Updated PDF (New 2024) Actual HP HPE7-A02 Exam Questions [Q42-Q61]

Q42. A company has AOS-CX switches and HPE Aruba Networking APs, which run AOS-10 and bridge their SSIDs. Company security policies require 802.1X on all edge ports, some of which connect to APs.
How should you configure the auth-mode on AOS-CX switches?

Configure all edge ports in device auth-mode.

Leave all edge ports in client auth-mode and configure device auth-mode in the AP role.

Configure all edge ports in client auth-mode.

Leave all edge ports in device auth-mode and configure client auth-mode in the AP role.

Q43. Refer to Exhibit.

A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application).
In the CPDI interface, you go to the Generic Devices
page and see the view shown in the exhibit.
What correctly describes what you see?

Each cluster is a group of unclassified devices that CPDI’s machine learning has discovered to have similar attributes.

Each cluster is a group of devices that match one of the tags configured by admins.

Each cluster is all the devices that have been assigned to the same category by one of CPDI’s built-in system rules.

Each cluster is a group of devices that have been classified with user rules, but for which CPDI offers different recommendations.

Q44. A company has HPE Aruba Networking APs, which authenticate users to HPE Aruba Networking ClearPass Policy Manager (CPPM).
What does HPE Aruba Networking recommend as the preferred method for assigning clients to a role on the AOS firewall?

Configure CPPM to assign the role using a RADIUS enforcement profile with a RADIUS:IETF Username attribute.

Configure CPPM to assign the role using a RADIUS enforcement profile with an Aruba-User-Role VSA.

OCreate server rules on the APs to assign clients to roles based on RADIUS IETF attributes returned by CPPM.

Create user rules on the APs to assign clients to roles based on a variety of criteria.

Q45. A company needs you to integrate HPE Aruba Networking ClearPass Policy Manager (CPPM) with HPE Aruba Networking ClearPass Device Insight (CPDI).
What is one task you should do to prepare?

Install the root CA for CPPM’s HTTPS certificate as trusted in the CPDI application.

Configure WMI, SSH, and SNMP external accounts for device scanning on CPPM.

Enable Insight in the CPPM server configuration settings.

Collect a Data Collector token from HPE Aruba Networking Central.

Q46. What is one use case for implementing user-based tunneling (UBT) on AOS-CX switches?

Centralizing the distribution of wired traffic without requiring HPE Aruba Networking gateways

Tunneling traffic directly to a third-party firewall in a client data center

Adding 802.1X while continuing to use the existing VLAN and ACL structure in the Ethernet network

Applying enhanced security features such as deep packet inspection (DPI) to wired traffic

Q47. A company wants HPE Aruba Networking ClearPass Policy Manager (CPPM) to respond to Syslog messages from its Check Point firewall. You have added the firewall as an event source and set up an event service. However, test Syslog messages are not triggering the expected actions.
What is one CPPM setting that you should check?

ClearPass Device Insight integration is disabled.

The Check Point Extension is installed through ClearPass Guest.

The CoA delay value is set to 0 on the server.

Ingress Event Dictionaries for Check Point messages are enabled.

Q48. You have installed an HPE Aruba Networking Network Analytic Engine (NAE) script on an AOS-CX switch to monitor a particular function.
Which additional step must you complete to start the monitoring?

Reboot the switch.

Enable NAE, which is disabled by default.

Edit the script to define monitor parameters.

Create an agent from the script.

Q49. You need to set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to provide certificate-based authentication of 802.1X supplicants.
How should you upload the root CA certificate for the supplicants’ certificates?

As a ClearPass Server certificate with the RADIUS/EAP usage

As a Trusted CA with the AD/LDAP usage

As a Trusted CA with the EAP usage

As a ClearPass Server certificate with the Database usage

Q50. A company wants to turn on Wireless IDS/IPS infrastructure and client detection at the high level on HPE Aruba Networking APs. The company does not want to enable any prevention settings.
What should you explain about HPE Aruba Networking recommendations?

HPE Aruba Networking recommends turning on both wired and wireless prevention whenever you enable detection at high.

HPE Aruba Networking recommends using hybrid AP mode, as opposed to Air Monitors (AMs), when implementing detection without prevention.

HPE Aruba Networking recommends disabling client detection when you configure infrastructure detection at high, as infrastructure detection includes all the client checks and more.

HPE Aruba Networking recommends configuring infrastructure and client detection at a custom level and disabling or tuning some of the settings that are likely to produce false positives.

Q51. You need to create a rule in an HPE Aruba Networking ClearPass Policy Manager (CPPM) role mapping policy that references a ClearPass Device Insight Tag.
Which Type (namespace) should you specify for the rule?

Application

Tips

Device

Endpoint

Q52. An AOS-CX switch has been configured to implement UBT to a cluster of three HPE Aruba Networking gateways.
How does the switch determine to which gateways to tunnel UBT users’ traffic?

The switch tunnels all users’ traffic to the gateway configured as the primary gateway in the UBT zone, unless that gateway fails.

