HP HPE7-A02 시험

Question No : 1

You are establishing a cluster of HPE Aruba Networking ClearPass servers. (Assume that they are running version 6.9.).
For which type of certificate it is recommended to install a CA-signed certificate on the Subscriber before it joins the cluster?

• A.Database
• B.HTTPS
• C.RADIUS/EAP
• D.RadSec

답을 확인하기

정답:
Explanation:
When establishing a cluster of HPE Aruba Networking ClearPass servers, it is recommended to install a CA-signed certificate for HTTPS on the Subscriber before it joins the cluster. This ensures secure communication between the servers in the cluster and provides a trusted certificate for client connections.

Question No : 2

A company has wired VolP phones, which transmit tagged traffic and connect to AOS-CX switches. The company wants to tunnel the phones' traffic to an HPE Aruba Networking gateway for applying security policies.
What is part of the correct configuration on the AOS-CX switches?

• A.UBT mode set to VLAN extend
• B.A VXLAN VNI mapped to the VLAN assigned to the VolP phones
• C.VLANs assigned to the VolP phones configured on the switch uplinks
• D.A UBT reserved VLAN set to a VLAN dedicated for that purpose

답을 확인하기

정답:
Explanation:
To tunnel VoIP phone traffic from AOS-CX switches to an HPE Aruba Networking gateway, you need to configure a User-Based Tunneling (UBT) reserved VLAN on the switches. This VLAN is dedicated for tunneling purposes and ensures that the VoIP traffic is correctly identified and tunneled to the gateway where security policies can be applied.

Question No : 3

Refer to Exhibit.



(Note that the HPE Aruba Networking Central interface shown here might look slightly different from what you see in your HPE Aruba Networking Central interface as versions change; however, similar concepts continue to apply.)
An HPE Aruba Networking 9x00 gateway is part of an HPE Aruba Networking Central group that has the settings shown in the exhibit.
What would cause the gateway to drop traffic as part of its IDPS settings?

• A.Its site-to-site VPN connections failing
• B.Traffic matching a rule in the active ruleset
• C.Its IDPS engine failing
• D.Traffic showing anomalous behavior

답을 확인하기

정답:
Explanation:
In the exhibit, the HPE Aruba Networking Central settings for the 9x00 gateway show that traffic inspection is enabled, and the gateway is set to operate in IDS (Intrusion Detection System) mode with the fail strategy set to "Block". This configuration means that the gateway will drop traffic if it matches a rule in the active ruleset.

Question No : 4

What is a benefit of Online Certificate Status Protocol (OCSP)?

• A.It lets a device query whether a single certificate is revoked or not.
• B.It lets a device dynamically renew its certificate before the certificate expires.
• C.It lets a device download all the serial numbers for certificates revoked by a CA at once.
• D.It lets a device determine whether to trust a certificate without needing any root certificates installed.

답을 확인하기

정답:
Explanation:
The benefit of the Online Certificate Status Protocol (OCSP) is that it allows a device to query whether a single certificate is revoked or not. OCSP provides a real-time mechanism for checking the revocation status of an individual certificate, enabling devices to verify the validity of certificates quickly and efficiently.

Question No : 5

A company has AOS-CX switches and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company wants switches to implement 802.1X authentication to CPPM and download user roles.
What is one task that you must complete on the switches to support this use case?

• A.Specify CPPM as the RADIUS server with the exact CN in CPPM's HTTPS certificate.
• B.Install the root CA certificate for CPPM's RADIUS certificate in a TA profile on the switches.
• C.Configure empty user-roles with names that match enforcement profile names on CPP
• D.Specify a ClearPass username and password that match the name and RADIUS secret in a CPPM network device entry.

답을 확인하기

정답:
Explanation:
To support 802.1X authentication and download user roles from HPE Aruba Networking ClearPass Policy Manager (CPPM) on AOS-CX switches, you must install the root CA certificate for CPPM's RADIUS certificate in a Trust Anchor (TA) profile on the switches. This ensures that the switches trust the RADIUS server certificate presented by CPPM during the authentication process.

Question No : 6

Refer to Exhibit.



A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). In the CPDI interface, you go to the Generic Devices page and see the view shown in the exhibit.
What correctly describes what you see?

• A.Each cluster is a group of unclassified devices that CPDI's machine learning has discovered to have similar attributes.
• B.Each cluster is a group of devices that match one of the tags configured by admins.
• C.Each cluster is all the devices that have been assigned to the same category by one of CPDI's built-in system rules.
• D.Each cluster is a group of devices that have been classified with user rules, but for which CPDI offers different recommendations.

