HP HPE6-A84 Exam Questions Instant Access

Question 1

A company has Aruba gateways that are Implementing gateway IDS/IPS in IDS mode. The customer complains that admins are receiving too frequent of repeat email notifications for the same threat. The threat itself might be one that the admins should investigate, but the customer does not want the email notification to repeat as often.

Which setting should you adjust in Aruba Central?

AReport scheduling settings

BAlert duration and threshold settings

CThe IDS policy setting (strict, medium, or lenient)

DThe allowlist settings in the IDS policy

Answer : B

Alert duration and threshold settings are used to control how often and under what conditions email notifications are sent for gateway IDS/IPS events1. By adjusting these settings, the customer can reduce the frequency of repeat email notifications for the same threat, while still being informed of any critical or new threats.

To adjust the alert duration and threshold settings in Aruba Central, the customer can follow these steps1:

In the Aruba Central app, set the filter to Global, a group, or a device.

Under Analyze, click Alerts & Events.

Click the Config icon to open the Alert Severities & Notifications page.

Select the Gateway IDS/IPS tab to view the alert categories and severities for gateway IDS/IPS events.

Click on an alert category to expand it and view the alert duration and threshold settings for each severity level.

Enter a value in minutes for the alert duration. This is the time period during which the alert is active and email notifications are sent.

Enter a value for the alert threshold. This is the number of times the alert must be triggered within the alert duration before an email notification is sent.

Click Save.

By increasing the alert duration and/or threshold values, the customer can reduce the number of email notifications for recurring threats, as they will only be sent when the threshold is reached within the duration. For example, if the customer sets the alert duration to 60 minutes and the alert threshold to 10 for a Critical severity level, then an email notification will only be sent if the same threat occurs 10 times or more within an hour.

Question 2

Refer to the scenario.

# Introduction to the customer

You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

The company currently has a Windows domain and Windows C

AThe Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.
# Requirements for issuing certificates to mobile clients
The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.
The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.
# Requirements for authenticating clients
The customer requires all types of clients to connect and authenticate on the same corporate SSID.
The company wants CPPM to use these authentication methods:
To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:
# Requirements for assigning clients to roles
After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:
The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:
# Other requirements
Communications between ClearPass servers and on-prem AD domain controllers must be encrypted.
# Network topology
For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.

# ClearPass cluster IP addressing and hostnames
A customer's ClearPass cluster has these IP addresses:
The customer's DNS server has these entries
You cannot see flow attributes for wireless clients.
What should you check?

ADeep packet inspection is enabled on the role to which the Aruba APs assign the wireless clients.

BFirewall application visibility is enabled on the Aruba gateways, and the gateways have been rebooted.

CGateway IDS/IPS is enabled on the Aruba gateways, and the gateways have been rebooted.

DDeep packet inspection is enabled on the Aruba Aps, and the APs have been rebooted.

Answer : A, A

Question 3

Refer to the scenario.

A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below:

What is one recommendation to make?

ALet the RADIUS server confiqure VLANs on LAG 1 dynamically.

BUse MDS instead of SHA1 for the NTP authentication key.

CEncrypt the certificate in the TA-profile.

DCreate a control plane ACL to limit the sources that can access the switch with SSH.

Answer : D

According to the AOS-CX Switches Multiple Vulnerabilities1, one of the vulnerabilities (CVE-2021-41000) affects the SSH service on AOS-CX switches. This vulnerability allows an unauthenticated remote attacker to cause a denial-of-service condition on the switch by sending specially crafted SSH packets. The impact of this vulnerability is high, as it could result in a loss of management access and network disruption. Therefore, one recommendation to make is to create a control plane ACL to limit the sources that can access the switch with SSH. This way, the switch can filter out unwanted or malicious SSH traffic and reduce the risk of exploitation.

Question 4

Refer to the scenario.

# Introduction to the customer

You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

The company currently has a Windows domain and Windows C

AThe Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.

