HPE6-A78 Exam Questions and Answers

QUESTION: 9

What is a guideline for managing local certificates on an ArubaOS-Switch?

Before installing the local certificate, create a trust anchor (TA) profile with the root CA certificate for the certificate that you will install
Install an Online Certificate Status Protocol (OCSP) certificate to simplify the process of enrolling and re-enrolling for certificate
Generate the certificate signing request (CSR) with a program offline, then, install both the certificate and the private key on the switch in a single file.
Create a self-signed certificate online on the switch because ArubaOS-Switches do not support CA- signed certificates.

Answer(s): A

Explanation:

When managing local certificates on an ArubaOS-Switch, a recommended guideline is to create a trust anchor (TA) profile with the root CA certificate before installing the local certificate. This step ensures that the switch can verify the authenticity of the certificate chain during SSL/TLS communications. The trust anchor profile establishes a basis of trust by containing the root CA

certificate, which helps validate the authenticity of any subordinate certificates, including the local certificate installed on the switch. This process is essential for enhancing security on the network, as it ensures that encrypted communications involving the switch are based on a verified certificate hierarchy.
:
ArubaOS-Switch security configuration guides that detail the process of certificate management, including the creation of trust anchor profiles.
Security best practices and SSL/TLS implementation guidelines that emphasize the importance of establishing trusted certificate chains for secure communications.

Reveal Solution Next Question

QUESTION: 10

What distinguishes a Distributed Denial of Service (DDoS) attack from a traditional Denial or service attack (DoS)?

A DDoS attack originates from external devices, while a DoS attack originates from internal devices
A DDoS attack is launched from multiple devices, while a DoS attack is launched from a single device
A DoS attack targets one server, a DDoS attack targets all the clients that use a server
A DDoS attack targets multiple devices, while a DoS Is designed to Incapacitate only one device

Answer(s): B

Explanation:

The main distinction between a Distributed Denial of Service (DDoS) attack and a traditional Denial of Service (DoS) attack is that a DDoS attack is launched from multiple devices, whereas a DoS attack originates from a single device. This distinction is critical because the distributed nature of a DDoS attack makes it more difficult to mitigate. Multiple attacking sources can generate a higher volume of malicious traffic, overwhelming the target more effectively than a single source, as seen in a DoS attack. DDoS attacks exploit a variety of devices across the internet, often coordinated using botnets, to flood targets with excessive requests, leading to service degradation or complete service denial.
:
Cybersecurity texts and resources that differentiate between types of denial of service attacks. Technical documentation and analysis of DDoS tactics, which illustrate how botnets and other distributed systems are employed to execute attacks.

Reveal Solution Next Question

QUESTION: 11

You have an Aruba Mobility Controller (MC). for which you are already using Aruba ClearPass Policy Manager (CPPM) to authenticate access to the Web Ul with usernames and passwords You now want to enable managers to use certificates to log in to the Web Ul CPPM will continue to act as the external server to check the names in managers' certificates and tell the MC the managers' correct rote in addition to enabling certificate authentication. what is a step that you should complete on the MC?

Verify that the MC has the correct certificates, and add RadSec to the RADIUS server configuration for CPPM
install all of the managers' certificates on the MC as OCSP Responder certificates
Verify that the MC trusts CPPM's HTTPS certificate by uploading a trusted CA certificate Also, configure a CPPM username and password on the MC
Create a local admin account mat uses certificates in the account, specify the correct trusted CA certificate and external authentication

Answer(s): C

Explanation:

To enable managers to use certificates to log into the Web UI of an Aruba Mobility Controller (MC), where Aruba ClearPass Policy Manager (CPPM) acts as the external server for authentication, it is essential to ensure that the MC trusts the HTTPS certificate used by CPPM. This involves uploading a trusted CA certificate to the MC that matches the one used by CPPM. Additionally, configuring a username and password for CPPM on the MC might be necessary to secure and facilitate communication between the MC and CPPM. This setup ensures that certificate-based authentication is securely validated, maintaining secure access control for the Web UI.
:
Aruba Mobility Controller configuration guides that detail the process of setting up certificate-based authentication.
Best practices for secure authentication and certificate management in enterprise network environments.

