HPE7-A02 HPE Aruba Networking Certified Network Security Professional Practice Questions
Prepare for HPE7-A02 with more than an answer.
- Level
- Professional
- Valid for
- 3 years
Domains covered on the exam 10
- Define Security Terminology26%
- Device Hardening6%
- Secure WLAN12%
- Secure Wired AOS-CX19%
- Secure the WAN5%
- Endpoint Classification (Deploy and Define)8%
- Threat Detection9%
- Troubleshooting6%
- Endpoint Classification (Analyze)8%
- Forensics1%
- 1
What is the primary function of the 'Ingress Event Engine' in ClearPass Policy Manager?
Show answer details
Correct answer: D
The Ingress Event Engine allows CPPM to listen for external Syslog messages (e.g., from a firewall or MDM). It parses these messages and can trigger enforcement actions, such as changing a device's trust score or initiating a CoA, enabling integration with third-party security solutions.
- 2
Which of the following attributes are collected during DHCP Fingerprinting to profile a device? (Select TWO)
Show answer details
Correct answer: C, D
Option 60 is explicitly the Vendor Class Identifier, a string sent by the client to identify its vendor or hardware type (e.g., 'ArubaAP', 'MSFT 5.0').
Option 55 lists the parameters the client is requesting (e.g., subnet mask, router, DNS). The specific order and content of this list are highly characteristic of the OS version and device type.
- 3
In a Zero Trust architecture using HPE Aruba Networking, what does 'Micro-segmentation' specifically refer to?
Show answer details
Correct answer: C
Micro-segmentation goes beyond traditional VLAN separation. It enforces security policies between individual workloads or devices, even if they reside on the same Layer 2 segment. In Aruba, this is often achieved via PEF user roles preventing peer-to-peer traffic unless explicitly allowed.
- 4
A network architect is designing a Public Key Infrastructure (PKI) for a high-security environment using HPE Aruba Networking solutions. The design requires mutual authentication (EAP-TLS) for all corporate endpoints. The architect must ensure that if an Intermediate Certificate Authority (CA) is compromised, the revocation status can be checked immediately without waiting for the next CRL update interval. Which PKI mechanism should be prioritized in the ClearPass Policy Manager authentication source configuration to meet this requirement?
Show answer details
Correct answer: B
OCSP (Online Certificate Status Protocol) provides real-time certificate status checks. Unlike CRLs (Certificate Revocation Lists), which are downloaded periodically and may have a latency window where a revoked certificate is still accepted, OCSP queries the CA's responder directly at the time of authentication. For high-security environments requiring immediate revocation validation, OCSP is the superior mechanism.
- 5
A security administrator is integrating ClearPass Device Insight (CPDI) with ClearPass Policy Manager (CPPM). The goal is to quarantine IoT devices that start exhibiting anomalous traffic patterns, such as a thermostat attempting to communicate with an external FTP server. What is the correct workflow to automate this response?
Show answer details
Correct answer: D
The integration relies on CPDI analyzing traffic and tagging devices (e.g., 'Anomalous-Behavior'). CPPM is configured to read these tags (often via endpoint attributes synced or polled) and use them in Enforcement Policies. When the tag appears, CPPM can trigger a Change of Authorization (CoA) to move the device to a quarantine VLAN.
- 6
Which of the following methods are considered 'Active' profiling techniques used by ClearPass to classify endpoints? (Select TWO)
Show answer details
Correct answer: A, E
WMI scanning involves the profiler logging into or querying the Windows endpoint to gather system details, which is an active profiling technique.
Active profiling involves the profiler initiating traffic to the endpoint. Sending an SNMP query (e.g., OID request) is an active method.
