Pass4Test 10%OFF Discount Code

HP Aruba Certified Network Security Associate - HPE6-A78 Exam Questions

QUESTION NO: 1
This company has AOS-CX switches. The exhibit shows one access layer switch, Switch-2, as an example, but the campus actually has more switches. Switch-1 is a core switch that acts as the default router for end-user devices.
What is a correct way to configure the switches to protect against exploits from untrusted end-user devices?

A. On Switch-2, enable DHCP snooping globally and on VLANs 15 and 25. Later, enable ARP inspection on the same VLANs. B. On Switch-1, enable ARP inspection on VLAN 100 and DHCP snooping on VLANs 15 and 25. C. On Switch-1, enable DHCP snooping on VLAN 100 and ARP inspection on VLANs 15 and 25. D. On Switch-2, enable BPDU filtering on all edge ports in order to prevent eavesdropping attacks by untrusted devices.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
You are configuring ArubaOS-CX switches to tunnel client traffic to an Aruba Mobility Controller (MC). What should you do to enhance security for control channel communications between the switches and the MC?

A. Make sure that the UBT client vlan is assigned to the interface on which the switches reach the MC and only that interface. B. install certificates on the switches, and make sure that CPsec is enabled on the MC C. Configure a long, random PAPI security key that matches on the switches and the MC. D. Create one UBT zone for control traffic and a second UBT zone for clients.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
How can hackers implement a man-in-the-middle (MITM) attack against a wireless client?

A. The hacker connects a device to the same wireless network as the client and responds to the client's ARP requests with the hacker device's MAC address. B. The hacker uses a combination of software and hardware to jam the RF band and prevent the client from connecting to any wireless networks. C. The hacker runs an NMap scan on the wireless client to find its MAC and IP address. The hacker then connects to another network and spoofs those addresses. D. The hacker uses spear-phishing to probe for the IP addresses that the client is attempting to reach. The hacker device then spoofs those IP addresses.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
What is an example or phishing?

A. An attacker lures clients to connect to a software-based AP that is using a legitimate SSID. B. An attacker sends TCP messages to many different ports to discover which ports are open. C. An attacker sends emails posing as a service team member to get users to disclose their passwords. D. An attacker checks a user's password by using trying millions of potential passwords.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
Which correctly describes one of HPE Aruba Networking ClearPass Policy Manager's (CPPM's) device profiling methods?

A. CPPM can analyze settings such as TCP/UDP ports used for HTTP, DHCP, and DNS in endpoints' traffic to fingerprint the OS. B. CPPM can use Wireshark to actively probe devices, analyze their traffic patterns, and construct an endpoint profile. C. CPPM can analyze settings such as TTL and time window size in endpoints' TCP traffic in order to fingerprint the OS. D. CPPM can use SNMP to configure Aruba switches and mobility devices to mirror client traffic to CPPM for analysis.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Refer to the exhibit.

A diem is connected to an ArubaOS Mobility Controller. The exhibit snows all Tour firewall rules that apply to this diem What correctly describes how the controller treats HTTPS packets to these two IP addresses, both of which are on the other side of the firewall
10.1 10.10
203.0.13.5

A. It drops both of the packets B. It drops the packet to 10.1.10.10 and permits the packet to 203.0.13.5. C. It permits the packet to 10.1.10.10 and drops the packet to 203 0.13.5 D. it permits both of the packets

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
What is one of the roles of the network access server (NAS) in the AAA framework?

A. It negotiates with each user's device to determine which EAP method is used for authentication. B. It enforces access to network services and sends accounting information to the AAA server. C. It determines which resources authenticated users are allowed to access and monitors each user's session. D. It authenticates legitimate users and uses policies to determine which resources each user is allowed to access.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
A company has an AOS controller-based solution with a WPA3-Enterprise WLAN, which authenticates wireless clients to HPE Aruba Networking ClearPass Policy Manager (CPPM). The company has decided to use digital certificates for authentication. A user's Windows domain computer has had certificates installed on it. However, the Networks and Connections window shows that authentication has failed for the user. The Mobility Controller's (MC's) RADIUS events show that it is receiving Access-Rejects for the authentication attempt.
What is one place that you can look for deeper insight into why this authentication attempt is failing?