Reveal Solution Next Question

QUESTION: 12

A company has Aruba Mobility Controllers (MCs). Aruba campus APs. and ArubaOS-CX switches. The company plans to use ClearPass Policy Manager (CPPM) to classify endpoints by type The ClearPass admins tell you that they want to run Network scans as part of the solution What should you do to configure the infrastructure to support the scans?

Create a TA profile on the ArubaOS-Switches with the root CA certificate for ClearPass's HTTPS certificate
Create device fingerprinting profiles on the ArubaOS-Switches that include SNMP. and apply the profiles to edge ports
Create remote mirrors on the ArubaOS-Swrtches that collect traffic on edge ports, and mirror it to CPPM's IP address.
Create SNMPv3 users on ArubaOS-CX switches, and make sure that the credentials match those configured on CPPM

Answer(s): D

Explanation:

To configure the infrastructure to support network scans as part of the ClearPass Policy Manager (CPPM) solution, creating SNMPv3 users on ArubaOS-CX switches is necessary. Ensuring that the credentials for these SNMPv3 users match those configured on CPPM is crucial for enabling CPPM to perform network scans effectively. SNMPv3 provides a secure method for network management by offering authentication and encryption, which are essential for safely conducting scans that classify endpoints by type. This configuration allows CPPM to communicate securely with the switches and gather necessary data without compromising network security.
:
ArubaOS-CX configuration manuals that discuss SNMP settings. Network management and security guidelines that emphasize the importance of secure SNMP configurations for network scanning and monitoring.

Reveal Solution Next Question

QUESTION: 13

You have deployed a new Aruba Mobility Controller (MC) and campus APs (CAPs). One of the WLANs enforces 802.IX authentication lo Aruba ClearPass Policy Manager {CPPM) When you test connecting the client to the WLAN. the test falls You check Aruba ClearPass Access Tracker and cannot find a record of the authentication attempt You ping from the MC to CPPM. and the ping is successful.
What is a good next step for troubleshooting?

Renew CPPM's RADIUS/EAP certificate
Reset the user credentials
Check CPPM Event viewer.
Check connectivity between CPPM and a backend directory server

Answer(s): C

Explanation:

When dealing with a failed 802.1X authentication attempt to a WLAN enforced by Aruba ClearPass Policy Manager (CPPM) where no record of the attempt is seen in ClearPass Access Tracker, a good next troubleshooting step is to check the CPPM Event Viewer. Since you are able to successfully ping from the Mobility Controller to CPPM, this indicates that there is network connectivity between these two devices. The lack of a record in Access Tracker suggests that the issue may not be with the RADIUS/EAP certificate or user credentials, but possibly with the ClearPass service itself or its reception of authentication requests. The Event Viewer can provide detailed logs that might reveal internal errors or misconfigurations within CPPM that could prevent it from processing authentication attempts properly.

Reveal Solution Next Question

QUESTION: 14

Refer to the exhibit.

This company has ArubaOS-Switches. The exhibit shows one access layer switch, Swllcn-2. as an example, but the campus actually has more switches. The company wants to slop any internal users from exploiting ARP
What Is the proper way to configure the switches to meet these requirements?

On Switch-1, enable ARP protection globally, and enable ARP protection on ail VLANs.
On Switch-2, make ports connected to employee devices trusted ports for ARP protection
On Swltch-2, enable DHCP snooping globally and on VLAN 201 before enabling ARP protection
On Swltch-2, configure static PP-to-MAC bindings for all end-user devices on the network

Answer(s): C

Explanation:

To prevent users from exploiting Address Resolution Protocol (ARP) on a network with ArubaOS- Switches, the correct approach would be to enable DHCP snooping globally and on VLAN 201 before enabling ARP protection, as stated in option C. DHCP snooping acts as a foundation by tracking and securing the association of IP addresses to MAC addresses. This allows ARP protection to function effectively by ensuring that only valid ARP requests and responses are processed, thus preventing ARP spoofing attacks. Trusting ports that connect to employee devices directly could lead to bypassing ARP protection if those devices are compromised.

