What is a benefit or Protected Management Frames (PMF). sometimes called Management Frame Protection (MFP)?
Correct Answer: A
Question 87
What is one of the roles of the network access server (NAS) in the AAA framewonx?
Correct Answer: C
In the AAA (Authentication, Authorization, and Accounting) framework, the role of the Network Access Server (NAS) is to act as a gateway that enforces access to network services and sends accounting information to the AAA server. The NAS initially requests authentication information from the user and then passes that information to the AAA server. It also enforces the access policies as provided by the AAA server after authentication and provides accounting data to the AAA server based on user activity. : Technical literature on AAA protocols which often includes a description of the roles and responsibilities of a Network Access Server. Network security resources that discuss the NAS function within the AAA framework.
Question 88
How can hackers implement a man-in-the-middle (MITM) attack against a wireless client?
Correct Answer: D
A man-in-the-middle (MITM) attack involves an attacker positioning themselves between a wireless client and the legitimate network to intercept or manipulate traffic. HPE Aruba Networking documentation often discusses MITM attacks in the context of wireless security threats and mitigation strategies. Option D, "The hacker connects a device to the same wireless network as the client and responds to the client's ARP requests with the hacker device's MAC address," is correct. This describes an ARP poisoning (or ARP spoofing) attack, a common MITM technique in wireless networks. The hacker joins the same wireless network as the client (e.g., by authenticating with the same SSID and credentials). Once on the network, the hacker sends fake ARP responses to the client, associating the hacker's MAC address with the IP address of the default gateway (or another target device). This causes the client to send traffic to the hacker's device instead of the legitimate gateway, allowing the hacker to intercept, modify, or forward the traffic, thus performing an MITM attack. Option A, "The hacker uses a combination of software and hardware to jam the RF band and prevent the client from connecting to any wireless networks," is incorrect. Jamming the RF band would disrupt all wireless communication, including the hacker's ability to intercept traffic. This is a denial-of-service (DoS) attack, not an MITM attack. Option B, "The hacker runs an NMap scan on the wireless client to find its MAC and IP address. The hacker then connects to another network and spoofs those addresses," is incorrect. NMap scans are used for network discovery and port scanning, not for implementing an MITM attack. Spoofing MAC and IP addresses on another network does not position the hacker to intercept the client's traffic on the original network. Option C, "The hacker uses spear-phishing to probe for the IP addresses that the client is attempting to reach. The hacker device then spoofs those IP addresses," is incorrect. Spear-phishing is a delivery method for malware or credentials theft, not a direct method for implementing an MITM attack. Spoofing IP addresses alone does not allow the hacker to intercept traffic unless they are on the same network and can manipulate routing (e.g., via ARP poisoning). The HPE Aruba Networking AOS-8 8.11 User Guide states: "A common man-in-the-middle (MITM) attack against wireless clients involves ARP poisoning. The hacker connects a device to the same wireless network as the client and sends fake ARP responses to the client, associating the hacker's MAC address with the IP address of the default gateway. This causes the client to send traffic to the hacker's device, allowing the hacker to intercept and manipulate the traffic." (Page 422, Wireless Threats Section) Additionally, the HPE Aruba Networking Security Guide notes: "ARP poisoning is a prevalent MITM attack in wireless networks. The attacker joins the same network as the client and responds to the client's ARP requests with the attacker's MAC address, redirecting traffic through the attacker's device. This allows the attacker to intercept sensitive data or modify traffic between the client and the legitimate destination." (Page 72, Wireless MITM Attacks Section) : HPE Aruba Networking AOS-8 8.11 User Guide, Wireless Threats Section, Page 422. HPE Aruba Networking Security Guide, Wireless MITM Attacks Section, Page 72.
Question 89
You have deployed a new Aruba Mobility Controller (MC) and campus APs (CAPs). One of the WLANs enforces 802.IX authentication lo Aruba ClearPass Policy Manager {CPPM) When you test connecting the client to the WLAN. the test falls You check Aruba ClearPass Access Tracker and cannot find a record of the authentication attempt You ping from the MC to CPPM. and the ping is successful. What is a good next step for troubleshooting?
Correct Answer: C
When dealing with a failed 802.1X authentication attempt to a WLAN enforced by Aruba ClearPass Policy Manager (CPPM) where no record of the attempt is seen in ClearPass Access Tracker, a good next troubleshooting step is to check the CPPM Event Viewer. Since you are able to successfully ping from the Mobility Controller to CPPM, this indicates that there is network connectivity between these two devices. The lack of a record in Access Tracker suggests that the issue may not be with the RADIUS/EAP certificate or user credentials, but possibly with the ClearPass service itself or its reception of authentication requests. The Event Viewer can provide detailed logs that might reveal internal errors or misconfigurations within CPPM that could prevent it from processing authentication attempts properly.
Question 90
What is a benefit or using network aliases in ArubaOS firewall policies?
