2024 Realistic HPE6-A84 Dumps Questions To Gain Brilliant Result [Q21-Q41]

Rate this post

2024 Realistic HPE6-A84 Dumps Questions To Gain Brilliant Result

Start your HPE6-A84 Exam Questions Preparation with Updated 60 Questions

HP HPE6-A84 certification exam is a comprehensive exam that tests the knowledge and skills of individuals seeking to become an Aruba Certified Network Security Expert. HPE6-A84 exam covers a range of topics related to network security and is designed to validate the expertise of professionals who wish to work with Aruba products and solutions.

NO.21 Refer to the exhibit.

You have been given this certificate to install on a ClearPass server for the RADIUS/EAP and RadSec usages.
What is one issue?

The certificate has a wildcard in the subject common name.

The certificate uses a fully qualified the ‘.local” domain name.

The certificate does not have a URI subject alternative name

The certificate does not have an IP subject alternative name

NO.22 You are setting up Aruba ClearPass Policy Manager (CPPM) to enforce EAP-TLS authentication with Active Directory as the authentication source. The company wants to prevent users with disabled accounts from connecting even if those users still have valid certificates.
As the first part of meeting these criteria, what should you do to enable CPPM to determine where accounts are enabled in AD or not?

Add an Endpoint Context Server to the domain controller with actions for querying the domain controller for account status.

Enable OCSP in the EAP-TLS authentication method settings and configure an OCSP override to the domain controller FQDN.

Add a custom attribute for userAccountControl to the filters in the AD authentication source.

Install a Microsoft Active Directory extension in Aruba ClearPass Guest and set up an HTTP authentication source that points to that extension.

NO.23 A customer wants CPPM to authenticate non-802.1X-capable devices. An admin has created the service shown in the exhibits below:

What is one recommendation to improve security?

Adding an enforcement policy rule that denies access to endpoints with the Conflict flaq

Using Active Directory as the authentication source

Creating and using a custom MAC-Auth authentication method

Enabling caching of posture and roles

NO.24 Refer to the exhibit.

You have been given this certificate to install on a ClearPass server for the RADIUS/EAP and RadSec usages.
What is one issue?

The certificate has a wildcard in the subject common name.

The certificate uses a fully qualified the ‘.local” domain name.

The certificate does not have a URI subject alternative name

The certificate does not have an IP subject alternative name

NO.25 A customer has an AOS 10-based solution, including Aruba APs. The customer wants to use Cloud Auth to authenticate non-802.1X capable IoT devices.
What is a prerequisite for setting up the device role mappings?

Configuring a NetConductor-based fabric

Configuring Device Insight (client profile) tags in Central

Integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight

Creating global role-to-role firewall policies in Central

NO.26 Refer to the scenario.
A customer requires these rights for clients in the “medical-mobile” AOS firewall role on Aruba Mobility Controllers (MCs):
Permitted to receive IP addresses with DHCP
Permitted access to DNS services from 10.8.9.7 and no other server
Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22 Denied access to other 10.0.0.0/8 subnets Permitted access to the Internet Denied access to the WLAN for a period of time if they send any SSH traffic Denied access to the WLAN for a period of time if they send any Telnet traffic Denied access to all high-risk websites External devices should not be permitted to initiate sessions with “medical-mobile” clients, only send return traffic.
The exhibits below show the configuration for the role.

There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example,
“medical-mobile” rule 1 is “ipv4 any any svc-dhcp permit,” and rule 8 is “ipv4 any any any permit”.)

In the “medical-mobile” policy, move rules 2 and 3 between rules 7 and 8.

In the “medical-mobile” policy, change the subnet mask in rule 3 to 255.255.248.0.

Move the rule in the “apprf-medical-mobile-sacl” policy between rules 7 and 8 in the “medical-mobile” policy.

In the “medical-mobile” policy, change the source in rule 8 to “user.”

