HPE6-A84 Practice Questions

The "Fail Strategy" setting within the Aruba Central IDS/IPS configuration dictates the gateway's behavior in the event of an IDS/IPS engine failure. The "Bypass" option configures a fail-open mechanism. This means if the inspection engine fails or is unable to process traffic for any reason, the gateway will permit the traffic to pass through without inspection. This strategy prioritizes network availability and connectivity over security inspection during a failure state, preventing the security feature from causing a network outage.

B: Allowlisting is a specific policy configuration to explicitly permit certain traffic, which is unrelated to the engine's overall failure-handling strategy.

C: The fail strategy pertains to the local IDS/IPS engine's operational status, not the gateway's external internet connectivity.

D: Decisions on which traffic to inspect (e.g., based on authentication state) are configured within the IDS/IPS policies, not by the global fail strategy setting.

1. Aruba Central Help Portal

"Configuring Security Policy for Gateways": In the section for Intrusion Detection and Prevention System (IDS/IPS)

the documentation specifies the options for "Fail Strategy". It explicitly states: "Fail Strategy—Select one of the following options if the IDS/IPS engine fails: Bypass—Allows the traffic to pass through without inspection. Block—Blocks the traffic." This directly supports that "Bypass" is chosen to permit traffic when the engine fails. (Reference: Aruba Central Help > Gateway > Configuration > Security > Intrusion Detection and Prevention).

The scenario requires the Certificate Authority (CA) certificate to be trusted for two distinct purposes. First, for validating the certificates presented by domain users and computers during 802.1X authentication, the EAP (Extensible Authentication Protocol) usage is necessary. This allows ClearPass to act as a RADIUS server and validate the client's certificate chain in EAP-TLS or PEAP-EAP-TLS.

Second, the requirement for encrypted communication between ClearPass and the domain controllers for account lookups implies the use of LDAPS (LDAP over SSL/TLS). For ClearPass to establish a secure LDAPS session, it must trust the server certificate presented by the domain controller. Enabling the AD/LDAP Server usage for the imported root CA certificate allows ClearPass to validate the domain controller's certificate.

A. Radec and Aruba infrastructure: Radsec is for secure RADIUS-to-RADIUS communication, and Aruba Infrastructure is for device management; neither is relevant for client authentication or AD lookups in this context.

C. EAP and Radsec: Radsec is incorrect. The encrypted communication is with an Active Directory domain controller (which uses LDAPS), not another RADIUS server.

D. LDAP and Aruba infrastructure: The Aruba Infrastructure usage is not required. While AD/LDAP Server usage is correct, this option pairs it with an incorrect one.

1. HPE Aruba ClearPass Policy Manager 6.9 User Guide

Page 288

"Trust List Page". This section details the certificate usages.

EAP: "Select this check box to use this certificate for EAP." This directly supports the requirement to validate client certificates.

AD/LDAP Server: "Select this check box to use this certificate for AD/LDAP Server." This supports the requirement to trust the domain controller's certificate for a secure connection.

Radsec: "Select this check box to use this certificate for Radsec." This defines Radsec for secure RADIUS proxying

which is not the scenario described.

2. HPE Aruba ClearPass Policy Manager 6.9 User Guide

Page 111

"Adding Active Directory Authentication Sources". This section describes the "Connection Security" setting for an AD authentication source.

To meet the requirement for encrypted communication

the "AD over SSL" option would be selected

which uses port 636 (LDAPS). The guide states

"To use this option

the root CA of the AD server certificate must be available in the Certificate Trust List." This confirms the need for the AD/LDAP Server usage.

The question requires identifying the correct trust usages for the imported Windows CA root certificate in ClearPass. Based on the scenario:

1. EAP Usage: The network must support TEAP with an inner EAP-TLS method for Windows domain computers and users. These clients present certificates issued by the internal Windows CA. For ClearPass to validate these client certificates during the EAP-TLS exchange, the issuing CA's root certificate must be trusted for "EAP" usage.

2. AD/LDAP Server Usage: The scenario explicitly requires that "Communications between ClearPass servers and on-prem AD domain controllers must be encrypted." This is achieved using LDAPS. The domain controllers will present their server certificates (issued by the Windows CA) to ClearPass. To establish a trusted, encrypted connection, ClearPass must validate this server certificate, which requires the "AD/LDAP Server" usage to be enabled for the Windows CA root.

B. LDAP and Aruba infrastructure: "Aruba infrastructure" is incorrect as the scenario does not state that Aruba network devices use certificates from the Windows CA for any function that ClearPass must validate.

C. Radsec and Aruba infrastructure: "Radsec" is incorrect because RadSec (RADIUS over TLS) is not mentioned as a requirement. "Aruba infrastructure" is also incorrect for the reason stated above.

