Exam2pass > HP > HP Certifications > HPE6-A84 > HPE6-A84 Online Practice Questions and Answers

HPE6-A84 Online Practice Questions and Answers

Questions 4

You want to use Device Insight tags as conditions within CPPM role mapping or enforcement policy rules.

What guidelines should you follow?

A. Create an HTTP authentication source to the Central API that queries for the tags. To use that source as the type for rule conditions, add it an authorization source for the service in question.

B. Use the Application type for the rule conditions; no extra authorization source is required for services that use policies with these rules.

C. Use the Endpoints Repository type for the rule conditions; Add Endpoints Repository as a secondary authentication source for services that use policies with these rules.

D. Use the Endpoint type for the rule conditions; no extra authorization source is required for services that use policies with these rules.

Buy Now

Questions 5

Refer to the scenario.

A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):

Permitted to receive IP addresses with DHCP

Permitted access to DNS services from 10.8.9.7 and no other server

Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22

Denied access to other 10.0.0.0/8 subnets

Permitted access to the Internet

Denied access to the WLAN for a period of time if they send any SSH traffic

Denied access to the WLAN for a period of time if they send any Telnet traffic

Denied access to all high-risk websites

External devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.

The exhibits below show the configuration for the role.

What setting not shown in the exhibit must you check to ensure that the requirements of the scenario are met?

A. That denylisting is enabled globally on the MCs' firewalls

B. That stateful handling of traffic is enabled globally on the MCs' firewalls and on the medical-mobile role.

C. That AppRF and WebCC are enabled globally and on the medical-mobile role

D. That the MCs are assigned RF Protect licenses

Buy Now

Questions 6

A customer wants CPPM to authenticate non-802.1X-capable devices. An admin has created the service shown in the exhibits below: What is one recommendation to improve security?

A. Adding an enforcement policy rule that denies access to endpoints with the Conflict flaq

B. Using Active Directory as the authentication source

C. Creating and using a custom MAC-Auth authentication method

D. Enabling caching of posture and roles

Buy Now

Questions 7

Refer to the exhibit.

Aruba ClearPass Policy Manager (CPPM) is using the settings shown in the exhibit. You reference the tag shown in the exhibit in enforcement policies related to NASes of several types, including Aruba APs, Aruba gateways, and AOS-CX switches.

What should you do to ensure that clients are reclassified and receive the correct treatment based on the tag?

A. Change the RADIUS action to [Aruba Wireless -Terminate Session] which is supported by all the NASes in question.

B. Change the RADIUS action to [Aruba Wireless - Bounce Switch Port] which is supported by all the NASes in question.

C. Enable profiling in each service using one of these enforcement profiles. Set the profiling action to the correct one for the NASes using that service.

D. Set the Tags Update Action to No Action. Then instead enable the RADIUS CoAs using enforcement profiles in the rules that match clients with the tag shown in the exhibit.

Buy Now

Questions 8

A customer has an AOS 10 architecture, consisting of Aruba AP and AOS-CX switches, managed by Aruba Central. The customer wants to obtain information about the clients, such as their general category and OS. What should you explain?

A. The customer must deploy Aruba gateways in order to receive any client profiling information.

B. You will need to set up Aruba Central as a secondary IP helper for client VLANs, but this will not interfere with existing operations.

C. Aruba Central will automatically derive this information using telemetry from the Aruba devices.

D. The customer should set up a dedicated switch VSX group to sniff packets and direct them to Aruba Central.

Buy Now

Questions 9

Refer to the scenario.

# Introduction to the customer

You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is

shown here.

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.

# Requirements for issuing certificates to mobile clients

The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be

provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.

The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.

# Requirements for authenticating clients

The customer requires all types of clients to connect and authenticate on the same corporate SSID.

The company wants CPPM to use these authentication methods:

EAP-TLS to authenticate users on mobile clients registered in Intune

TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:

Their certificate is valid and is not revoked, as validated by OCSP

The client's username matches an account in AD # Requirements for assigning clients to roles After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:

Clients with certificates issued by Onboard are assigned the "mobile-onboarded" role

Clients that have passed TEAP Method 1 are assigned the "domain-computer" role

Clients in the AD group "Medical" are assigned the "medical-staff" role

Clients in the AD group "Reception" are assigned to the "reception-staff" role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:

Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall role

Assign other mobile-onboarded clients to the "mobile-other" firewall role

Assign medical staff on domain computers to the "medical-domain" firewall role

All reception staff on domain computers to the "reception-domain" firewall role

All domain computers with no valid user logged in to the "computer-only" firewall role

Deny other clients access # Other requirements Communications between ClearPass servers and on-prem AD domain controllers must be encrypted. # Network topology For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not

managed by Central at this point.

# ClearPass cluster IP addressing and hostnames

A customer's ClearPass cluster has these IP addresses:

Publisher = 10.47.47.5

Subscriber 1 = 10.47.47.6

Subscriber 2 = 10.47.47.7

Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8

The customer's DNS server has these entries

cp.acnsxtest.com = 10.47.47.5

cps1.acnsxtest.com = 10.47.47.6

cps2.acnsxtest.com = 10.47.47.7

radius.acnsxtest.com = 10.47.47.8

onboard.acnsxtest.com = 10.47.47.8

The customer needs a secure way for users to enroll their new wireless clients in Intune. You are recommending a new WLAN that will provide the users with limited access for the enrollment.

You have set up captive portal for clients on this WLAN to a web page with instructions for enrolling devices. You will need to add several hostnames to the captive portal allowlist manually.

What is one of those hostnames?