NO.27 Refer to the scenario.
# Introduction to the customer
You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.
The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients.
The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.
# Requirements for issuing certificates to mobile clients
The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.
The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.
# Requirements for authenticating clients
The customer requires all types of clients to connect and authenticate on the same corporate SSID.
The company wants CPPM to use these authentication methods:
EAP-TLS to authenticate users on mobile clients registered in Intune
TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:
Their certificate is valid and is not revoked, as validated by OCSP
The client’s username matches an account in AD
# Requirements for assigning clients to roles
After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:
Clients with certificates issued by Onboard are assigned the “mobile-onboarded” role Clients that have passed TEAP Method 1 are assigned the “domain-computer” role Clients in the AD group “Medical” are assigned the “medical-staff” role Clients in the AD group “Reception” are assigned to the “reception-staff” role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:
Assign medical staff on mobile-onboarded clients to the “medical-mobile” firewall role Assign other mobile-onboarded clients to the “mobile-other” firewall role Assign medical staff on domain computers to the “medical-domain” firewall role All reception staff on domain computers to the “reception-domain” firewall role All domain computers with no valid user logged in to the “computer-only” firewall role Deny other clients access
# Other requirements
Communications between ClearPass servers and on-prem AD domain controllers must be encrypted.
# Network topology
For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.

# ClearPass cluster IP addressing and hostnames
A customer’s ClearPass cluster has these IP addresses:
Publisher = 10.47.47.5
Subscriber 1 = 10.47.47.6
Subscriber 2 = 10.47.47.7
Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8
The customer’s DNS server has these entries
cp.acnsxtest.com = 10.47.47.5
cps1.acnsxtest.com = 10.47.47.6
cps2.acnsxtest.com = 10.47.47.7
radius.acnsxtest.com = 10.47.47.8
onboard.acnsxtest.com = 10.47.47.8
The customer has now decided that it needs CPPM to assign certain mobile-onboarded devices to a
“nurse-call” AOS user role. These are mobile-onboarded devices that are communicating with IP address
10.1.18.12 using port 4343.
What are the prerequisites for fulfilling this requirement?

Setting up traffic classes and role mapping rules within Central’s global settings

Creating server-based role assignment rules on APs that apply roles to clients based on traffic destinations

Creating server-based role assignment rules on gateways that apply roles to clients based on traffic destinations

Creating a tag on Central to select the proper destination connection and integrating CPPM with Device Insight

NO.28 Refer to the scenario.
A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).
Switches are using local port-access policies.
The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the “eth-internet” role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.
The plan for the enforcement policy and profiles is shown below:

The gateway cluster has two gateways with these IP addresses:
* Gateway 1
o VLAN 4085 (system IP) = 10.20.4.21
o VLAN 20 (users) = 10.20.20.1
o VLAN 4094 (WAN) = 198.51.100.14
* Gateway 2
o VLAN 4085 (system IP) = 10.20.4.22
o VLAN 20 (users) = 10.20.20.2
o VLAN 4094 (WAN) = 198.51.100.12
* VRRP on VLAN 20 = 10.20.20.254
The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.
You are setting up the UBT zone on an AOS-CX switch.
Which IP addresses should you define in the zone?

Primary controller = 10.20.4.21; backup controller = 10.20.4.22

[Primary controller = 198.51.100.14; backup controller = 10.20.4.21

Primary controller = 10 20 4 21: backup controller not defined

Primary controller = 10.20.20.254; backup controller, not defined

NO.29 Which element helps to lay the foundation for solid network security forensics?

Enable BPDU protection and loop protection on edqe switch ports

Enabling debug-level information for network infrastructure device logs

Implementing 802.1X authentication on switch ports that connect to APs

Ensuring that all network devices use a correct, consistent clock

NO.30 Refer to the exhibit.

Which security issue is possibly indicated by this traffic capture?