The company's goal is to prevent internal users from exploiting ARP within their ArubaOS-Switch network. Let's break down the options:
Option A (Incorrect): Enabling ARP protection globally on Switch-1 and all VLANs is not the best approach. ARP protection should be selectively applied where needed, not globally. It's also not clear why Switch-1 is mentioned when the exhibit focuses on Switch-2. Option B (Incorrect): Making ports connected to employee devices trusted for ARP protection is a good practice, but it's not sufficient by itself. Trusted ports allow ARP traffic, but we need an additional layer of security.
Option C (Correct): This is the recommended approach. Here's why:
DHCP Snooping: First, enable DHCP snooping globally. DHCP snooping helps validate DHCP messages and builds an IP-MAC binding table. This table is crucial for ARP protection to function effectively. VLAN 201: Enable DHCP snooping specifically on VLAN 201 (as shown in the exhibit). This ensures that DHCP messages within this VLAN are validated.
ARP Protection: Once DHCP snooping is in place, enable ARP protection. ARP requests/replies from untrusted ports with invalid IP-to-MAC bindings will be dropped. This prevents internal users from exploiting ARP for attacks like man-in-the-middle.
Option D (Incorrect): While static ARP bindings can enhance security, they are cumbersome to manage and don't dynamically adapt to changes in the network.
:
ArubaOS-Switch Management and Configuration Guide for WB_16_10 - Chapter 15: IP Routing Features
Aruba Security Guide

Reveal Solution Next Question

QUESTION: 15

Which attack is an example or social engineering?

An email Is used to impersonate a Dank and trick users into entering their bank login information on a fake website page.
A hacker eavesdrops on insecure communications, such as Remote Desktop Program (RDP). and discovers login credentials.
A user visits a website and downloads a file that contains a worm, which sell-replicates throughout the network.
An attack exploits an operating system vulnerability and locks out users until they pay the ransom.

Answer(s): A

Explanation:

An example of a social engineering attack is described in option A, where an email is used to impersonate a bank and deceive users into entering their bank login information on a counterfeit website. Social engineering attacks exploit human psychology rather than technical hacking techniques to gain access to systems, data, or personal information. These attacks often involve tricking people into breaking normal security procedures. The other options describe different types of technical attacks that do not primarily rely on manipulating individuals through deceptive personal interactions.

Reveal Solution Next Question

QUESTION: 16

Refer to the exhibit.

You have set up a RADIUS server on an ArubaOS Mobility Controller (MC) when you created a WLAN named "MyEmployees .You now want to enable the MC to accept change of authorization (CoA) messages from this server for wireless sessions on this WLAN.
What Is a part of the setup on the MC?

Create a dynamic authorization, or RFC 3576, server with the 10.5.5.5 address and correct shared secret.
Install the root CA associated with the 10 5.5.5 server's certificate as a Trusted CA certificate.
Configure a ClearPass username and password in the MyEmployees AAA profile.
Enable the dynamic authorization setting in the "clearpass" authentication server settings.

Answer(s): A

Explanation:

To enable an ArubaOS Mobility Controller (MC) to accept Change of Authorization (CoA) messages from a RADIUS server for wireless sessions on a WLAN, part of the setup on the MC involves creating a dynamic authorization, or RFC 3576, server with the provided IP address (10.5.5.5) and the correct shared secret. This setup allows the MC to handle CoA requests, which are used to change the authorization attributes of a session after it has been authenticated, such as disconnecting a user or changing a user's VLAN assignment.

Reveal Solution Next Question

HP HPE6-A78 Exam (page: 2) HP Aruba Certified Network Security Associate Exam Updated on: 12-Feb-2026

QUESTION: 9

Explanation:

QUESTION: 10

Explanation:

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

QUESTION: 16

Explanation:

HP HPE6-A78 Exam (page: 2)
HP Aruba Certified Network Security Associate Exam
Updated on: 12-Feb-2026