Question 1

A company has Aruba Mobility Controllers (MCs), Aruba campus APs, and ArubaOS-Switches. The company plans to use ClearPass Policy Manager (CPPM) to classify endpoints by type. This company is using only CPPM and no other ClearPass solutions. The ClearPass admins tell you that they want to use HTTP User-Agent strings to help classify endpoints. What should you do as a part of configuring the ArubaOS-Switches to support this requirement?

Options :

A : Create a device fingerprinting policy that includes HTTP, and apply the policy to edge ports.

B : Create remote mirrors that collect traffic on edge ports, and mirror it to CPPM's IP address.

C : Configure CPPM as the sFlow collector, and make sure that sFlow is enabled on edge ports.

D : Connect the switches to CPPM's span ports, and set up mirroring of HTTP traffic on the switches.

Answer: C

Question 2

A company has an HPE Aruba Networking Instant AP cluster. A Windows 10 client is attempting to connect to a WLAN that enforces WPA3-Enterprise with authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM). CPPM is configured to require EAP-TLS. The client authentication fails. In the record for this client's authentication attempt on CPPM, you see this alert. What is one thing that you check to resolve this issue?

Options :

A : Whether EAP-TLS is enabled in the AAA Profile settings for the WLAN on the IAP cluster

B : Whether the client has a valid certificate installed on it to let it support EAP-TLS

C : Whether EAP-TLS is enabled in the SSID Profile settings for the WLAN on the IAP cluster

D : Whether the client has a third-party 802.1X supplicant, as Windows 10 does not support EAP-TLS

Answer: B

Question 3

What is a guideline for managing local certificates on an ArubaOS-Switch?

Options :

A :

Before installing the local certificate, create a trust anchor (TA) profile with the root CA certificate for the certificate that you will install

B :

Install an Online Certificate Status Protocol (OCSP) certificate to simplify the process of enrolling and re-enrolling for certificate

C :

Generate the certificate signing request (CSR) with a program offline, then, install both the certificate and the private key on the switch in a single file.

D : Create a self-signed certificate online on the switch because ArubaOS-Switches do not support CAsigned certificates.

Answer: A

Question 4

A company has HPE Aruba Networking Mobility Controllers (MCs), HPE Aruba Networking campus APs, and AOS-CX switches. The company plans to use HPE Aruba Networking ClearPass Policy Manager (CPPM) to classify endpoints by type. The company is contemplating the use of ClearPass's TCP fingerprinting capabilities. What is a consideration for using those capabilities?

Options :

A : You will need to mirror traffic to one of CPPM’s span ports from a device such as a core routing switch.

B :

ClearPass admins will need to provide the credentials of an API admin account to configure on HPE Aruba Networking devices.

C :

AOS-CX switches do not offer the support necessary for CPPM to use TCP fingerprinting on wired endpoints.

D :

TCP fingerprinting of wireless endpoints requires a third-party Mobility Device Management (MDM) solution.

Answer: A

Question 5

What is a benefit of Opportunistic Wireless Encryption (OWE)?

Options :

A :

It allows both WPA2-capable and WPA3-capable clients to authenticate to the same WPA-Personal WLAN.

B :

It offers more control over who can connect to the wireless network when compared with WPA2- Personal.

C :

It allows anyone to connect, but provides better protection against eavesdropping than a traditional open network.

D :

It provides protection for wireless clients against both honeypot APs and man-in-the-middle (MITM) attacks.

Answer: C