HPE7-A02 practice question 8 of 25

A company has HPE Aruba Networking APs running AOS-10 and managed by HPE Aruba Networking Central. The company also has AOS-CX switches. The security team wants you to capture traffic from a particular wireless client. You should capture this client's traffic over a 15 minute time period and then send the traffic to them in a PCAP file. What should you do?

Full set: 156 questions
Answer options
A: Go to the client's AP in HPE Aruba Networking Central. Use the "Security" page to run a packet capture.
B: Access the CLI for the client's AP. Set up a mirroring session between its radio and a management station running Wireshark.
C: Access the CLI for the client's AP's switch. Set up a mirroring session between the AP's port and a management station running Wireshark.
D: Go to that client in HPE Aruba Networking Central. Use the "Live Events" page to run a packet capture. Correct answer
Correct Answer:
D. Go to that client in HPE Aruba Networking Central. Use the "Live Events" page to run a packet capture.
Explanation

The most efficient and direct method to capture traffic for a specific wireless client in HPE Aruba Networking Central is to use the client-centric troubleshooting tools. The correct workflow involves navigating to the specific client's details page within Central. From there, diagnostic actions, including packet capture, can be initiated. While the tool is located under the "Tools" tab, Option D correctly identifies the starting point as the client object and places the action within the context of live troubleshooting ("Live Events" page), making it the most plausible choice among the given options.

Why Incorrect

A. This is incorrect because the "Security" page in HPE Aruba Networking Central is for managing IDS/IPS and threat events, not for initiating on-demand, client-specific packet captures.
B. Using the AP's CLI is not the standard procedure for devices managed by HPE Aruba Networking Central. Central provides a GUI-based, centralized method for such tasks, avoiding direct device access.
C. Capturing traffic on the switch port is incorrect. It would capture all traffic for the AP, not just the specific client, and would miss the 802.11 wireless frame details.

References

1. HPE Aruba Networking Central User Guide (for Central 2.5.8): In the section Monitoring and Reports > Client Details > Tools, the guide explicitly describes the packet capture utility for a specific client. It states, "The Tools tab in the client details page provides the following troubleshooting and remote management utilities for the selected client: ... Packet Capture—Allows you to capture packets for the client." This confirms the client-centric workflow is the correct approach.

2. HPE Aruba Networking Central User Guide (for Central 2.5.8): In the section Managing Devices > Access Points > Troubleshooting AP Issues > Tools Menu for APs, the guide details the packet capture utility available from the AP's context. While this is a valid method, it is less direct than starting from the client. Crucially, it confirms the tool is under the "Tools" menu, not "Security," further invalidating option A.

Scroll to Top