D. EAP and Radsec: "Radsec" is incorrect as it is not a required communication protocol in this scenario.

1. Aruba ClearPass Policy Manager 6.9 User Guide

Page 238

"Trust List Page":

EAP: "Allows the certificate to be used for EAP-TLS

PEAP-TLS

and EAP-TTLS authentication." This directly supports the need to validate client certificates for the required TEAP/EAP-TLS method.

AD/LDAP Server: "Allows the certificate to be used for secure AD/LDAP connections." This directly supports the requirement for encrypted communication with the Active Directory domain controllers.

RadSec: "Allows the certificate to be used for RadSec connections." This confirms RadSec is a distinct usage not required by the scenario.

Aruba Infrastructure: "Allows the certificate to be used for Aruba infrastructure." This confirms it is for trusting Aruba devices

which is not a stated requirement for the Windows CA.

Cloud Authentication in Aruba Central assigns roles to clients based on a set of rules. For non-802.1X IoT devices that authenticate using their MAC address, the primary method for dynamic role assignment is device profiling. Aruba Device Insight automatically classifies clients on the network (e.g., as IP cameras, printers, etc.). Administrators can then create "Client Profile Tags" based on these classifications. These tags are used as attributes within the Cloud Authentication policy rules to map a specific type of device to a predefined user role. Therefore, configuring these tags is a necessary prerequisite for creating the role mapping rules.

A. Configuring a NetConductor-based fabric: NetConductor is an architecture for policy automation. Cloud Auth can function independently in non-fabric deployments, making this not a strict prerequisite for role mapping.

C. Integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight: Cloud Auth is a native Aruba Central feature. Integrating an external NAC like ClearPass represents an alternative solution, not a prerequisite for using Central's built-in functionality.

D. Creating global role-to-role firewall policies in Central: Firewall policies define the network access permissions after a role has been assigned. They are configured as part of the role's definition, not as a prerequisite for the mapping process itself.

1. Aruba Central User Guide: In the section on "Cloud Authentication and Policy

" the workflow for creating role assignment rules is detailed. The guide explicitly shows that "Client Profile Tags" are a selectable condition for these rules. It states

"The Cloud Authentication and Policy feature uses the device profiles from the Client Profile page and allows you to create user access policies." This confirms that profiles from Device Insight are used for role mapping. (Reference: Aruba Central Documentation > Security > Cloud Authentication and Policy > Configuring Cloud Authentication and Policy).

2. Aruba Central User Guide: The section on "Device Insight" explains how it classifies clients and how administrators can create tags. It notes that these tags can be leveraged by other services within Central

such as Cloud Authentication

for policy enforcement. (Reference: Aruba Central Documentation > Analyze > Device Insight > Managing Client Profile Tags).

Aruba Central's "Alerts & Events" monitoring dashboard is the most direct and efficient tool for this task. It provides a comprehensive, filterable log of network activities captured by the infrastructure. An administrator can quickly apply filters for the "IoT" client category (or a specific profile like "Raspberry Pi") and the "SSH" application to generate a precise list of all clients that have initiated SSH traffic. This feature is designed for exactly this type of ad-hoc operational visibility and troubleshooting.

A. Create and apply a Central client profile tag that selects the SSH application and the clients' category.

Client tags are primarily for classifying clients to enforce policies (e.g., VLAN or firewall rule assignment), not for historical searching or ad-hoc reporting of traffic flows.

B. Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information.

ClearPass accounting logs contain RADIUS session data (e.g., connection times, data transferred) but lack the application-level visibility from Deep Packet Inspection (DPI) needed to identify SSH traffic.

D. Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources.

The IDS/IPS dashboard is specifically for analyzing security threats. While it might log malicious SSH activity, it is not the appropriate tool for general visibility of all legitimate SSH traffic.

1. Aruba Central User Guide: In the "Monitoring Network Health and Activities" chapter

the "Alerts & Events" section describes the dashboard's function. It states

"The Alerts & Events dashboard provides a list of all alerts and events generated for devices

clients

and networks." The guide details the powerful filtering capabilities

which include filtering by Application

Client Category

and Client OS

directly supporting the action in option C. (Reference: Aruba Central User Guide

Monitoring > Alerts & Events section).

2. Aruba Central User Guide: The "Clients" chapter

under "Client Profiling

" explains that tags are used to "group clients that match the specified criteria" for the purpose of applying configuration profiles

such as user-based tunneling or session ACLs. This confirms tags are a policy tool

not a search tool. (Reference: Aruba Central User Guide

Clients > Client Profile section).

3. Aruba ClearPass Policy Manager User Guide: The "Live Monitoring > Accounting" section details the available RADIUS accounting data. The fields listed (e.g.

