HPE6-A78 PDF Dumps 2024 Exam Questions with Practice Test
Dumps for Free HPE6-A78 Practice Exam Questions
HP HPE6-A78 exam is designed for IT professionals who have experience in securing enterprise-level networks. It is an Aruba Certified Network Security Associate exam that validates the skills and knowledge required to configure and manage Aruba ClearPass Policy Manager and Aruba AirWave. HPE6-A78 exam tests the candidates' ability to identify and mitigate network security threats, configure and manage firewalls, and implement secure network access policies.
NEW QUESTION # 18
You are troubleshooting an authentication issue for Aruba switches that enforce 802 IX10 a cluster of Aruba ClearPass Policy Manager (CPPMs) You know that CPPM Is receiving and processing the authentication requests because the Aruba switches are showing Access-Rejects in their statistics However, you cannot find the record tor the Access-Rejects in CPPM Access Tracker What is something you can do to look for the records?
- A. Go to the CPPM Event Viewer, because this is where RADIUS Access Rejects are stored.
- B. Verify that you are logged in to the CPPM Ul with read-write, not read-only, access
- C. Make sure that CPPM cluster settings are configured to show Access-Rejects
- D. Click Edit in Access viewer and make sure that the correct servers are selected.
Answer: C
NEW QUESTION # 19
What role does the Aruba ClearPass Device Insight Analyzer play in the Device Insight architecture?
- A. It resides on-prem and provides the span port to which traffic is mirrored for deep analytics.
- B. It resides In the cloud and applies machine learning and supervised crowdsourcing to metadata sent by Collectors
- C. It resides on-prem and is responsible for running active SNMP and Nmap scans
- D. It resides in the cloud and manages licensing and configuration for Collectors
Answer: B
NEW QUESTION # 20
You have deployed a new Aruba Mobility Controller (MC) and campus APs (CAPs). One of the WLANs enforces 802.IX authentication lo Aruba ClearPass Policy Manager {CPPM) When you test connecting the client to the WLAN. the test falls You check Aruba ClearPass Access Tracker and cannot find a record of the authentication attempt You ping from the MC to CPPM. and the ping is successful.
What is a good next step for troubleshooting?
- A. Check CPPM Event viewer.
- B. Renew CPPM's RADIUS/EAP certificate
- C. Reset the user credentials
- D. Check connectivity between CPPM and a backend directory server
Answer: A
NEW QUESTION # 21
What is one way that Control Plane Security (CPsec) enhances security for me network?
- A. It prevents access from unauthorized IP addresses to critical services, such as SSH on Mobility Controllers (MCs).
- B. It prevents Denial of Service (DoS) attacks against Mobility Controllers' (MCs") control plane.
- C. It protects management traffic between APs and Mobility Controllers (MCs) from eavesdropping.
- D. It protects wireless clients' traffic tunneled between APs and Mobility Controllers, from eavesdropping
Answer: D
NEW QUESTION # 22
A company has Aruba Mobility Controllers (MCs). Aruba campus APs. and ArubaOS-CX switches. The company plans to use ClearPass Policy Manager (CPPM) to classify endpoints by type The ClearPass admins tell you that they want to run Network scans as part of the solution What should you do to configure the infrastructure to support the scans?
- A. Create SNMPv3 users on ArubaOS-CX switches, and make sure that the credentials match those configured on CPPM
- B. Create device fingerprinting profiles on the ArubaOS-Switches that include SNMP. and apply the profiles to edge ports
- C. Create a TA profile on the ArubaOS-Switches with the root CA certificate for ClearPass's HTTPS certificate
- D. Create remote mirrors on the ArubaOS-Swrtches that collect traffic on edge ports, and mirror it to CPPM's IP address.
Answer: B
NEW QUESTION # 23
You configure an ArubaOS-Switch to enforce 802.1X authentication with ClearPass Policy Manager (CPPM) denned as the RADIUS server Clients cannot authenticate You check Aruba ClearPass Access Tracker and cannot find a record of the authentication attempt.