An attempt at a DoS attack by a device acting as an unauthorized DNS server

A port scan being run on the 10.1.7.0/24 subnet

A command and control channel established with DNS tunneling

An ARP poisoning or man-in-the-middle attempt by the device at 94:60:d5:bf:36:40

NO.31 A customer has an AOS 10 architecture, consisting of Aruba AP and AOS-CX switches, managed by Aruba Central. The customer wants to obtain information about the clients, such as their general category and OS.
What should you explain?

The customer must deploy Aruba gateways in order to receive any client profiling information.

You will need to set up Aruba Central as a secondary IP helper for client VLANs, but this will not interfere with existing operations.

Aruba Central will automatically derive this information using telemetry from the Aruba devices.

The customer should set up a dedicated switch VSX group to sniff packets and direct them to Aruba Central.

NO.32 Refer to the scenario.
A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).
The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).
The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients’ privileges, ClearPass also should use information collected by Intune to make access control decisions.
The customer wants you to configure CPPM to collect information from Intune on demand during the authentication process.
What should you tell the Intune admins about the certificates issued to clients?

They must be issued by a well-known, trusted CA.

They must include the Intune ID in the subject name.

They must include the client MAC address in the subject name.

They must be issued by a ClearPass Onboard CA.

NO.33 You want to use Device Insight tags as conditions within CPPM role mapping or enforcement policy rules.
What guidelines should you follow?

Create an HTTP authentication source to the Central API that queries for the tags. To use that source as the type for rule conditions, add it an authorization source for the service in question.

Use the Application type for the rule conditions; no extra authorization source is required for services that use policies with these rules.

Use the Endpoints Repository type for the rule conditions; Add Endpoints Repository as a secondary authentication source for services that use policies with these rules.

Use the Endpoint type for the rule conditions; no extra authorization source is required for services that use policies with these rules.

NO.34 Refer to the exhibit.

Which security issue is possibly indicated by this traffic capture?

An attempt at a DoS attack by a device acting as an unauthorized DNS server

A port scan being run on the 10.1.7.0/24 subnet

A command and control channel established with DNS tunneling

An ARP poisoning or man-in-the-middle attempt by the device at 94:60:d5:bf:36:40

NO.35 A company has Aruba gateways that are Implementing gateway IDS/IPS in IDS mode. The customer complains that admins are receiving too frequent of repeat email notifications for the same threat. The threat itself might be one that the admins should investigate, but the customer does not want the email notification to repeat as often.
Which setting should you adjust in Aruba Central?

Report scheduling settings

Alert duration and threshold settings

The IDS policy setting (strict, medium, or lenient)

The allowlist settings in the IDS policy

NO.36 A company has Aruba gateways and wants to start implementing gateway IDS/IPS. The customer has selected Block for the Fail Strategy.
What might you recommend to help minimize unexpected outages caused by using this particular fall strategy?

Configuring a relatively high threshold for the gateway threat count alerts

Making sure that the gateways have formed a cluster and operate in default gateway mode

