New 2023 HPE6-A84 exam questions Welcome to download the newest Actual4test HPE6-A84 PDF dumps (60 Q&As)
P.S. Free 2023 HP ACA - Network Security HPE6-A84 dumps are available on Google Drive shared by Actual4test
NEW QUESTION # 13
Refer to the exhibit.
Which IP address should you record as a possibly compromised client?
- A. 10.1.26.151
- B. 10.1J.100
- C. 10.1.26.1
- D. 10.254.1.21
Answer: A
NEW QUESTION # 14
You are working with a developer to design a custom NAE script for a customer. You are helping the developer find the correct REST API resource to monitor.
Refer to the exhibit below.
What should you do before proceeding?
- A. Use your Aruba passport account and collect a token to use when trying out API calls.
- B. Enable the switch to listen to REST API calls on the default VRF.
- C. Go to the v1 API documentation interface instead of the v10.10 interface.
- D. Make sure that your browser is set up to store authentication tokens and cookies.
Answer: A
Explanation:
Explanation
The exhibit shows the ArubaOS-CX REST API documentation interface, which allows you to explore the available resources and try out the API calls using the "Try it out" button. However, before you can use this feature, you need to authenticate yourself with your Aruba passport account and collect a token that will be used for subsequent requests. This token will expire after a certain time, so you need to refresh it periodically. You can find more details about how to use the documentation interface and collect a token in the ArubaOS-CX REST API Guide1.
NEW QUESTION # 15
You are reviewing an endpoint entry in ClearPass Policy Manager (CPPM) Endpoints Repository.
What is a good sign that someone has been trying to gain unauthorized access to the network?
- A. The entry shows a profile conflict of having a new profile of Computer for a profiled Printer.
- B. The entry lacks a hostname or includes a hostname with long seemingly random characters.
- C. The entry shows an Unknown status.
- D. The entry shows multiple DHCP options under the fingerprints.
Answer: A
Explanation:
Explanation
A profile conflict occurs when ClearPass Policy Manager (CPPM) detects a change in the device category or OS family of an endpoint that has been previously profiled. This could indicate that someone has spoofed the MAC address of a legitimate device and is trying to gain unauthorized access to the network. For example, if an endpoint that was previously profiled as a Printer suddenly shows a new profile of Computer, this could be a sign of an attack. You can find more information about profile conflicts and how to resolve them in the ClearPass Policy Manager User Guide1. The other options are not necessarily signs of unauthorized access, as they could have other explanations. For example, multiple DHCP options under the fingerprints could indicate that the device has connected to different networks or subnets, an Unknown status could indicate that the device has not been authenticated yet, and a lack of hostname or a random hostname could indicate that the device has not been configured properly or has been reset to factory settings.
NEW QUESTION # 16
Refer to the scenario.
A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below:
What is one immediate remediation that you should recommend?
- A. Changing the switch's DNS server to the mgmt VRF
- B. Setting the clock manually instead of using NTP
- C. Either disabling DHCPv4-snoopinq or leaving it enabled, but also enabling ARP inspection
- D. Disabling Telnet
Answer: D
Explanation:
Explanation
According to the AOS-CX Switches Multiple Vulnerabilities1, one of the vulnerabilities (CVE-2021-41001) affects the Telnet service on AOS-CX switches. This vulnerability allows an unauthenticated remote attacker to cause a denial-of-service condition on the switch by sending specially crafted Telnet packets. The impact of this vulnerability is high, as it could result in a loss of management access and network disruption. Therefore, one immediate remediation that you should recommend is to disable Telnet on the switch. This way, the switch can prevent any malicious Telnet traffic from reaching it and avoid the exploitation of this vulnerability.
NEW QUESTION # 17
You are setting up Aruba ClearPass Policy Manager (CPPM) to enforce EAP-TLS authentication with Active Directory as the authentication source. The company wants to prevent users with disabled accounts from connecting even if those users still have valid certificates.