답을 확인하기

정답:
Explanation:
In HPE Aruba Networking ClearPass Device Insight (CPDI), the clusters shown in the exhibit represent groups of unclassified devices that CPDI's machine learning algorithms have identified as having similar attributes. These clusters are formed based on observed characteristics and behaviors of the devices, helping administrators to categorize and manage devices more effectively.

Question No : 7

A company wants to turn on Wireless IDS/IPS infrastructure and client detection at the high level on HPE Aruba Networking APs. The company does not want to enable any prevention settings.
What should you explain about HPE Aruba Networking recommendations?

• A.HPE Aruba Networking recommends turning on both wired and wireless prevention whenever you enable detection at high.
• B.HPE Aruba Networking recommends using hybrid AP mode, as opposed to Air Monitors (AMs), when implementing detection without prevention.
• C.HPE Aruba Networking recommends disabling client detection when you configure infrastructure detection at high, as infrastructure detection includes all the client checks and more.
• D.HPE Aruba Networking recommends configuring infrastructure and client detection at a custom level and disabling or tuning some of the settings that are likely to produce false positives.

답을 확인하기

정답:
Explanation:
When enabling Wireless IDS/IPS infrastructure and client detection at a high level on HPE Aruba Networking APs without enabling prevention settings, HPE Aruba Networking recommends configuring detection at a custom level and adjusting settings to minimize false positives. This approach allows for effective monitoring while reducing the risk of unnecessary alerts and maintaining the accuracy of detections.

Question No : 8

A company has an HPE Aruba Networking ClearPass cluster with several servers.
ClearPass Policy Manager (CPPM) is set up to:
. Update client attributes based on Syslog messages from third-party appliances
. Have the clients reauthenticate and apply new profiles to the clients based on the updates
To ensure that the correct profiles apply, what is one step you should take?

• A.Configure a CoA action for all tag updates in the ClearPass Device Insight integration settings.
• B.Tune the CoA delay on the ClearPass servers to a value of 5 seconds or greater.
• C.Set the cluster's Endpoint Context Servers polling interval to a value of 5 seconds or less.
• D.Configure the cluster to periodically clean up (delete) unknown endpoints.

답을 확인하기

정답:
Explanation:
To ensure that the correct profiles apply after client attributes are updated based on Syslog messages, you should tune the Change of Authorization (CoA) delay on the ClearPass servers to a value of 5 seconds or greater. This delay allows sufficient time for the attribute updates to be processed and for the reauthentication to occur correctly, ensuring that the updated profiles are accurately applied to the clients.

Question No : 9

What is a use case for running periodic subnet scans on devices from HPE Aruba Networking ClearPass Policy Manager (CPPM)?

• A.Using DHCP fingerprints to determine a client's device category and OS
• B.Detecting devices that fail to comply with rules defined in CPPM posture policies
• C.Identifying issues with authenticating and authorizing clients
• D.Using WMI to collect additional information about Windows domain clients

답을 확인하기

정답:
Explanation:
Running periodic subnet scans on devices from HPE Aruba Networking ClearPass Policy Manager (CPPM) can be used to gather DHCP fingerprints, which help determine a client's device category and operating system. DHCP fingerprints are unique patterns in DHCP request packets that provide valuable information about the device type and OS, assisting in device profiling and policy enforcement.

Question No : 10

A company has HPE Aruba Networking APs and AOS-CX switches, as well as HPE Aruba Networking ClearPass. The company wants CPPM to have HTTP User-Agent strings to use in profiling devices.
What can you do to support these requirements?

• A.Add the CPPM server's IP address to the IP helper list in all client VLANs on routing switches.
• B.Schedule periodic subnet scans of all client subnets on CPP
• C.Configure mirror sessions on the APs and switches to copy client HTTP traffic to CPP
• D.On the APs and switches, configure a redirect to ClearPass Guest in the role for devices being profiled.

답을 확인하기

정답:
Explanation:
To support the requirement for HPE Aruba Networking ClearPass Policy Manager (CPPM) to have HTTP User-Agent strings for profiling devices, you should add the CPPM server's IP address to the IP helper list in all client VLANs on routing switches. This configuration ensures that DHCP requests and other relevant client traffic are forwarded to CPPM, allowing it to capture HTTP User-Agent strings and use them for device profiling.

Question No : 11

A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) and HPE Aruba Networking ClearPass Device Insight (CPDI) and has integrated the two. CPDI admins have created a tag. CPPM admins have created rules that use that tag in the wired 802.1X and wireless 802.1X services' enforcement policies.
The company requires CPPM to apply the tag-based rules to a client directly after it learns that the client has that tag.
What is one of the settings that you should verify on CPPM?