Setting the IDS or IPS policy to the least restrictive option, Lenient

Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors

Explanation
The correct answer is D. Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors.
Gateway IDS/IPS is a feature that allows the Aruba gateways to monitor and block malicious or unwanted traffic based on predefined or custom rules 1. The Fail Strategy is a setting that determines how the gateways handle traffic when the IPS engine fails or crashes 2. The Block option means that the gateways will stop forwarding traffic until the IPS engine recovers, while the Bypass option means that the gateways will continue forwarding traffic without inspection 2.
The Block option provides more security, but it also increases the risk of network outages if the IPS engine fails frequently or for a long time 2. To minimize this risk, it is recommended to enable alerts and email notifications for events related to gateway IPS engine utilization and errors 3. This way, the network administrators can be informed of any issues with the IPS engine and take appropriate actions to restore or troubleshoot it 3.
The other options are not correct or relevant for this issue:
Option A is not correct because configuring a relatively high threshold for the gateway threat count alerts would not help minimize unexpected outages caused by using the Block option. The gateway threat count alerts are used to notify the network administrators of the number of threats detected by the IPS engine, but they do not affect how the gateways handle traffic when the IPS engine fails 4.
Option B is not correct because making sure that the gateways have formed a cluster and operate in default gateway mode would not help minimize unexpected outages caused by using the Block option.
The gateway cluster mode is used to provide high availability and load balancing for the gateways, but it does not affect how the gateways handle traffic when the IPS engine fails . The default gateway mode is used to enable routing and NAT functions on the gateways, but it does not affect how the gateways handle traffic when the IPS engine fails .
Option C is not correct because setting the IDS or IPS policy to the least restrictive option, Lenient, would not help minimize unexpected outages caused by using the Block option. The IDS or IPS policy is used to define what rules are applied by the IPS engine to inspect and block traffic, but it does not affect how the gateways handle traffic when the IPS engine fails 2. The Lenient option contains fewer and older rules than the Moderate or Strict options, which means that it provides less security and more false negatives .

NO.37 Several AOS-CX switches are responding to SNMPv2 GET requests for the public community. The customer only permits SNMPv3. You have asked a network admin to fix this problem. The admin says, “I tried to remove the community, but the CLI output an error.” What should you recommend to remediate the vulnerability and meet the customer’s requirements?

Enabling control plane policing to automatically drop SNMP GET requests

Setting the snmp-server settings to “snmpv3-only”

Adding an SNMP community with a long random name

Enabling SNMPv3, which implicitly disables SNMPv1/v2

Explanation
This is because SNMPv3 is a secure version of SNMP that provides authentication, encryption, and access control for network management. SNMPv3-only is a configuration option on AOS-CX switches that disables SNMPv1 and SNMPv2c, which are insecure versions of SNMP that use plain text community strings for authentication. By setting the snmp-server settings to “snmpv3-only”, the switch will only respond to SNMPv3 requests and reject any SNMPv1 or SNMPv2c requests, thus remedying the vulnerability and meeting the customer’s requirements.
A: Enabling control plane policing to automatically drop SNMP GET requests. This is not a valid recommendation because control plane policing is a feature that protects the switch from denial-of-service (DoS) attacks by limiting the rate of traffic sent to the CPU. Control plane policing does not disable SNMPv1 or SNMPv2c, but rather applies a rate limit to all SNMP requests, regardless of the version. Moreover, control plane policing might also drop legitimate SNMP requests if they exceed the rate limit, which could affect the network management.
C: Adding an SNMP community with a long random name. This is not a valid recommendation because an SNMP community is a shared secret that acts as a password for accessing network devices using SNMPv1 or SNMPv2c. Adding an SNMP community with a long random name does not disable SNMPv1 or SNMPv2c, but rather creates another community string that can be used for authentication. Moreover, adding an SNMP community with a long random name does not improve the security of SNMPv1 or SNMPv2c, as the community string is still transmitted in plain text and can be intercepted by an attacker.
D: Enabling SNMPv3, which implicitly disables SNMPv1/v2. This is not a valid recommendation because enabling SNMPv3 does not implicitly disable SNMPv1 or SNMPv2c on AOS-CX switches. Enabling SNMPv3 only adds support for the secure version of SNMP, but does not remove support for the insecure versions. Therefore, enabling SNMPv3 alone does not remedy the vulnerability or meet the customer’s requirements.

NO.38 You are reviewing an endpoint entry in ClearPass Policy Manager (CPPM) Endpoints Repository.
What is a good sign that someone has been trying to gain unauthorized access to the network?

The entry shows multiple DHCP options under the fingerprints.

The entry shows an Unknown status.

The entry shows a profile conflict of having a new profile of Computer for a profiled Printer.

The entry lacks a hostname or includes a hostname with long seemingly random characters.

