HPE Aruba Network Security Expert Free Sample Questions

In the HPE Aruba Networking ESP data-center design, the CX 10000 Distributed Services Switch (DSS) 'enforces east-west traffic policy using an inline stateful firewall in hardware within the switch', so micro-segmentation is enforced at the top-of-rack switch port without hair-pinning server-to-server traffic through a centralized firewall. Aruba Fabric Composer, integrated with vCenter and AMD Pensando Policy Services Manager (PSM), manages the east-west policy centrally and lets VM administrators assign workloads to policy groups. Standard AOS-CX switches only support stateless ACLs (the stateful Policy Enforcement Firewall runs on Aruba gateways and APs); gateway IDS/IPS inspects only traffic that passes through the gateway; WIPS protects the RF environment; and EdgeConnect/OnGuard address SD-WAN and endpoint posture.

ClearPass Policy Manager is the authentication server, so its authentication records (Monitoring > Live Monitoring > Access Tracker) list every RADIUS, TACACS+ and WebAuth request with the username, host MAC address, NAS IP/name, service, login status (Accept, Reject or Timeout), roles and enforcement profiles. Filtering on the compromised username over the investigation window shows the first network authentication with the stolen credentials and every later session, including the device and the network access device (switch/AP) used. Gateway firewall logs and switch syslog are keyed to traffic and IP addresses rather than to the credential, and CPDI classification data describes devices rather than user logins; they become useful pivots once the authenticated sessions have been identified.

Both mechanisms let the RADIUS server check whether a client certificate has been revoked during EAP-TLS. A Certificate Revocation List (CRL) is a CA-signed list of revoked certificate serial numbers that the server downloads and refreshes (in ClearPass: Administration > Certificates > Revocation Lists, updated on a schedule or with Check Now). The Online Certificate Status Protocol (OCSP) queries a responder for the status (good, revoked or unknown) of an individual certificate at authentication time and is recommended because it gives real-time status (ClearPass EAP-TLS method: Verify Certificate using OCSP = Optional, Required or Required (CRL fallback)). A Registration Authority verifies requester identities, SCEP enrolls certificates and the root CA anchors trust; none of them checks revocation during authentication.

This statement is false. Installing an NAE script only makes it available on the switch. To activate it, a network administrator must explicitly create an NAE agent based on that script. The agent is the running instance of the script that performs the actual monitoring and alerting. Without creating the agent, the script remains dormant.

The integration between CPDI and CPPM is designed for dynamic, automated responses. When CPDI detects a high-risk device, it can signal CPPM to trigger a RADIUS Change of Authorization (CoA). This allows CPPM to instantly re-evaluate the device's session and apply a different enforcement policy, such as assigning a 'Quarantine' role that maps to a restricted VLAN. This contains the threat while allowing for further investigation, which is a core tenet of dynamic Zero Trust security.

Cryptographic hashing algorithms like SHA-256 are used to create a fixed-size, unique digital fingerprint (hash value) of a piece of data. Any change to the original data, no matter how small, will result in a completely different hash value. In digital forensics, hashing is fundamental for proving data integrity. The hash of the evidence is calculated upon collection and recorded in the chain of custody; it can be recalculated later to prove the evidence has not been tampered with.

Deauthentication containment is Aruba WIPS's direct, over-the-air containment method: Aruba APs and air monitors near the rogue disrupt its associations by sending spoofed 802.11 deauthentication frames - a broadcast deauthentication, followed by unicast deauthentication frames from the AP to the station and from the station to the AP - so clients cannot stay connected to it. (Tarpit and wired containment are Aruba's other containment methods; containment may be subject to regulatory restrictions such as FCC rules.) Blocking the rogue's MAC in the gateway firewall does not stop clients associating over the air, physically removing it is not immediate, and raising transmit power does not prevent association to the rogue.

Control Plane Policing (CoPP) is designed to protect the switch's CPU from being overwhelmed. A flood of Address Resolution Protocol (ARP) requests, often seen in an 'ARP scan,' is a common reconnaissance technique used by attackers to map out the active hosts on a subnet. An NAE agent monitoring CoPP would see a spike in the ARP queue, which is a strong indicator of a potential attack and should be alerted on.

The solution needs identification, policy and enforcement. (1) ClearPass Device Insight discovers and classifies the headless IoMT devices (active scans plus passive traffic analysis) and shares the classification and tags with ClearPass. (2) ClearPass Policy Manager uses that context in role mapping and enforcement policies to assign a restrictive role (for example, 'Infusion-Pump'). (3) The role is enforced in the network: the Policy Enforcement Firewall on the AP (bridged WLAN) or gateway (tunneled WLAN/UBT) applies stateful role-based rules, and AOS-CX switches apply the role's local or downloadable user-role policy (stateless ACLs), so the device can reach only its management server. EdgeConnect SD-WAN traffic shaping and NAE performance monitoring provide neither device identification nor segmentation.

In ClearPass, the Authentication Source configuration is where you connect to external identity stores like Active Directory. Within this configuration, you define which attributes to fetch during the authentication process. By adding the 'department' attribute to the list of fetched attributes in the AD Authentication Source, it becomes available for use in subsequent Role Mapping and Enforcement policies.