HPE6-A78 practice question 24 of 25

What is a reason to set up a packet capture on an Aruba Mobility Controller (MC)?

Answer options

A: The company wants to use ClearPass Policy Manager (CPPM) to profile devices and needs to receive HTTP User-Agent strings from the MC.

B: The security team believes that a wireless endpoint connected to the MC is launching an attack and wants to examine the traffic more closely. Correct answer

C: You want the MC to analyze wireless clients' traffic at a lower level, so that the ArubaOS firewall can control the traffic I based on application.

D: You want the MC to analyze wireless clients' traffic at a lower level, so that the ArubaOS firewall can control Web traffic based on the destination URL.

Correct Answer:

B. The security team believes that a wireless endpoint connected to the MC is launching an attack and wants to examine the traffic more closely.

Explanation

Packet capture is a fundamental troubleshooting and security analysis tool that records raw network traffic for detailed inspection. When a security team suspects a device is compromised or is launching an attack, a packet capture allows them to examine the specific frames and packets being sent and received by that endpoint. This granular level of detail is essential for identifying malicious patterns, understanding the nature of an attack, and gathering evidence for forensic analysis.

Why Incorrect

A. ClearPass uses more integrated and efficient methods like RADIUS accounting or DHCP fingerprinting for profiling; a manual packet capture is not the standard procedure.
C. This describes Deep Packet Inspection (DPI), an automated feature of the ArubaOS firewall (PEF) that classifies traffic by application without manual intervention.
D. This describes Web Content Classification (WebCC), another automated firewall feature that filters web traffic based on URL and category, not a manual capture task.

References

Aruba Networks, "ArubaOS 8.10.0.0 User Guide," (December 2022), Chapter: Troubleshooting Tools, Section: Packet Capturing, p. 1083. The guide states, "The packet capturing feature allows you to capture a copy of the packets going to, from, or through the controller for monitoring and troubleshooting purposes." This supports its use for security investigations.

Aruba Networks, "ArubaOS 8.x CLI Reference Guide," details the packet-capture command, which is used for targeted traffic analysis of specific clients or interfaces, aligning with the security investigation scenario.

Keep practicing

Take the free HPE6-A78 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test