As the first part of meeting these criteria, what should you do to enable CPPM to determine where accounts are enabled in AD or not?
- A. Add a custom attribute for userAccountControl to the filters in the AD authentication source.
- B. Enable OCSP in the EAP-TLS authentication method settings and configure an OCSP override to the domain controller FQDN.
- C. Install a Microsoft Active Directory extension in Aruba ClearPass Guest and set up an HTTP authentication source that points to that extension.
- D. Add an Endpoint Context Server to the domain controller with actions for querying the domain controller for account status.
Answer: A
NEW QUESTION # 18
Refer to the scenario.
This customer is enforcing 802.1X on AOS-CX switches to Aruba ClearPass Policy Manager (CPPM). The customer wants switches to download role settings from CPPM. The "reception-domain" role must have these settings:
- Assigns clients to VLAN 14 on switch 1, VLAN 24 on switch 2, and so on.
- Filters client traffic as follows:
- Clients are permitted full access to 10.1.5.0/24 and the Internet
- Clients are denied access to 10.1.0.0/16
The switch topology is shown here:
How should you configure the VLAN setting for the reception role?
- A. Configure the enforcement profile as a downloadable role, but specify only the role name and leave the VLAN undefined. Then define a 'reception' role with the correct VLAN setting on each individual access layer switch.
- B. Assign a consistent name to VLAN 14, 24, or 34 on each access layer switch and reference that name in the enforcement profile VLAN settings.
- C. Assign a number-based ID to the access layer switches. Then use this variable in the enforcement profile VLAN settings: %(NAS-ID]4.
- D. Create a separate enforcement profile with a different VLAN ID for each switch. Add all profiles to the profile list in the appropriate enforcement policy rule.
Answer: B
NEW QUESTION # 19
A company has Aruba gateways and wants to start implementing gateway IDS/IPS. The customer has selected Block for the Fail Strategy.
What might you recommend to help minimize unexpected outages caused by using this particular fall strategy?
- A. Setting the IDS or IPS policy to the least restrictive option, Lenient
- B. Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors
- C. Configuring a relatively high threshold for the gateway threat count alerts
- D. Making sure that the gateways have formed a cluster and operate in default gateway mode
Answer: D
NEW QUESTION # 20
Refer to the scenario.
A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):
Permitted to receive IP addresses with DHCP
* Permitted access to DNS services from 10.8.9.7 and no other server
* Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22
* Denied access to other 10.0.0.0/8 subnets
* Permitted access to the Internet
* Denied access to the WLAN for a period of time if they send any SSH traffic
* Denied access to the WLAN for a period of time if they send any Telnet traffic
* Denied access to all high-risk websites
External devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.
The exhibits below show the configuration for the role.
There are multiple issues with the configuration.
What is one of the changes that you must make to the policies to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, "medical-mobile" rule 1 is "ipv4 any any svc-dhcp permit," and rule 8 is "ipv4 any any any permit'.)
- A. Move the rule in the "apprf-medical-mobile-sacl" policy between rules 7 and 8 in the "medical-mobile" policy.
- B. In the "medical-mobile" policy, change the source in rule 1 to "user."
- C. In the "medical-mobile" policy, move rules 6 and 7 to the top of the list.
- D. In the "medical-mobile" policy, change the subnet mask in rule 3 to 255.255.248.0.
Answer: C
Explanation:
Explanation
Rules 6 and 7 in the "medical-mobile" policy are used to deny access to the WLAN for a period of time if the clients send any SSH or Telnet traffic, as required by the scenario. However, these rules are currently placed below rule 5, which permits access to the Internet for any traffic. This means that rule 5 will override rules 6 and 7, and the clients will not be denied access to the WLAN even if they send SSH or Telnet traffic.
To fix this issue, rules 6 and 7 should be moved to the top of the list, before rule 5. This way, rules 6 and 7 will take precedence over rule 5, and the clients will be denied access to the WLAN if they send SSH or Telnet traffic, as expected.