A. The Alerts tab in the authentication record in CPPM Access Tracker B. The reports generated by HPE Aruba Networking ClearPass Insight C. The packets captured on the MC control plane destined to UDP 1812 D. The RADIUS events within the CPPM Event Viewer

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
A company with 439 employees wants to deploy an open WLAN for guests. The company wants the experience to be as follows:
* Guests select the WLAN and connect without having to enter a password.
* Guests are redirected to a welcome web page and log in.
The company also wants to provide encryption for the network for devices that are capable. Which security options should you implement for the WLAN?

A. Captive portal and WPA3-Personal B. WPA3-Personal and MAC-Auth C. Captive portal and Opportunistic Wireless Encryption (OWE) in transition mode D. Opportunistic Wireless Encryption (OWE) and WPA3-Personal

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
You have a network with AOS-CX switches for which HPE Aruba Networking ClearPass Policy Manager (CPPM) acts as the TACACS+ server. When an admin authenticates, CPPM sends a response with:
Aruba-Priv-Admin-User = 1
TACACS+ privilege level = 15
What happens to the user?

A. The user receives operators access. B. The user receives administrators access. C. The user receives auditors access. D. The user receives no access.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 11
Refer to the exhibit, which shows the current network topology.

You are deploying a new wireless solution with an Aruba Mobility Master (MM). Aruba Mobility Controllers (MCs). and campus APs (CAPs). The solution will Include a WLAN that uses Tunnel for the forwarding mode and Implements WPA3-Enterprise security What is a guideline for setting up the vlan for wireless devices connected to the WLAN?

A. Assign the WLAN to a named VLAN which specified 100-150 as the range of IDs. B. Use wireless user roles to assign the devices to different VLANs in the 100-150 range C. Assign the WLAN to a single new VLAN which is dedicated to wireless users D. Use wireless user roles to assign the devices to a range of new vlan IDs.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 12
What is one practice that can help you to maintain a digital chain or custody In your network?

A. Ensure that all network infrastructure devices receive a valid clock using authenticated NTP B. Enable packet capturing on Instant AP or Mobility Controller (MC) control path on an ongoing basis. C. Ensure that all network Infrastructure devices use RADIUS rather than TACACS+ to authenticate managers D. Enable packet capturing on Instant AP or Moodily Controller (MC) datepath on an ongoing basis

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 13
What is a benefit of Opportunistic Wireless Encryption (OWE)?

A. It offers more control over who can connect to the wireless network when compared with WPA2-Personal B. It allows anyone lo connect, but provides better protection against eavesdropping than a traditional open network C. It provides protection for wireless clients against both honeypot APs and man-in-the-middle (MUM) attacks D. It allows both WPA2-capabie and WPA3-capable clients to authenticate to the same WPA-Personal WLAN

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 14
What are some functions of an AruDaOS user role?

A. The role determines which wireless networks (SSiDs) a user is permitted to access B. The role determines which authentication methods the user must pass to gain network access C. The role determines which firewall policies and bandwidth contract apply to the clients traffic D. The role determines which control plane ACL rules apply to the client's traffic

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 15
What is a benefit of Opportunistic Wireless Encryption (OWE)?

A. It allows anyone to connect, but provides better protection against eavesdropping than a traditional open network. B. It allows both WPA2-capable and WPA3-capable clients to authenticate to the same WPA-Personal WLAN. C. It provides protection for wireless clients against both honeypot APs and man-in-the-middle (MITM) attacks. D. It offers more control over who can connect to the wireless network when compared with WPA2-Personal.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).