The switch tunnels each user’s traffic to the particular gateway assigned as that user’s active user designed gateway.

The switch load balances client traffic across the primary and standby gateway configured in the UBT zone.

The switch tunnels all users’ traffic to the gateway assigned as the switch’s active device designated gateway.

Q53. A company is implementing a client-to-site VPN based on tunnel-mode IPsec.
Which devices are responsible for the IPsec encapsulation?

Gateways at the remote clients’ locations and devices accessed by the clients at the main site

The remote clients and devices accessed by the clients at the main site

The remote clients and a gateway at the main site

Gateways at the remote clients’ locations and a gateway at the main site

Q54. You have run an Active Endpoint Security Report on HPE Aruba Networking ClearPass. The report indicates that hundreds of endpoints have MAC addresses but no known IP addresses.
What is one step for addressing this issue?

Set up network devices to implement RADIUS accounting to CPPM.

Add CPPM’s IP address to the IP helper list on routing switches.

Set up switches to implement ARP inspection on client VLANs.

Configure CPPM as a Syslog destination on network devices.

Q55. Which use case is fulfilled by applying a time range to a firewall rule on an AOS device?

Enforcing the rule only during the specified time range

Tuning the session timeout for sessions established with this rule

Locking clients that violate the rule for the specified time range

Setting the time range over which hit counts for the rule are aggregated

Q56. You need to set up an HPE Aruba Networking VIA solution for a customer who needs to support 2100 remote employees. The customer wants employees to download their VIA connection profile from the VPNC. Only employees who authenticate with their domain credentials to HPE Aruba Networking ClearPass Policy Manager (CPPM) should be able to download the profile. (A RADIUS server group for CPPM is already set up on the VPNC.) How do you configure the VPNC to enforce that requirement?

Set up a VIA Authentication Profile that uses CPPM’s server group; reference that profile in the VIA Web Authentication Profile.

Reference CPPM’s server group in an AAA profile; then, apply that profile to the VPNC’s Internet-facing ports.

Create a new VPN Authentication Profile and then reference CPPM’s default server group in that profile.

Set up a VIA Authentication Profile that uses CPPM’s server group; reference that profile in the VIA Connection Profile.

Q57. You have configured an AOS-CX switch to implement 802.1X on edge ports. Assume ports operate in the default auth-mode. VolP phones are assigned to the
“voice” role and need to send traffic that is tagged for VLAN 12.
Where should you configure VLAN 12?

As the trunk native VLAN on edge ports and the trunk native VLAN on the “voice” role

As a trunk allowed VLAN on edge ports and the trunk native VLAN in the “voice” role

As the trunk native VLAN in the “voice” role (and not in the edge port settings)

As the allowed trunk VLAN in the “voice” role (and not in the edge port settings)

Q58. A security team needs to track a device’s communication patterns and identify patterns such as how many destinations the device is accessing.
Which Aruba solution can show this information at a glance?

HPE Aruba Networking ClearPass Insight Endpoints and Network Dashboards

HPE Aruba Networking ClearPass Policy Manager (CPPM) live monitoring Access Tracker

HPE Aruba Networking ClearPass Device Insight (CPDI) under a device’s network activity

AOS-CX Analytics Dashboard using the system-installed NAE agent

Q59. A company has HPE Aruba Networking APs (AOS-10), which authenticate clients to HPE Aruba Networking ClearPass Policy Manager (CPPM). CPPM is set up to receive a variety of information about clients’ profile and posture. New information can mean that CPPM should change a client’s enforcement profile.
What should you set up on the APs to help the solution function correctly?

In the security settings, configure dynamic denylisting.

In the RADIUS server settings for CPPM, enable Dynamic Authorization.

In the WLAN profiles, enable interim RADIUS accounting.

In the RADIUS server settings for CPPM, enable querying the authentication status.

Q60. A company has HPE Aruba Networking APs and AOS-CX switches, as well as HPE Aruba Networking ClearPass. The company wants CPPM to have HTTP User- Agent strings to use in profiling devices.
What can you do to support these requirements?

Add the CPPM server’s IP address to the IP helper list in all client VLANs on routing switches.

Schedule periodic subnet scans of all client subnets on CPPM.

Configure mirror sessions on the APs and switches to copy client HTTP traffic to CPPM.

On the APs and switches, configure a redirect to ClearPass Guest in the role for devices being profiled.

Q61. A company wants HPE Aruba Networking ClearPass Policy Manager (CPPM) to respond to Syslog messages from its Palo Alto Next Generation Firewall (NGFW) by quarantining clients involved in security incidents.
Which step must you complete to enable CPPM to process the Syslogs properly?

Configure the Palo Alto as a context server on CPPM.

Install a Palo Alto Extension through ClearPass Guest.

Enable Insight and ingress event processing on the CPPM server.

Configure CPPM to trust the root CA certificate for the NGFW.

Premium VCE Dumps

Premium VCE Dumps

Updated PDF (New 2024) Actual HP HPE7-A02 Exam Questions [Q42-Q61]

Leave a Reply Cancel reply