Acct-Status-Type

Framed-IP-Address

NAS-IP-Address) confirm that application-specific data like "SSH" is not part of standard accounting records. (Reference: ClearPass Policy Manager 6.x User Guide

Monitoring > Live Monitoring > Accounting).

4. Aruba Central User Guide: The "Security > IDS/IPS" chapter describes the dashboard as a tool to "monitor threats detected in the network" and view "events based on severity." This highlights its focus on security incidents rather than general traffic visibility. (Reference: Aruba Central User Guide

Security > IDS/IPS section).

The scenario requires that client certificates, including those from ClearPass Onboard, are validated for revocation via OCSP. For certificates issued by Onboard, the OCSP responder is the ClearPass server itself. To enable this, the EAP-TLS authentication method must be configured to override the default OCSP URL (from the certificate's Authority Information Access - AIA extension) and point to the internal Onboard OCSP service. Option A provides the correct action and a valid URL format, using localhost to ensure the processing ClearPass node queries its local service. This configuration is essential for validating Onboard-issued certificates as required.

B. Enable certificate comparison: This feature compares certificate attributes against other values (e.g., from an authentication source). It does not perform the required OCSP revocation check.

C. Enable authorization: This is required to validate the user against Active Directory, a separate requirement. It does not configure the OCSP check, which occurs during the authentication phase.

D. Configure OCSP override and leave the OCSP URL blank: This would cause OCSP checks for Onboard certificates to fail, as ClearPass would not know where to send the revocation status request.

1. Aruba ClearPass Policy Manager 6.11 User Guide: In the section for configuring an EAP-TLS authentication method

the guide details the "Certificate Revocation" settings. It explains the "Override OCSP URL from Certificate" option

which is necessary when the OCSP responder URL is not present in the certificate's AIA extension or needs to be overridden

as is the case for Onboard-issued certificates. It also describes the "Use OCSP only for Onboard certificates" setting

which allows this override to apply only to Onboard certificates while others use their AIA. (See Chapter: Authentication > Authentication Methods > Add Authentication Method Dialog > EAP-TLS).

2. Aruba ClearPass Onboard 6.11 Deployment Guide: This guide specifies the URL format for the Onboard Mobile Device Provisioning Service (MDPS) OCSP responder

which is https://<ClearPass FQDN>/onboard/mdpsocsp.php/. This confirms the structure of the URL provided in the correct answer

where localhost is a valid substitute for the FQDN in the local configuration. (See Chapter: Onboard Certificate Authority).

Dynamic ARP Inspection (DAI) relies on the DHCP-Snooping binding table to validate ARP packets. Aruba AOS-CX requires DHCP-Snooping to be enabled on every VLAN that is protected by DAI; otherwise no bindings exist and all ARP packets will be dropped or bypassed unverified. Because VLAN 4 lacks DHCP-Snooping, the current configuration cannot protect against ARP poisoning.

A. ARP proxy is unrelated to DAI and provides no protection against spoofed ARP packets.

B. Uplink (LAG 1) should remain trusted so that legitimate ARP traffic from upstream switches is not inspected; making it untrusted is unnecessary.

D. Interfaces are untrusted by default; edge ports do not need an explicit “untrusted” command, so their absence is not an issue.

1. Aruba AOS-CX 10.09 Security Guide

“Dynamic ARP Inspection”

p. 272-275: “DAI requires DHCP-Snooping to be enabled on the same VLAN… Without Snooping bindings

ARP validation cannot occur.”

2. Aruba AOS-CX 10.09 Security Guide

p. 273: “All interfaces are untrusted by default; use ‘arp inspection trust’ only on uplinks or to DHCP servers.”

3. Aruba AOS-CX 10.09 Command-Line Guide

“Configuring DHCP-Snooping”

p. 163: command syntax for enabling snooping per-VLAN

prerequisite for DAI.

To check the status of a user account in Active Directory (AD), ClearPass Policy Manager (CPPM) must be configured to retrieve the userAccountControl attribute during the authentication process. This is accomplished by adding this specific attribute to the filter configuration of the AD authentication source. The userAccountControl attribute is a bitmask field in AD that contains flags indicating the account's properties, including whether it is enabled or disabled. Once CPPM fetches this attribute, enforcement policies can be created to check its value and deny access to users with disabled accounts, fulfilling the requirement.

A: Endpoint Context Servers are used to gather supplementary endpoint data (e.g., from an MDM), not as the primary mechanism for user account status checks during authentication.

B: OCSP (Online Certificate Status Protocol) is used exclusively to verify the revocation status of a digital certificate, not the status of a user's account in Active Directory.

D: ClearPass Guest is the module for guest access, onboarding, and self-service portals. Core authentication source configuration for 802.1X is managed in ClearPass Policy Manager.

