Free HP HPE6-A84 Practice Questions & Answers 2026 Part2 | Aruba Certified

Refer to the scenario.

Refer to the scenario.A hospital has an AOS10 architecture that is managed by Aruba Central. The customer has deployed apair of Aruba 9000 Series gateways with Security licenses at each clinic. The gateways implementIDS/IPS in IDS mode.The Security Dashboard shows these several recent events with the same signature, as shown below:Which step could give you valuable context about the incident?

Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.The customer wants you to configure CPPM to collect information from Intune on demand during the authentication process.What should you tell the Intune admins about the certificates issued to clients?

You are setting up Aruba ClearPass Policy Manager (CPPM) to enforce EAP-TLS authentication with Active Directory as the authentication source. The company wants to prevent users with disabled accounts from connecting even if those users still have valid certificates.

How does Aruba Central handle security for site-to-site connections between AOS 10 gateways?

A customer has an AOS 10 architecture, consisting of Aruba AP and AOS-CX switches, managed by Aruba Central. The customer wants to obtain information about the clients, such as their general category and OS.What should you explain?

A customer's admins have added RF Protect licenses and enabled WIDS for a customer's AOS 8-based solution. The customer wants to use the built-in capabilities of APs without deploying dedicated air monitors (AMs). Admins tested rogue AP detection by connecting an unauthorized wireless AP to a switch. The rogue AP was not detected even after several hours.What is one point about which you should ask?

Refer to the scenario.

Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement802.1X authentication to ClearPass Policy Manager (CPPM).Switches are using local port-access policies.The customer wants to start tunneling wired clients that pass user authentication only to an Arubagateway cluster. The gateway cluster should assign these clients to the “eth-internet" role. Thegateway should also handle assigning clients to their VLAN, which is VLAN 20.The plan for the enforcement policy and profiles is shown below:The gateway cluster has two gateways with these IP addresses:• Gateway 1o VLAN 4085 (system IP) = 10.20.4.21o VLAN 20 (users) = 10.20.20.1o VLAN 4094 (WAN) = 198.51.100.14• Gateway 2o VLAN 4085 (system IP) = 10.20.4.22o VLAN 20 (users) = 10.20.20.2o VLAN 4094 (WAN) = 198.51.100.12• VRRP on VLAN 20 = 10.20.20.254The customer requires high availability for the tunnels between the switches and the gateway cluster.If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be ableto discover the gateway cluster regardless of whether one of the gateways is in the cluster.Assume that you are using the “myzone” name for the UBT zone.Which is a valid minimal configuration for the AOS-CX port-access roles?

Refer to the scenario.

Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer alsomanages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design aClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wiredclients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLSauthentication if a query to Azure AD shows that they have accounts in Azure AD. To further refinethe clients’ privileges, ClearPass also should use information collected by Intune to make accesscontrol decisions.You are planning to use Azure AD as the authentication source in 802.1X services.What should you make sure that the customer understands is required?

A customer has an AOS 10-based mobility solution, which authenticates clients to Aruba ClearPass Policy Manager (CPPM). The customer has some wireless devices that support WPA2 in personal mode only.How can you meet these devices’ needs but improve security?

You are setting up Aruba ClearPass Policy Manager (CPPM) to enforce EAP-TLS authentication with Active Directory as the authentication source. The company wants to prevent users with disabled accounts from connecting even if those users still have valid certificates.As the first part of meeting these criteria, what should you do to enable CPPM to determine where accounts are enabled in AD or not?

Refer to the scenario.An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.You are helping the developer understand how to develop an NAE script for this use case.You are helping a customer define an NAE script for AOS-CX switches. The script will monitor statistics from a RADIUS server defined on the switch. You want to future proof the script by enabling admins to select a different hostname or IP address for the monitored RADIUS server when they create an agent from the script.What should you recommend?

Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.Assume that the Azure AD deployment has the proper prerequisites established.You are planning the CPPM authentication source that you will reference as the authentication source in802.1X services.How should you set up this authentication source?

You are designing an Aruba ClearPass Policy Manager (CPPM) solution for a customer. You learn that the customer has a Palo Alto firewall that filters traffic between clients in the campus and the data center.Which integration can you suggest?

Refer to the scenario.A customer requires these rights for clients in the “medical-mobile” AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22Denied access to other 10.0.0.0/8 subnetsPermitted access to the InternetDenied access to the WLAN for a period of time if they send any SSH trafficDenied access to the WLAN for a period of time if they send any Telnet trafficDenied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with “medical-mobile” clients, only send return traffic.The exhibits below show the configuration for the role.There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, “medical-mobile” rule 1 is “ipv4 any any svc-dhcp permit,” and rule 8 is “ipv4 any any any permit”.)

A customer requires a secure solution for connecting remote users to the corporate main site. Youare designing a client-to-site virtual private network (VPN) based on Aruba VIA and Aruba MobilityControllers acting as VPN Concentrators (VPNCs). Remote users will first use the VIA client to contactthe VPNCs and obtain connection settings.The users should only be allowed to receive the settings if they are the customer's“RemoteEmployees” AD group. After receiving the settings, the VIA clients will automaticallyestablish VPN connections, authenticating to CPPM with certificates.What should you do to help ensure that only authorized users obtain VIA connection settings?

