computers to HPE Aruba Networking ClearPass Policy Manager (CPPM). The company needs the computers to authenticate as both machines and users in the same session.
Which authentication method should you set up on CPPM?

A. TEAP

B. PEAP MSCHAPv2

C. EAP-TLS

D. EAP-TTLS

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

You need to set up an HPE Aruba Networking VIA solution for a customer who needs to support
2100 remote employees. The customer wants employees to
download their VIA connection profile from the VPNC. Only employees who authenticate with their domain credentials to HPE Aruba Networking ClearPass Policy Manager (CPPM) should be able to download the profile. (A RADIUS server group for CPPM is already set up on the VPNC.) How do you configure the VPNC to enforce that requirement?

A. Set up a VIA Authentication Profile that uses CPPM's server group; reference that profile in the VIA Connection Profile.

B. Set up a VIA Authentication Profile that uses CPPM's server group; reference that profile in the VIA Web Authentication Profile.

C. Reference CPPM's server group in an AAA profile; then, apply that profile to the VPNC's Internet- facing ports.

D. Create a new VPN Authentication Profile and then reference CPPM's default server group in that profile.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

You are setting up HPE Aruba Networking SSE to detect threats as remote users browse the internet.
What is part of this process?

A. Creating an external web profile that enables SSL inspection

B. Integrating HPE Aruba Networking SSE with a supported third-party antivirus provider

C. Creating a non-default file security profile

D. Deploying a connector that can reach the remote users

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

A company has AOS-CX switches and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company wants switches to implement 802.1X authentication to CPPM and download user roles.
What is one task that you must complete on the switches to support this use case?

A. Specify a ClearPass username and password that match the name and RADIUS secret in a CPPM network device entry.

B. Configure empty user-roles with names that match enforcement profile names on CPPM.

C. Specify CPPM as the RADIUS server with the exact CN in CPPM's HTTPS certificate.

D. Install the root CA certificate for CPPM's RADIUS certificate in a TA profile on the switches.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) and HPE Aruba Networking ClearPass Device Insight (CPDI) and has integrated the two. CPDI admins have created a tag. CPPM admins have created rules that use that tag in the wired 802.1X and wireless 802.1X services' enforcement policies.
The company requires CPPM to apply the tag-based rules to a client directly after it learns that the client has that tag.
What is one of the settings that you should verify on CPPM?

A. Both 802.1X services have the "Profile Endpoints" option enabled and an appropriate CoA profile selected in the Profiler tab.

B. The "Device Sync" setting is set to 1 in the ClearPass Device Insight Integration settings.

C. Both 802.1X services have the "Use cached Role and Posture attributes from the previous sessions" setting.

D. The "Polling Interval" is set to 1 in the ClearPass Device Insight Integration settings.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

A security team needs to track a device's communication patterns and identify patterns such as how many destinations the device is accessing.
Which Aruba solution can show this information at a glance?

A. HPE Aruba Networking ClearPass Policy Manager (CPPM) live monitoring Access Tracker

B. HPE Aruba Networking ClearPass Insight Endpoints and Network Dashboards

C. HPE Aruba Networking ClearPass Device Insight (CPDI) under a device's network activity

D. AOS-CX Analytics Dashboard using the system-installed NAE agent

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

What is a benefit of Online Certificate Status Protocol (OCSP)?

A. It lets a device download all the serial numbers for certificates revoked by a CA at once.

B. It lets a device dynamically renew its certificate before the certificate expires.

C. It lets a device determine whether to trust a certificate without needing any root certificates installed.

D. It lets a device query whether a single certificate is revoked or not.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

Which endpoint classification method requires direct device interrogation for identification?

A. Static VLAN tagging

B. Active profiling

C. Passive profiling

D. DHCP lease duration

Correct Answer: B

Question 11

What can help justify the extra cost of air monitors (AMs) to a company?

A. AMs support tarpit containment, which introduces fewer legal issues than deauthentication containment.

B. AMs can support wireless clients when they are not actively containing a device, so companies benefit from better security and connectivity.

C. AMs can detect wireless threats much faster than hybrid APs, reducing the company's vulnerability surface.

D. AMs support additional IDS/IPS features, such as malware and Trojan detection, to enhance overall security.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

A company wants to use the HPE Aruba Networking ClearPass OnGuard agent to assign posture to clients.
How do you define the conditions by which a client receives a particular posture?

A. Create rules within a posture policy

B. Create rules within a WebAuth enforcement policy

C. Create the rules directly in a service's Enforcement tab

D. Create rules directly in a service's Posture tab

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 13

The security team needs you to show them information about MAC spoofing attempts detected by HPE Aruba Networking ClearPass Policy Manager (CPPM).
What should you do?

A. Export the Access Tracker records on CPPM as an XML file.

B. Use ClearPass Insight to run an Active Endpoint Security report.

C. Integrate CPPM with ClearPass Device Insight (CPDI) and run a security report on CPDI.

D. Show the security team the CPPM Endpoint Profiler dashboard.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

HP Aruba Certified Network Security Professional (HPE7-A02) Free Practice Test