What are two possible problems that have this symptom? (Select two)
- A. Clients are not configured to trust the root CA certificate for CPPM's RADIUS/EAP certificate.
- B. Clients are configured to use a mismatched EAP method from the one In the CPPM service.
- C. CPPM does not have a network device defined for the switch's IP address.
- D. users are logging in with the wrong usernames and passwords or invalid certificates.
- E. The RADIUS shared secret does not match between the switch and CPPM.
Answer: A,D
NEW QUESTION # 24
A company is deploying ArubaOS-CX switches to support 135 employees, which will tunnel client traffic to an Aruba Mobility Controller (MC) for the MC to apply firewall policies and deep packet inspection (DPI).
This MC will be dedicated to receiving traffic from the ArubaOS-CX switches.
What are the licensing requirements for the MC?
- A. one AP license per-switch
- B. one PEF license per-switch
- C. one PEF license per-switch. and one WCC license per-switch
- D. one AP license per-switch. and one PEF license per-switch
Answer: D
NEW QUESTION # 25
What are some functions of an AruDaOS user role?
- A. The role determines which firewall policies and bandwidth contract apply to the clients traffic
- B. The role determines which wireless networks (SSiDs) a user is permitted to access
- C. The role determines which authentication methods the user must pass to gain network access
- D. The role determines which control plane ACL rules apply to the client's traffic
Answer: C
NEW QUESTION # 26
What is a benefit or Protected Management Frames (PMF). sometimes called Management Frame Protection (MFP)?
- A. PMF helps to protect APs and MCs from unauthorized management access by hackers.
- B. PMF protects clients from DoS attacks based on forged de-authentication frames
- C. PMF ensures trial traffic between APs and Mobility Controllers (MCs) is encrypted.
- D. PMF prevents hackers from capturing the traffic between APs and Mobility Controllers.
Answer: A
NEW QUESTION # 27
What distinguishes a Distributed Denial of Service (DDoS) attack from a traditional Denial or service attack (DoS)?
- A. A DDoS attack targets multiple devices, while a DoS Is designed to Incapacitate only one device
- B. A DDoS attack is launched from multiple devices, while a DoS attack is launched from a single device
- C. A DDoS attack originates from external devices, while a DoS attack originates from internal devices
- D. A DoS attack targets one server, a DDoS attack targets all the clients that use a server
Answer: C
NEW QUESTION # 28
You have been asked to rind logs related to port authentication on an ArubaOS-CX switch for events logged in the past several hours But. you are having trouble searching through the logs What is one approach that you can take to find the relevant logs?
- A. Specify a logging facility that selects for "port-access" messages.
- B. Enable debugging for "portaccess" to move the relevant logs to a buffer.
- C. Configure a logging Tiller for the "port-access" category, and apply that filter globally.
- D. Add the "-C and *-c port-access" options to the "show logging" command.
Answer: D
NEW QUESTION # 29
What is a benefit of Opportunistic Wireless Encryption (OWE)?
- A. It provides protection for wireless clients against both honeypot APs and man-in-the-middle (MUM) attacks
- B. It allows anyone lo connect, but provides better protection against eavesdropping than a traditional open network
- C. It allows both WPA2-capabie and WPA3-capable clients to authenticate to the same WPA-Personal WLAN
- D. It offers more control over who can connect to the wireless network when compared with WPA2-Personal
Answer: B
NEW QUESTION # 30
What is one practice that can help you to maintain a digital chain or custody In your network?
- A. Ensure that all network infrastructure devices receive a valid clock using authenticated NTP
- B. Ensure that all network Infrastructure devices use RADIUS rather than TACACS+ to authenticate managers
- C. Enable packet capturing on Instant AP or Mobility Controller (MC) control path on an ongoing basis.
- D. Enable packet capturing on Instant AP or Moodily Controller (MC) datepath on an ongoing basis
Answer: D
NEW QUESTION # 31
What is a guideline for creating certificate signing requests (CSRs) and deploying server Certificates on ArubaOS Mobility Controllers (MCs)?