NEW QUESTION # 21
The customer needs a way for users to enroll new wired clients in Intune. The clients should have limited access that only lets them enroll and receive certificates. You plan to set up these rights in an AOS-CX role named "provision." The customer's security team dictates that you must limit these clients' Internet access to only the necessary sites. Your switch software supports IPv4 and IPv6 addresses for the rules applied in the "provision" role.
What should you recommend?
- A. Configuring the rules for the "provision" role with IPv6 addresses, which tend to be more stable
- B. Assigning the "provision" role to a VLAN and then setting up the rules within a Layer 2 access control list (ACL)
- C. Enabling tunneling to the MCs on the "provision" role and then setting up the privileges on the MCs
- D. Configuring the "provision" role as a downloadable user role (DUR) in CPPM
Answer: D
NEW QUESTION # 22
How does Aruba Central handle security for site-to-site connections between AOS 10 gateways?
- A. It automatically steers traffic away from Internet-based connections to more secure MPLS connections to reduce encryption overhead.
- B. It automatically establishes simple-to-manage and highly secure TLSv1.3 tunnels between gateways.
- C. It uses an Aruba proprietary integrity and encryption technologies to secure site-to-site connections, making them resistant to zero day attacks.
- D. It automatically establishes IPsec tunnels for all site-to-site (all HUBs and Branches) connections using keys securely distributed by Central.
Answer: D
NEW QUESTION # 23
Refer to the scenario.
A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below:
What is one recommendation to make?
- A. Use MDS instead of SHA1 for the NTP authentication key.
- B. Encrypt the certificate in the TA-profile.
- C. Create a control plane ACL to limit the sources that can access the switch with SSH.
- D. Let the RADIUS server confiqure VLANs on LAG 1 dynamically.
Answer: C
Explanation:
Explanation
According to the AOS-CX Switches Multiple Vulnerabilities1, one of the vulnerabilities (CVE-2021-41000) affects the SSH service on AOS-CX switches. This vulnerability allows an unauthenticated remote attacker to cause a denial-of-service condition on the switch by sending specially crafted SSH packets. The impact of this vulnerability is high, as it could result in a loss of management access and network disruption. Therefore, one recommendation to make is to create a control plane ACL to limit the sources that can access the switch with SSH. This way, the switch can filter out unwanted or malicious SSH traffic and reduce the risk of exploitation.
NEW QUESTION # 24
Refer to the scenario.
A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below:
What is one recommendation to make?
- A. Use MDS instead of SHA1 for the NTP authentication key.
- B. Encrypt the certificate in the TA-profile.
- C. Let the RADIUS server confiqure VLANs on LAG 1 dynamically.
- D. Create a control plane ACL to limit the sources that can access the switch with SSH.
Answer: B
NEW QUESTION # 25
Refer to the scenario.
A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.
In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as
"Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.
You want a relatively easy way to communicate the information that an IoT client has used SSH to Aruba CPPM.
What is one prerequisite?
- A. In CPPM's CA trust list, add the Aruba Infrastructure usage to the DigiCert certificate.
- B. Obtain a data collector token from Central's platform integration settings.
- C. Enable event processing on subscribers in the ClearPass cluster.
- D. Create an API application and token within the REST API settings.
Answer: B
NEW QUESTION # 26
A customer's admins have added RF Protect licenses and enabled WIDS for a customer's AOS 8-based solution. The customer wants to use the built-in capabilities of APs without deploying dedicated air monitors (AMs). Admins tested rogue AP detection by connecting an unauthorized wireless AP to a switch. The rogue AP was not detected even after several hours.
What is one point about which you should ask?