A company has an Aruba ClearPass server at 10.47.47.8, FQDN radius.acnsxtest.local. This exhibit shows ClearPass Policy Manager's (CPPM's) settings for an Aruba Mobility Controller (MC).The MC is already configured with RADIUS authentication settings for CPPM, and RADIUS requests between the MC and CPPM are working. A network admin enters and commits this command to enable dynamic authorization on the MC: aaa rfc-3576-server 10.47.47.8But when CPPM sends CoA requests to the MC, they are not working. This exhibit shows the RFC 3576 server statistics on the MC:How could you fix this issue?

Refer to the scenario.A customer requires these rights for clients in the “medical-mobile” AOS firewall role on Aruba Mobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22Denied access to other 10.0.0.0/8 subnetsPermitted access to the InternetDenied access to the WLAN for a period of time if they send any SSH trafficDenied access to the WLAN for a period of time if they send any Telnet trafficDenied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with “medical-mobile” clients, only send return traffic.The exhibits below show the configuration for the role.There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, “medical-mobile” rule 1 is “ipv4 any any svc-dhcp permit,” and rule 8 is “ipv4 any any any permit”.)

You are configuring gateway IDS/IPS settings in Aruba Central.

When would you implement BPDU protection on an AOS-CX switch port versus BPDU filtering?

Refer to the scenario.A customer requires these rights for clients in the “medical-mobile” AOS firewall role on ArubaMobility Controllers (MCs):Permitted to receive IP addresses with DHCPPermitted access to DNS services from 10.8.9.7 and no other serverPermitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22Denied access to other 10.0.0.0/8 subnetsPermitted access to the InternetDenied access to the WLAN for a period of time if they send any SSH trafficDenied access to the WLAN for a period of time if they send any Telnet trafficDenied access to all high-risk websitesExternal devices should not be permitted to initiate sessions with “medical-mobile” clients, onlysend return traffic.The line below shows the effective configuration for the role.There are multiple issues with this configuration. What is one change you must make to meet thescenario requirements? (In the options, rules in a policy are referenced from top to bottom. Forexample, “medical-mobile” rule 1 is “ipv4 any any svc-dhcp permit,” and rule 6 is “ipv4 any any anypermit’.)

Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement802.1X authentication to ClearPass Policy Manager (CPPM).Switches are using local port-access policies.The customer wants to start tunneling wired clients that pass user authentication only to an Arubagateway cluster. The gateway cluster should assign these clients to the “eth-internet" role. Thegateway should also handle assigning clients to their VLAN, which is VLAN 20.The plan for the enforcement policy and profiles is shown below:The gateway cluster has two gateways with these IP addresses:• Gateway 1o VLAN 4085 (system IP) = 10.20.4.21o VLAN 20 (users) = 10.20.20.1o VLAN 4094 (WAN) = 198.51.100.14• Gateway 2o VLAN 4085 (system IP) = 10.20.4.22o VLAN 20 (users) = 10.20.20.2o VLAN 4094 (WAN) = 198.51.100.12• VRRP on VLAN 20 = 10.20.20.254The customer requires high availability for the tunnels between the switches and the gateway cluster.If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be ableto discover the gateway cluster regardless of whether one of the gateways is in the cluster.What is one change that you should make to the solution?

You are reviewing an endpoint entry in ClearPass Policy Manager (CPPM) Endpoints Repository.What is a good sign that someone has been trying to gain unauthorized access to the network?

Refer to the scenario.A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients’ privileges, ClearPass also should use information collected by Intune to make access control decisions.Assume that the Azure AD deployment has the proper prerequisites established.You are planning the CPPM authentication source that you will reference as the authentication source in 802.1X services.How should you set up this authentication source?

You are configuring gateway IDS/IPS settings in Aruba Central.For which reason would you set the Fail Strategy to Bypass?

Refer to the scenario. A customer requires these rights for clients in the “medical - mobile” AOS firewall role on Aruba Mobility Controllers (MCs) Permitted to receive IP addresses with DHCP Permitted access to DNS services from 10.8.9.7 and no other server Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22 Denied access to other 10.0.0.0/8 subnets Permitted access to the Internet Denied access to the WLAN for a period of time if they send any SSH traffic Denied access to the WLAN for a period of time if they send any Telnet traffic Denied access to all high - risk websites External devices should not be permitted to initiate sessions with “medical - mobile” clients, only send return traffic. The exhibits below show the configuration for the role.There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, “medical - mobile” rule 1 is “ipv4 any any svc - dhcp permit,” and rule 8 is “ipv4 any any any permit”.)

Refer to the scenario.A customer has an Aruba ClearPass cluster. The customer has AOS - CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM). Switches are using local port - access policies. The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the “eth - internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20. The plan for the enforcement policy and profiles is shown belowThe gateway cluster has two gateways with these IP addresses • Gateway 1 o VLAN 4085 (system IP) = 10.20.4.21 o VLAN 20 (users) = 10.20.20.1 o VLAN 4094 (WAN) = 198.51.100.14 • Gateway 2 o VLAN 4085 (system IP) = 10.20.4.22 o VLAN 20 (users) = 10.20.20.2 o VLAN 4094 (WAN) = 198.51.100.12 • VRRP on VLAN 20 = 10.20.20.254 The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster. You are setting up the UBT zone on an AOS - CX switch. Which IP addresses should you define in the zone?

What is a common characteristic of a beacon between a compromised device and a command and control server?

Refer to the scenario.