1. Aruba ClearPass Policy Manager 6.11 User Guide

Chapter: "Identity > Authentication > Sources"

Section: "Adding an Active Directory Authentication Source". The guide details the configuration tabs for an AD source

including the "Attributes" tab where you define the attributes to be fetched from the directory. To use userAccountControl in policies

it must first be added as an attribute to be retrieved here.

2. Aruba ClearPass Workshop v6.7 Lab Guide (Official Courseware)

Lab 4: "802.1X EAP-PEAP with Active Directory". This lab demonstrates configuring an AD authentication source and then using fetched attributes (like memberOf) in Role Mapping and Enforcement Policies. The same principle directly applies to fetching and using the userAccountControl attribute for account status checks.

3. Microsoft Active Directory Documentation

"User-Account-Control attribute". This official documentation defines the userAccountControl attribute and its bitmask values. The flag for a disabled account is ADSUFACCOUNTDISABLE with a value of 2. This confirms it is the correct attribute for CPPM to query to determine account status. (This source validates the purpose of the attribute itself).

The core issue is alert fatigue caused by the "high" Wireless Intrusion Detection System (WIDS) level, which is likely too sensitive for the specific network environment and is generating an excessive number of notifications. The most effective initial step is to tune the system. By changing the WIDS level to "custom," administrators can deselect the specific checks that are generating noise or false positives while keeping the protections for high-fidelity, critical threats enabled. This approach directly reduces the volume of irrelevant alerts without compromising the overall security posture, making the notification system manageable and useful again.

A: This is a procedural workaround that ignores the root cause. Hiding alerts increases the risk of missing a critical, time-sensitive threat and is poor security practice.

B: Disabling an entire category of threats, such as Rogue AP detection, is a drastic measure that creates a significant security gap. The problem is likely sensitivity, not the category itself.

D: These alert categories are distinct and detect different types of attacks. They do not inherently overlap, and disabling two of the three would severely weaken the WIDS protection.

1. ArubaOS 10.5.x.x User Guide: In the section on configuring Intrusion Detection System (IDS)

the guide details the different protection levels. It explains that predefined levels (Low

Medium

High) enable a set of signatures

but the "Custom" level provides granular control. This allows an administrator to enable or disable individual protection types to tailor the IDS to their specific environment

which is the standard procedure for reducing false positives and alert fatigue. (Reference: ArubaOS 10.5.x.x User Guide

Chapter: "Configuring IDS"

Section: "IDS Configuration Workflow").

2. Aruba Central Help Center - Configuring IDS: The documentation for configuring IDS within Aruba Central (which manages AOS 10) describes the process of creating and customizing IDS profiles. It explicitly shows how administrators can move from a predefined level to a custom one

where they can check or uncheck specific infrastructure and client attack detections. This functionality is designed precisely for the scenario described: tuning the system to reduce noise. (Reference: Aruba Central Help

Page: "Configuring Intrusion Detection System (IDS)").

Aruba Central automates the creation of a secure SD-WAN fabric for site-to-site connections. For traffic between AOS 10 gateways (both Hub and Branch), Central orchestrates the automatic establishment of standards-based IPsec tunnels. It acts as the central controller, securely generating and distributing the necessary cryptographic keys and security association (SA) parameters to all gateways. This automated process ensures that all inter-site traffic is encrypted and authenticated, forming a secure overlay network without manual IPsec configuration on each device.

A: Aruba's SD-WAN security is built on industry-standard IPsec, not proprietary technologies. The claim of being resistant to zero-day attacks is a general security goal, not a specific mechanism.

C: SD-WAN is designed to securely leverage all available transports, including the internet. It does not simply steer traffic to MPLS to avoid encryption; traffic is encrypted over all transports.

D: IPsec is the protocol used for establishing secure site-to-site tunnels between network gateways. TLS is typically used for securing application-layer traffic or for remote access VPNs, not gateway-to-gateway tunnels.

1. ArubaOS 10.x Fundamentals Guide (Official Courseware): In the "SD-WAN" chapter

under the "Overlay Tunnel Orchestration" section

it states

"Aruba Central automatically orchestrates IPsec tunnels between gateways in the same group... Central provides the gateways with the necessary information to build the tunnels

including IPsec crypto and keying material." (Typically found in Module 7).

2. Aruba SD-Branch Fundamentals Guide (Official Courseware): The "Overlay Tunnel Orchestration" section explains that Aruba Central automates the establishment of IPsec tunnels between Branch Gateways and VPN Concentrators (Hubs). It details that "Central is responsible for orchestrating routing and the IPsec tunnels that form the overlay." (Typically found in Chapter 1).

3. Aruba Central User Guide: In sections describing SD-WAN Overlay Configuration

the documentation details the process of "Overlay Route and Tunnel Orchestration

" which explicitly states the automatic setup of IPsec tunnels between hub and branch sites managed by Central.