# ClearPass cluster IP addressing and hostnames
A customer's ClearPass cluster has these IP addresses:
The customer's DNS server has these entries
You have created a role mapping policy as shown in the exhibits below.

What is one change that you need to make to this policy?

AIn rule 1 change Subject-CN to Issuer-CN.

BMove rules 2 and 3 to the top of the list.

CChange the rules evaluation mechanism to first applicable.

DChange the default role to 'mobile-onboarded*

Answer : A, A

Question 5

Refer to the scenario.

A customer requires these rights for clients in the ''medical-mobile'' AOS firewall role on Aruba Mobility Controllers (MCs):

External devices should not be permitted to initiate sessions with ''medical-mobile'' clients, only send return traffic.

The exhibits below show the configuration for the role.

What setting not shown in the exhibit must you check to ensure that the requirements of the scenario are met?

AThat denylisting is enabled globally on the MCs' firewalls

BThat stateful handling of traffic is enabled globally on the MCs' firewalls and on the medical-mobile role.

CThat AppRF and WebCC are enabled globally and on the medical-mobile role

DThat the MCs are assigned RF Protect licenses

Answer : C

AppRF and WebCC are features that allow the MCs to classify and control application traffic and web content based on predefined or custom categories12. These features are required to meet the scenario requirements of denying access to all high-risk websites and denying access to the WLAN for a period of time if they send any SSH or Telnet traffic.

To enable AppRF and WebCC, you need to check the following settings:

On the global level, you need to enable AppRF and WebCC underConfiguration > Services > AppRFandConfiguration > Services > WebCC, respectively12.

On the role level, you need to enable AppRF and WebCC underConfiguration > Security > Access Control > Roles > medical-mobile > AppRFandConfiguration > Security > Access Control > Roles > medical-mobile > WebCC, respectively12.

You also need to make sure that the MCs have valid licenses for AppRF and WebCC, which are included in the ArubaOS PEFNG license3.

Question 6

Refer to the scenario.

A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below:

What is one immediate remediation that you should recommend?

AChanging the switch's DNS server to the mgmt VRF

BSetting the clock manually instead of using NTP

CEither disabling DHCPv4-snoopinq or leaving it enabled, but also enabling ARP inspection

DDisabling Telnet

Answer : D

According to the AOS-CX Switches Multiple Vulnerabilities1, one of the vulnerabilities (CVE-2021-41001) affects the Telnet service on AOS-CX switches. This vulnerability allows an unauthenticated remote attacker to cause a denial-of-service condition on the switch by sending specially crafted Telnet packets. The impact of this vulnerability is high, as it could result in a loss of management access and network disruption. Therefore, one immediate remediation that you should recommend is to disable Telnet on the switch. This way, the switch can prevent any malicious Telnet traffic from reaching it and avoid the exploitation of this vulnerability.

Question 7

Which element helps to lay the foundation for solid network security forensics?

AEnable BPDU protection and loop protection on edqe switch ports

BEnabling debug-level information for network infrastructure device logs

CImplementing 802.1X authentication on switch ports that connect to APs

DEnsuring that all network devices use a correct, consistent clock

Answer : D

This is because network forensics relies on the analysis of network traffic data, which is often time-stamped by the devices that generate or transmit it.Having a synchronized and accurate clock across all network devices helps to establish a reliable timeline of events and correlate different sources of evidence12

A)Enable BPDU protection and loop protection on edge switch ports is not related to network security forensics, but rather to preventing network loops and topology changes caused by rogue switches or bridges3

B) Enabling debug-level information for network infrastructure device logs might provide more details about the network activity, but it also consumes more resources and storage, and might not be relevant or useful for forensic analysis.Moreover, debug-level information might not be available for long-term retention or legal purposes4

C) Implementing 802.1X authentication on switch ports that connect to APs is a good security practice to prevent unauthorized access to the network, but it does not directly help with network security forensics.802.1X authentication does not capture or record network traffic data, which is the main source of evidence for network forensics

HP Aruba Certified Network Security Expert Written HPE6-A84 Exam Questions