Free Access to HP.HPE7-A02.v2025-07-02.q47 with Valid Practice Test (Page 5)

Question 16

A company has AOS-CX switches, which authenticate clients to HPE Aruba Networking ClearPass Policy Manager (CPPM). CPPM is set up to receive a variety of information about clients' profile and posture. New information can mean that CPPM should change a client's enforcement profile. What should you set up on the switches to help the solution function correctly?

A.Enable RADIUS accounting to CPPM, including interim RADIUS accounting.
B.Configure a RADIUS track that references CPPM's FQDN or IP address.
C.Enable dynamic authorization, and specify CPPM as a dynamic authorization client.
D.Re-configure the authentication server on the switch specifying CPPM as a TACACS server.

Question 17

HPE Aruba Networking Central displays a Gateway Threat Count alert in the alert list. How can you gather more information about what caused the alert to trigger?

A.Use HPE Aruba Networking Central tools to run a Network Check on the gateway with which the alert is associated.
B.Use Live Monitoring on the gateway to download a packet capture of recent traffic flowing through the gateway.
C.Check the threat list for the gateway associated with the alert. Access threat details and download packet info.
D.Check the gateway's Audit Trail in HPE Aruba Networking Central for more details about the threats that triggered the alert.

Correct Answer: C

Gateway Threat Count Alert
This alert indicates that the gateway has detected threats in traffic passing through it. HPE Aruba Networking Central provides tools to investigate and analyze these threats in detail.
Analysis of Each Option
A: Use HPE Aruba Networking Central tools to run a Network Check on the gateway with which the alert is associated:
* Incorrect:
* Network Check tools in Central are primarily used for connectivity and performance diagnostics, not for analyzing detected threats.
* This does not provide insight into the specific threats triggering the Gateway Threat Count alert.
B: Use Live Monitoring on the gateway to download a packet capture of recent traffic flowing through the gateway:
* Incorrect:
* Live Monitoring and packet capture can provide raw traffic data, but interpreting this requires significant manual analysis.
* The Gateway Threat Count alert already provides summarized threat insights that are easier to access via the threat list.
C: Check the threat list for the gateway associated with the alert. Access threat details and download packet info:
* Correct:
* The threat list is specifically designed to display detailed information about detected threats, such as their type, severity, and source/destination.
* Administrators can access this list in Central for the affected gateway, view granular details, and even download associated packet data for deeper inspection.
D: Check the gateway's Audit Trail in HPE Aruba Networking Central for more details about the threats that triggered the alert:
* Incorrect:
* The Audit Trail tracks configuration changes and administrative actions, not the details of detected threats.
* It is not relevant for investigating the Gateway Threat Count alert.
Final Recommendation
To gather more information about what caused the Gateway Threat Count alert to trigger, check the threat list for the associated gateway. This provides detailed threat information and the option to download packet data for further analysis.
References
* HPE Aruba Networking Central Threat Management Guide.
* Understanding Gateway IDS/IPS Alerts in Aruba Central Documentation.
* Best Practices for Threat Investigation Using Aruba Central.

Question 18

A company is using HPE Aruba Networking Central SD-WAN Orchestrator to establish a hub-spoke VPN between branch gateways (BGWs) at 1444 site and VPNCs at multiple data centers.
What is part of the configuration that admins need to complete?

A.At the global level, create default IPsec policies for the SD-WAN Orchestrator to use.
B.In BGWs' groups, select the VPNCs to which to connect in a DC preference list.
C.In VPNCs' groups, establish VPN pools to control which branches connect to which VPNCs.
D.In BGWs' and VPNCs' groups, create default IKE policies for the SD-WAN Orchestrator to use.

Question 19

A company has HPE Aruba Networking APs and AOS-CX switches, as well as HPE Aruba Networking ClearPass. The company wants CPPM to have HTTP User- Agent strings to use in profiling devices.
What can you do to support these requirements?

A.Add the CPPM server's IP address to the IP helper list in all client VLANs on routing switches.
B.Schedule periodic subnet scans of all client subnets on CPPM.
C.Configure mirror sessions on the APs and switches to copy client HTTP traffic to CPPM.
D.On the APs and switches, configure a redirect to ClearPass Guest in the role for devices being profiled.

Question 20

You manage AOS-10 APs with HPE Aruba Networking Central. A role is configured on these APs with the following rules:
* Allow UDP on port 67 to any destination
* Allow any to network 10.1.6.0/23
* Deny any to network 10.1.0.0/16 + log
* Deny any to network 10.0.0.0/8
* Allow any to any destination
You add this new rule immediately before rule 2:
Deny SSH to network 10.1.4.0/23 + denylist
What happens when a client assigned to this role sends SSH traffic to 10.1.11.42?

A.The traffic is permitted.
B.The traffic is dropped and logged.
C.The traffic is dropped (without any logging or further action against the client).
D.The traffic is dropped, and the client is denylisted.

Question 16

Question 17

Question 18

Question 19

Question 20

Download PDF File