- A. Whether APs' switch ports support all the VLANs that are accessible at the edge
- B. Whether admins enabled wireless containment
- C. Whether admins set at least one radio on each AP to air monitor mode
- D. Whether the customer is using non-standard Wi-Fi channels in the deployment
Answer: C
Explanation:
Explanation
RF Protect is a feature that enables wireless intrusion detection and prevention system (WIDS/WIPS) capabilities on AOS 8-based solutions. WIDS/WIPS allows detecting and mitigating rogue APs, unauthorized clients, and other wireless threats. RF Protect requires RF Protect licenses to be installed and WIDS to be enabled on the Mobility Master (MM).
To use the built-in capabilities of APs for WIDS/WIPS, without deploying dedicated air monitors (AMs), admins need to set at least one radio on each AP to air monitor mode. Air monitor mode allows the AP to scan the wireless spectrum and report any wireless activity or anomalies to the MM. Air monitor mode does not affect the other radio on the AP, which can still serve clients in access mode. By setting at least one radio on each AP to air monitor mode, admins can achieve full coverage and visibility of the wireless environment and detect rogue APs.
If admins do not set any radio on the APs to air monitor mode, the APs will not scan the wireless spectrum or report any wireless activity or anomalies to the MM. This means that the APs will not be able to detect rogue APs, even if they are connected to the same network. Therefore, admins should check whether they have set at least one radio on each AP to air monitor mode.
NEW QUESTION # 27
Refer to the scenario.
A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an Aruba ClearPass cluster.
In Aruba Central, you are examining network traffic flows on a wireless IoT device that is categorized as
"Raspberry Pi" clients. You see SSH traffic. You then check several more wireless IoT clients and see that they are sending SSH also.
You want an easy way to communicate the information that an IoT client has used SSH to Aruba ClearPass Policy Manager (CPPM).
What step should you take?
- A. On Central set up CPPM as a Webhook application.
- B. On CPPM create an Endpoint Context Server that points to the Central API.
- C. On CPPM enable Device Insight integration.
- D. On Central configure APs and gateways to use CPPM as the RADIUS accounting server.
Answer: B
Explanation:
Explanation
This is because an Endpoint Context Server (ECS) is a feature that allows ClearPass to receive contextual information from external sources, such as Aruba Central, and use it for policy enforcement and reporting. An ECS can be configured to point to the Aruba Central API and fetch data such as device type, category, OS, applications, traffic flows, etc.
An ECS can be used to communicate the information that an IoT client has used SSH to Aruba ClearPass Policy Manager (CPPM). The ECS can query the Aruba Central API and retrieve the network traffic flows of the wireless IoT devices that are categorized as "Raspberry Pi" clients. The ECS can then filter the traffic flows by the SSH protocol and send the relevant information to CPPM. CPPM can then use this information for policy decisions, such as allowing or denying SSH access, or triggering alerts or actions.
B: On CPPM enable Device Insight integration. This is not a valid step because Device Insight is a feature that allows ClearPass to discover, profile, and fingerprint devices on the network using deep packet inspection (DPI) and machine learning (ML). Device Insight does not communicate with Aruba Central or receive information from it. Moreover, Device Insight might not be able to detect SSH traffic on encrypted wireless IoT devices without decrypting it first.
C: On Central configure APs and gateways to use CPPM as the RADIUS accounting server. This is not a valid step because RADIUS accounting is a feature that allows network devices to send periodic updates about the status and activity of authenticated users or devices to a RADIUS server, such as CPPM. RADIUS accounting does not communicate with Aruba Central or receive information from it. Moreover, RADIUS accounting might not be able to capture SSH traffic on wireless IoT devices without inspecting it first.
D: On Central set up CPPM as a Webhook application. This is not a valid step because Webhook is a feature that allows Aruba Central to send notifications or events to external applications or services using HTTP requests. Webhook does not communicate with CPPM or send information to it. Moreover, Webhook might not be able to send SSH traffic information on wireless IoT devices without filtering it first.
NEW QUESTION # 28
Refer to the scenario.