A. The hostname used by ClearPass Policy ManaGer's RADIUS services

B. The ClearPass Onboard hostname referenced in an Onboard provisioninG profile

C. The ClearPass Onboard hostname referenced in Intune SCEP profiles

D. The hostname used by the on-prem domain controllers

Buy Now

Questions 10

A company has Aruba gateways and wants to start implementing gateway IDS/IPS. The customer has selected Block for the Fail Strategy.

What might you recommend to help minimize unexpected outages caused by using this particular fall strategy?

A. Configuring a relatively high threshold for the gateway threat count alerts

B. Making sure that the gateways have formed a cluster and operate in default gateway mode

C. Setting the IDS or IPS policy to the least restrictive option, Lenient

D. Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors

Buy Now

Correct Answer: D

The correct answer is D. Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors. Gateway IDS/IPS is a feature that allows the Aruba gateways to monitor and block malicious or unwanted traffic based on predefined or custom rules 1. The Fail Strategy is a setting that determines how the gateways handle traffic when the IPS engine fails or crashes 2. The Block option means that the gateways will stop forwarding traffic until the IPS engine recovers, while the Bypass option means that the gateways will continue forwarding traffic without inspection 2. The Block option provides more security, but it also increases the risk of network outages if the IPS engine fails frequently or for a long time 2. To minimize this risk, it is recommended to enable alerts and email notifications for events related to gateway IPS engine utilization and errors 3. This way, the network administrators can be informed of any issues with the IPS engine and take appropriate actions to restore or troubleshoot it 3. The other options are not correct or relevant for this issue: Option A is not correct because configuring a relatively high threshold for the gateway threat count alerts would not help minimize unexpected outages caused by using the Block option. The gateway threat count alerts are used to notify the network administrators of the number of threats detected by the IPS engine, but they do not affect how the gateways handle traffic when the IPS engine fails 4. Option B is not correct because making sure that the gateways have formed a cluster and operate in default gateway mode would not help minimize unexpected outages caused by using the Block option. The gateway cluster mode is used to provide high availability and load balancing for the gateways, but it does not affect how the gateways handle traffic when the IPS engine fails . The default gateway mode is used to enable routing and NAT functions on the gateways, but it does not affect how the gateways handle traffic when the IPS engine fails . Option C is not correct because setting the IDS or IPS policy to the least restrictive option, Lenient, would not help minimize unexpected outages caused by using the Block option. The IDS or IPS policy is used to define what rules are applied by the IPS engine to inspect and block traffic, but it does not affect how the gateways handle traffic when the IPS engine fails 2. The Lenient option contains fewer and older rules than the Moderate or Strict options, which means that it

provides less security and more false negatives .

Questions 11

How does Aruba Central handle security for site-to-site connections between AOS 10 gateways?

A. It uses an Aruba proprietary integrity and encryption technologies to secure site-to-site connections, making them resistant to zero day attacks.

B. It automatically establishes IPsec tunnels for all site-to-site (all HUBs and Branches) connections using keys securely distributed by Central.

C. It automatically steers traffic away from Internet-based connections to more secure MPLS connections to reduce encryption overhead.

D. It automatically establishes simple-to-manage and highly secure TLSv1.3 tunnels between gateways.

Buy Now

Questions 12

The customer needs a way for users to enroll new wired clients in Intune. The clients should have limited access that only lets them enroll and receive certificates. You plan to set up these rights in an AOS-CX role named "provision."

The customer's security team dictates that you must limit these clients' Internet access to only the necessary sites. Your switch software supports IPv4 and IPv6 addresses for the rules applied in the "provision" role.

What should you recommend?

A. Configuring the rules for the "provision" role with IPv6 addresses, which tend to be more stable

B. Enabling tunneling to the MCs on the "provision" role and then setting up the privileges on the MCs

C. Configuring the "provision" role as a downloadable user role (DUR) in CPPM

D. Assigning the "provision" role to a VLAN and then setting up the rules within a Layer 2 access control list (ACL)

Buy Now

Correct Answer: C

This is because a downloadable user role (DUR) is a feature that allows the switch to use a central ClearPass server to download user-roles to the switch for authenticated users12 A DUR can contain various attributes and rules that define the access level and privileges of the user, such as VLAN, ACL, PoE, reauthentication period, etc3 A DUR can also be customized and updated on the ClearPass server without requiring any changes on the switch1 A DUR can be used to create a "provision" role that allows users to enroll new wired clients in Intune. The "provision" role can have limited access that only lets them enroll and receive certificates from the Intune service. The "provision" role can also have rules that restrict the Internet access of the users to only the necessary sites, such as the Intune portal and the certificate authority. The rules can be based on IPv4 or IPv6 addresses, depending on the network configuration and preference2 A. Configuring the rules for the "provision" role with IPv6 addresses, which tend to be more stable. This is not a valid recommendation because it does not address how to create and apply the "provision" role on the switch. Moreover, IPv6 addresses do not necessarily tend to be more stable than IPv4 addresses, as both protocols have their own advantages and disadvantages4

B. Enabling tunneling to the MCs on the "provision" role and then setting up the privileges on the MCs. This is not a valid recommendation because it does not explain how to enable tunneling or what MCs are. Moreover, tunneling is a technique that encapsulates one network protocol within another, which adds complexity and overhead to the network communication5

D. Assigning the "provision" role to a VLAN and then setting up the rules within a Layer 2 access control list (ACL). This is not a valid recommendation because it does not explain how to assign a role to a VLAN or how to create a Layer 2 ACL on the switch. Moreover, a Layer 2 ACL is limited in its filtering capabilities, as it can only match on MAC addresses or Ethernet types, which might not be sufficient for restricting Internet access to specific sites

Questions 13

Refer to the scenario.

# Introduction to the customer

You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

shown here.