NO.39 Refer to the scenario.
A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).
The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).
The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients’ privileges, ClearPass also should use information collected by Intune to make access control decisions.
Assume that the Azure AD deployment has the proper prerequisites established.
You are planning the CPPM authentication source that you will reference as the authentication source in
802.1X services.
How should you set up this authentication source?

As Kerberos type

As Active Directory type

As HTTP type, referencing the Intune extension

AS HTTP type, referencing Azure AD’s FODN

NO.40 You are working with a developer to design a custom NAE script for a customer. The NAE agent should trigger an alert when ARP inspection drops packets on a VLAN. The customer wants the admins to be able to select the correct VLAN ID for the agent to monitor when they create the agent.
What should you tell the developer to do?

Use this variable, %{vlan-id} when defining the monitor URI in the NAE agent script.

Define a VLAN ID parameter; reference that parameter when defining the monitor URI.

Create multiple monitors within the script from which admins can select when they create the agent.

Use a callback action to collect the ID of the VLAN on which admins have enabled NAE monitoring.

NO.41 Refer to the scenario.
# Introduction to the customer
You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.
The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.

The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients.
The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.
# Requirements for issuing certificates to mobile clients
The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.
The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.
# Requirements for authenticating clients
The customer requires all types of clients to connect and authenticate on the same corporate SSID.
The company wants CPPM to use these authentication methods:
* EAP-TLS to authenticate users on mobile clients registered in Intune
* TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:
Their certificate is valid and is not revoked, as validated by OCSP
The client’s username matches an account in AD
# Requirements for assigning clients to roles
After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:
* Clients with certificates issued by Onboard are assigned the “mobile-onboarded” role
* Clients that have passed TEAP Method 1 are assigned the “domain-computer” role Clients in the AD group “Medical” are assigned the “medical-staff” role Clients in the AD group “Reception” are assigned to the “reception-staff” role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:
* Assign medical staff on mobile-onboarded clients to the “medical-mobile” firewall role
* Assign other mobile-onboarded clients to the “mobile-other” firewall role
* Assign medical staff on domain computers to the “medical-domain” firewall role
* All reception staff on domain computers to the “reception-domain” firewall role
* All domain computers with no valid user logged in to the “computer-only” firewall role
* Deny other clients access
# Other requirements
Communications between ClearPass servers and on-prem AD domain controllers must be encrypted.
# Network topology
For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.

# ClearPass cluster IP addressing and hostnames
A customer’s ClearPass cluster has these IP addresses:
* Publisher = 10.47.47.5
* Subscriber 1 = 10.47.47.6
* Subscriber 2 = 10.47.47.7
* Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8
The customer’s DNS server has these entries
* cp.acnsxtest.com = 10.47.47.5
* cps1.acnsxtest.com = 10.47.47.6
* cps2.acnsxtest.com = 10.47.47.7
* radius.acnsxtest.com = 10.47.47.8
* onboard.acnsxtest.com = 10.47.47.8
On CPPM, you are creating the authentication method shown in the exhibit below:

You will use the method for standalone EAP-TLS and for inner methods in TEAP.
What should you do?

Configure OCSP override and set the OCSP URL to localhost/onboard/mdps ocspphp/2

Enable certificate comparison.

Enable authorization.

Configure OCSP override and leave the OCSP URL blank.

HP HPE6-A84 exam is a written test that requires candidates to answer 60 multiple-choice questions in 90 minutes. HPE6-A84 exam is administered by Pearson VUE, a leading testing and assessment company, and is available in multiple languages worldwide. Candidates who pass the exam receive the Aruba Certified Network Security Expert (ACNSE) certification, which is recognized as a globally respected credential in the field of network security. Aruba Certified Network Security Expert Written Exam certification validates the candidate’s ability to design, configure, and troubleshoot complex security solutions on Aruba Networks.

Easy Success HP HPE6-A84 Exam in First Try: https://www.examcost.com/HPE6-A84-practice-exam.html