• A.The "Device Sync" setting is set to 1 in the ClearPass Device Insight Integration settings.
• B.Both 802.1X services have the "Profile Endpoints" option enabled and an appropriate CoA profile selected in the Profiler tab.
• C.Both 802.1X services have the "Use cached Role and Posture attributes from the previous sessions" setting.
• D.The "Polling Interval" is set to 1 in the ClearPass Device Insight Integration settings.

답을 확인하기

정답:
Explanation:
To ensure that HPE Aruba Networking ClearPass Policy Manager (CPPM) applies tag-based rules to a client immediately after learning the client has that tag, verify that both 802.1X services have the "Profile Endpoints" option enabled and an appropriate Change of Authorization (CoA) profile selected in the Profiler tab. This setup ensures that when a device is profiled and tagged, CPPM can immediately enforce the updated policies through CoA.

Question No : 12

You have installed an HPE Aruba Networking Network Analytic Engine (NAE) script on an AOS-CX switch to monitor a particular function.
Which additional step must you complete to start the monitoring?

• A.Reboot the switch.
• B.Enable NAE, which is disabled by default.
• C.Edit the script to define monitor parameters.
• D.Create an agent from the script.

답을 확인하기

정답:
Explanation:
After installing an HPE Aruba Networking Network Analytic Engine (NAE) script on an AOS-CX switch, the additional step required to start the monitoring is to create an agent from the script. The agent is responsible for executing the script and collecting the monitoring data as defined by the script parameters.

Question No : 13

A company needs you to integrate HPE Aruba Networking ClearPass Policy Manager (CPPM) with HPE Aruba Networking ClearPass Device Insight (CPDI).
What is one task you should do to prepare?

• A.Install the root CA for CPPM's HTTPS certificate as trusted in the CPDI application.
• B.Configure WMI, SSH, and SNMP external accounts for device scanning on CPP
• C.Enable Insight in the CPPM server configuration settings.
• D.Collect a Data Collector token from HPE Aruba Networking Central.

답을 확인하기

정답:
Explanation:
To integrate HPE Aruba Networking ClearPass Policy Manager (CPPM) with HPE Aruba Networking ClearPass Device Insight (CPDI), one of the necessary tasks is to enable Insight in the CPPM server configuration settings. This configuration allows CPPM to communicate and share data with CPDI, facilitating the integration and enabling enhanced device profiling and policy enforcement capabilities.

Question No : 14

You are using OpenSSL to obtain a certificate signed by a Certification Authority (CA).
You have entered this command:
openssl req -new -out file1.pem -newkey rsa:3072 -keyout file2.pem Enter PEM pass phrase: **********
Verifying - Enter PEM pass phrase: **********
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]: California
Locality Name (eg, city) []: Sunnyvale
Organization Name (eg, company) [Internet Widgits Pty Ltd]: example.com
Organizational Unit Name (eg, section) []:Infrastructure
Common Name (e.g. server FQDN or YOUR name) []: radius.example.com
What is one guideline for continuing to obtain a certificate?
A. You should use a third-party tool to encrypt file2.pem before sending it and file1.pem to the CA.
B. You should concatenate file1.pem and file2.pem into a single file, and submit that to the desired CA to sign.
C. You should submit file1.pem, but not file2.pem, to the desired CA to sign.
D. You should submit file2.pem, but not file1.pem, to the desired CA to sign.

답을 확인하기

정답: C
Explanation:
When using OpenSSL to obtain a certificate signed by a Certification Authority (CA), you should submit the Certificate Signing Request (CSR) file, which is file1.pem, to the CA. The CSR contains the information about the entity requesting the certificate and the public key, but not the private key, which is in file2.pem. The CA uses the information in the CSR to create and sign the certificate.

Question No : 15

You need to create a rule in an HPE Aruba Networking ClearPass Policy Manager (CPPM) role mapping policy that references a ClearPass Device Insight Tag.
Which Type (namespace) should you specify for the rule?

• A.Application
• B.Tips
• C.Device
• D.Endpoint

답을 확인하기

정답:
Explanation:
When creating a rule in an HPE Aruba Networking ClearPass Policy Manager (CPPM) role mapping policy that references a ClearPass Device Insight Tag, you should specify the "Endpoint" Type (namespace) for the rule. This ensures that the policy can properly reference and utilize the tags assigned to endpoints by ClearPass Device Insight for making role mapping decisions.