- A. Generate the private key online, but the public key and CSR offline, to install the same certificate on multiple MCs.
- B. Create the CSR and public/private keypair offline If you want to install the same certificate on multiple MCs.
- C. if you create the CSR and public/private Keypair offline, create a matching private key online on the MC.
- D. Create the CSR online using the MC Web Ul if your company requires you to archive the private key.
Answer: D
NEW QUESTION # 32
An ArubaOS-CX switch enforces 802.1X on a port. No fan-through options or port-access roles are configured on the port The 802 1X supplicant on a connected client has not yet completed authentication Which type of traffic does the authenticator accept from the client?
- A. RADIUS only
- B. DHCP, DNS, and EAP only
- C. EAP only
- D. DHCP, DNS and RADIUS only
Answer: C
NEW QUESTION # 33
Your Aruba Mobility Master-based solution has detected a rogue AP Among other information the ArubaOS Detected Radios page lists this Information for the AP SSID = PubllcWiFI BSSID = a8M27 12 34:56 Match method = Exact match Match type = Eth-GW-wired-Mac-Table The security team asks you to explain why this AP is classified as a rogue. What should you explain?
- A. The ap has a BSSID mat matches authorized client MAC addresses. This indicates that the AP is spoofing the MAC address to gam unauthorized access to your company's wireless services, so It is a rogue
- B. The AP is spoofing a routers MAC address as its BSSID. This indicates mat, even though WIP cannot determine whether the AP is connected to your LAN. it is a rogue.
- C. The AP Is connected to your LAN because It is transmitting wireless traffic with your network's default gateway's MAC address as a source MAC Because it does not belong to the company, it is a rogue
- D. The AP has been detected as launching a DoS attack against your company's default gateway. This qualities it as a rogue which needs to be contained with wireless association frames immediately
Answer: B
NEW QUESTION # 34
What are the roles of 802.1X authenticators and authentication servers?
- A. The authenticator stores the user account database, while the server stores access policies.
- B. The authenticator is a RADIUS client and the authentication server is a RADIUS server.
- C. The authenticator makes access decisions and the server communicates them to the supplicant.
- D. The authenticator supports only EAP, while the authentication server supports only RADIUS.
Answer: C
NEW QUESTION # 35
A company has an Aruba solution with a Mobility Master (MM) Mobility Controllers (MCs) and campus Aps.
What is one benefit of adding Aruba Airwave from the perspective of forensics?
- A. Airwave retains information about the network for much longer periods than ArubaOS solution
- B. Airwave can provide more advanced authentication and access control services for the AmbaOS solution
- C. Airwave is required to activate Wireless Intrusion Prevention (WIP) services on the ArubaOS solution
- D. AirWave enables low level debugging on the devices across the ArubaOS solution
Answer: C
NEW QUESTION # 36
What is a vulnerability of an unauthenticated Dime-Heliman exchange?
- A. Diffie-Hellman with elliptic curve values is no longer considered secure in modem networks, based on NIST recommendations.
- B. A brute force attack can relatively quickly derive Diffie-Hellman private values if they are able to obtain public values
- C. Participants must agree on a passphrase in advance, which can limit the usefulness of Diffie- Hell man in practical contexts.
- D. A hacker can replace the public values exchanged by the legitimate peers and launch an MITM attack.
Answer: D
NEW QUESTION # 37
Refer to the exhibit.
You need to ensure that only management stations in subnet 192.168.1.0/24 can access the ArubaOS-Switches' CLI. Web Ul. and REST interfaces The company also wants to let managers use these stations to access other parts of the network What should you do?
- A. Configure the switch to listen for these protocols on OOBM only.
- B. Specify 192.168.1.0.255.255.255.0 as authorized IP manager address
- C. Establish a Control Plane Policing class that selects traffic from 192.168 1.0/24.
- D. Specify vlan 100 as the management vlan for the switches.
Answer: C
NEW QUESTION # 38
......
Check your preparation for HP HPE6-A78 On-Demand Exam: https://torrentpdf.guidetorrent.com/HPE6-A78-dumps-questions.html