What is a difference between passive and active endpoint classification?
Correct Answer: D
HPE Aruba Networking ClearPass Policy Manager (CPPM) uses endpoint classification (profiling) to identify and categorize devices on the network, enabling policy enforcement based on device type, OS, or other attributes. CPPM supports two primary profiling methods: passive and active classification. Passive Classification: This method involves observing network traffic that endpoints send as part of their normal operation, without CPPM sending any requests to the device. Examples include DHCP fingerprinting (analyzing DHCP Option 55), HTTP User-Agent string analysis, and TCP fingerprinting (analyzing TTL and window size). Passive classification is non-intrusive and does not generate additional network traffic. Active Classification: This method involves CPPM sending requests to the endpoint to gather information. Examples include SNMP scans (to query device details), WMI scans (for Windows devices), and SSH scans (to gather system information). Active classification is more intrusive and may require credentials or network access to the device. Option A, "Passive classification refers exclusively to MAC OUI-based classification, while active classification refers to any other classification method," is incorrect. Passive classification includes more than just MAC OUI-based classification (e.g., DHCP fingerprinting, TCP fingerprinting). MAC OUI (Organizationally Unique Identifier) analysis is one passive method, but not the only one. Active classification specifically involves sending requests, not just "any other method." Option B, "Passive classification classifies endpoints based on entries in dictionaries, while active classification uses admin-defined rules to classify endpoints," is incorrect. Both passive and active classification use CPPM's fingerprint database (not "dictionaries") to match device attributes. Admin-defined rules are used for policy enforcement, not classification, and apply to both methods. Option C, "Passive classification is only suitable for profiling endpoints in small business environments, while enterprises should use active classification exclusively," is incorrect. Passive classification is widely used in enterprises because it is non-intrusive and scalable. Active classification is often used in conjunction with passive methods to gather more detailed information, but enterprises do not use it exclusively. Option D, "Passive classification analyzes traffic that endpoints send as part of their normal functions; active classification involves sending requests to endpoints," is correct. This accurately describes the fundamental difference between the two methods: passive classification observes existing traffic, while active classification actively queries the device. The HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide states: "Passive classification analyzes traffic that endpoints send as part of their normal functions, such as DHCP requests, HTTP traffic, or TCP packets, without ClearPass sending any requests to the device. Examples include DHCP fingerprinting and TCP fingerprinting. Active classification involves ClearPass sending requests to the endpoint to gather information, such as SNMP scans, WMI scans, or SSH scans, which may require credentials or network access." (Page 246, Passive vs. Active Profiling Section) Additionally, the ClearPass Device Insight Data Sheet notes: "Passive classification observes network traffic generated by endpoints during normal operation, such as DHCP or HTTP traffic, to identify devices without generating additional traffic. Active classification, in contrast, sends requests to endpoints (e.g., SNMP or WMI scans) to gather detailed information, which can be more intrusive but provides deeper insights." (Page 3, Profiling Methods Section) : HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide, Passive vs. Active Profiling Section, Page 246. ClearPass Device Insight Data Sheet, Profiling Methods Section, Page 3.
Question 43
You are configuring ArubaOS-CX switches to tunnel client traffic to an Aruba Mobility Controller (MC). What should you do to enhance security for control channel communications between the switches and the MC?
Correct Answer: D
Question 44
You are deploying a new wireless solution with an HPE Aruba Networking Mobility Master (MM), Mobility Controllers (MCs), and campus APs (CAPs). The solution will include a WLAN that uses Tunnel for the forwarding mode and WPA3-Enterprise for the security option. You have decided to assign the WLAN to VLAN 301, a new VLAN. A pair of core routing switches will act as the default router for wireless user traffic. Which links need to carry VLAN 301?
Correct Answer: D
In an HPE Aruba Networking AOS-8 architecture with a Mobility Master (MM), Mobility Controllers (MCs), and campus APs (CAPs), the WLAN is configured to use Tunnel forwarding mode and WPA3-Enterprise security. In Tunnel mode, all user traffic from the APs is encapsulated in a GRE tunnel and sent to the MC, which then forwards the traffic to the appropriate VLAN. The WLAN is assigned to VLAN 301, and the core routing switches act as the default router for wireless user traffic. Tunnel Forwarding Mode: In this mode, the AP does not directly place user traffic onto the wired network. Instead, the AP tunnels all user traffic to the MC over a GRE tunnel. The MC then decapsulates the traffic and places it onto the wired network in the specified VLAN (VLAN 301 in this case). This means the VLAN tagging for user traffic occurs at the MC, not at the AP. VLAN 301 Assignment: Since the WLAN is assigned to VLAN 301, the MC will tag user traffic with VLAN 301 when forwarding it to the wired network. The core routing switches, acting as the default router, need to receive this traffic on VLAN 301 to route it appropriately. Therefore, VLAN 301 needs to be carried on the links between the MC ports and the core routing switches, as this is where the MC forwards the user traffic after decapsulating it from the GRE tunnel. Option A, "Only links on the path between APs and the core routing switches," is incorrect because, in Tunnel mode, the APs do not directly forward user traffic to the wired network. The traffic is tunneled to the MC, so the links between the APs and the core switches do not need to carry VLAN 301 for user traffic (though they may carry other VLANs for AP management). Option B, "Only links on the path between APs and the MC," is incorrect for the same reason. The GRE tunnel between the AP and MC carries encapsulated user traffic, and VLAN 301 tagging occurs at the MC, not on the AP-to-MC link. Option C, "All links in the campus LAN to ensure seamless roaming," is incorrect because VLAN 301 only needs to be present where the MC forwards user traffic to the wired network (i.e., between the MC and the core switches). Extending VLAN 301 to all links is unnecessary and could introduce security or scalability issues. Option D, "Only links between MC ports and the core routing switches," is correct because the MC places user traffic onto VLAN 301 and forwards it to the core switches, which act as the default router. The HPE Aruba Networking AOS-8 8.11 User Guide states: "In Tunnel forwarding mode, the AP encapsulates all user traffic in a GRE tunnel and sends it to the Mobility Controller (MC). The MC decapsulates the traffic and forwards it to the wired network on the VLAN assigned to the WLAN. For example, if the WLAN is assigned to VLAN 301, the MC tags the user traffic with VLAN 301 and sends it out of its wired interface to the upstream switch. Therefore, the VLAN must be configured on the links between the MC and the upstream switch or router that acts as the default gateway for the VLAN." (Page 275, Tunnel Forwarding Mode Section) Additionally, the HPE Aruba Networking Wireless LAN Design Guide notes: "When using Tunnel mode, the VLAN assigned to the WLAN must be carried on the wired links between the Mobility Controller and the default router for the VLAN. The links between the APs and the MC do not need to carry the user VLAN, as all traffic is tunneled to the MC, which handles VLAN tagging." (Page 52, VLAN Configuration Section) : HPE Aruba Networking AOS-8 8.11 User Guide, Tunnel Forwarding Mode Section, Page 275. HPE Aruba Networking Wireless LAN Design Guide, VLAN Configuration Section, Page 52.
Question 45
What is symmetric encryption?
Correct Answer: C
Symmetric encryption is a type of encryption where the same key is used to encrypt and decrypt the message. It's called "symmetric" because the key used for encryption is identical to the key used for decryption. The data, or plaintext, is transformed into ciphertext during encryption, and then the same key is used to revert the ciphertext back to plaintext during decryption. It is a straightforward method but requires secure handling and exchange of the encryption key.References: Basic principles of cryptography.