A hospital has an AOS10 architecture that is managed by Aruba Central. The customer has deployed a pair of Aruba 9000 Series gateways with Security licenses at each clinic. The gateways implement IDS/IPS in IDS mode.
The Security Dashboard shows these several recent events with the same signature, as shown below:
Which step could give you valuable context about the incident?
- A. View firewall sessions on the APs and record the threat sources' type and OS.
- B. View the RAPIDS Security Dashboard and see if the threat sources are listed as rogues.
- C. Find the Central client profile for the threat sources and note their category and family.
- D. View the user-table on APs and record the threat sources' 802.11 settings.
Answer: B
NEW QUESTION # 29
Refer to the scenario.
A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):
Permitted to receive IP addresses with DHCP
Permitted access to DNS services from 10.8.9.7 and no other server
Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22 Denied access to other 10.0.0.0/8 subnets Permitted access to the Internet Denied access to the WLAN for a period of time if they send any SSH traffic Denied access to the WLAN for a period of time if they send any Telnet traffic Denied access to all high-risk websites External devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.
The exhibits below show the configuration for the role.
There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example,
"medical-mobile" rule 1 is "ipv4 any any svc-dhcp permit," and rule 8 is "ipv4 any any any permit".)
- A. In the "medical-mobile" policy, move rules 2 and 3 between rules 7 and 8.
- B. Move the rule in the "apprf-medical-mobile-sacl" policy between rules 7 and 8 in the "medical-mobile" policy.
- C. In the "medical-mobile" policy, change the subnet mask in rule 3 to 255.255.248.0.
- D. In the "medical-mobile" policy, change the source in rule 8 to "user."
Answer: C
NEW QUESTION # 30
A customer requires a secure solution for connecting remote users to the corporate main site. You are designing a client-to-site virtual private network (VPN) based on Aruba VIA and Aruba Mobility Controllers acting as VPN Concentrators (VPNCs). Remote users will first use the VIA client to contact the VPNCs and obtain connection settings.
The users should only be allowed to receive the settings if they are the customer's "RemoteEmployees" AD group. After receiving the settings, the VIA clients will automatically establish VPN connections, authenticating to CPPM with certificates.
What should you do to help ensure that only authorized users obtain VIA connection settings?
- A. Set up the VPNCs' VIA connection profile to use one authentication profile, which is set to the AD domain controller's hostname.
- B. Set up the VPNCs' VIA web authentication profile to use CPPM as the authentication server; set up a service on CPPM that uses AD as the authentication source.
- C. Set up the VPNCs' VIA web authentication profile to use an AD domain controller as the LDAP server.
- D. Set up the VPNCs' VIA connection profile to use two authentication profiles, one RADIUS profile to CPPM and one LDAP profile to AD.
Answer: B
Explanation:
Explanation
The VIA web authentication profile is used to authenticate the users who want to download the VIA connection settings from the VPNCs. The VPNCs can use either an internal database or an external server (such as RADIUS or LDAP) as the authentication source for this profile. To ensure that only authorized users obtain VIA connection settings, you should use CPPM as the external server and configure a service on CPPM that uses AD as the authentication source. This way, you can leverage the role mapping and enforcement features of CPPM to check if the users belong to the "RemoteEmployees" AD group and grant or deny them access accordingly1 The other options are not correct because they do not allow you to verify the users' AD group membership before providing them with VIA connection settings. Option B would only check the users' credentials against AD, but not their group membership. Option C would only apply to the VPN connection phase, not the VIA connection settings phase. Option D would not work because the VPNCs do not support LDAP as an authentication source for VIA connection profiles2
NEW QUESTION # 31
......
HPE6-A84 exam questions from Actual4test dumps: https://www.actual4test.com/HPE6-A84_examcollection.html (60 Q&As)
Free 2023 HP ACA - Network Security HPE6-A84 dumps are available on Google Drive shared by Actual4test: https://drive.google.com/open?id=1E1LGawwBQqr0xDbScNtlMRqAFtuQ6J4R