HPE7-A02 Exam Questions and Answers

QUESTION: 17

A company has HPE Aruba Networking APs running AOS-10 that connect to AOS-CX switches. The APs will:

. Authenticate as 802.1X supplicants to HPE Aruba Networking ClearPass Policy Manager (CPPM)

. Be assigned to the "APs" role on the switches

. Have their traffic forwarded locally

What information do you need to help you determine the VLAN settings for the "APs" role?

Whether the APs have static or DHCP-assigned IP addresses
Whether the switches are using local user-roles (LURs) or downloadable user-roles (DURs)
Whether the switches have established tunnels with an HPE Aruba Networking gateway
Whether the APs bridge or tunnel traffic on their SSIDs

Answer(s): D

Explanation:

To determine the VLAN settings for the "APs" role on AOS-CX switches, it is crucial to know whether the APs bridge or tunnel traffic on their SSIDs. If the APs are bridging traffic, the VLAN settings on the switch need to align with the VLANs used by the SSIDs. If the APs are tunneling traffic to a controller or gateway, the VLAN settings might differ as the traffic is encapsulated and forwarded through the tunnel. Understanding this aspect ensures that the VLAN configuration on the switches correctly supports the traffic forwarding method employed by the APs.

Reference:

Aruba's AOS-10 and AOS-CX documentation provide guidance on VLAN configuration and traffic forwarding methods, highlighting the importance of aligning VLAN settings with the APs' traffic handling mode.

Reveal Solution Next Question

QUESTION: 18

Your company wants to implement Tunneled EAP (TEAP).

How can you set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to enforce certificated- based authentication for clients using TEAP?

For the service using TEAP, set the authentication source to an internal database.
Select a service certificate when you specify TEAP as a service's authentication method.
Create an authentication method named "TEAP" with the type set to EAP-TLS.
Select an EAP-TLS-type authentication method for the TEAP method's inner method.

Answer(s): D

Explanation:

To set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to enforce certificate-based authentication for clients using Tunneled EAP (TEAP), you need to select an EAP-TLS-type authentication method for TEAP's inner method. TEAP allows for a combination of certificate-based (EAP-TLS) and password-based (EAP-MSCHAPv2) authentication. By choosing EAP-TLS as the inner method, you ensure that the clients are authenticated using their certificates, thus enforcing certificate-based authentication within the TEAP framework.

Reference:

Aruba ClearPass documentation provides detailed steps for configuring TEAP and selecting appropriate inner authentication methods to ensure secure certificate-based client authentication.

Reveal Solution Next Question

QUESTION: 19

Admins have recently turned on Wireless IDS/IPS infrastructure detection at the high level on HPE Aruba Networking APs.
When you check WIDS events, you see several RTS rate and CTS rate anomalies, which were triggered by neighboring APs.

What can you interpret from this event?

These neighboring APs are likely to be wireless clients that are inappropriately bridging their wired and wireless NICs; you should track down and remove them.
These neighboring APs might be hackers trying to launch a DoS, but are more likely operating normally; you should start by tuning the event thresholds.
These neighboring APs are actually rogue APs, and you should enable wireless tarpit containment on them.
These neighboring APs are actually rogue APs, and you should enable wireless de-authentication containment on them.

Answer(s): B

Explanation:

When Wireless IDS/IPS infrastructure detection reports RTS (Request to Send) and CTS (Clear to Send) rate anomalies triggered by neighboring APs, it is often an indication of unusual, but not necessarily malicious, behavior. These anomalies can be caused by neighboring APs operating normally but under specific conditions that trigger the alerts. Before assuming a security threat, it is recommended to tune the event thresholds to better match the environment and reduce false positives. This approach helps to distinguish between normal operations and potential DoS attacks.

Reference:

Aruba's Wireless IDS/IPS configuration guides provide information on interpreting events, adjusting thresholds, and distinguishing between legitimate and malicious activities in a wireless network environment.

Reveal Solution Next Question

QUESTION: 20

HPE Aruba Networking Central displays an alert about an Infrastructure Attack that was detected. You go to the Security > RAPIDS events and see that the attack was "Detect adhoc using Valid SSID."

What is one possible next step?

Use HPE Aruba Networking Central floorplans or the detecting AP identities to locate the general area for the threat.
Look for the IP address associated with the offender and then check for that IP address among HPE Aruba Networking Central clients.
Make sure that you have tuned the threshold for that check, as false positives are common for it.
Make sure that clients have updated drivers, as faulty drivers are a common explanation for this attack type.

Answer(s): A

Explanation:

When HPE Aruba Networking Central detects an Infrastructure Attack, such as "Detect adhoc using

Valid SSID," the next step is to locate the general area of the threat. You can use HPE Aruba Networking Central floorplans or the identities of the detecting APs to pinpoint the approximate location of the adhoc network. This allows you to physically investigate and address the source of the threat, ensuring that unauthorized or rogue networks are quickly identified and mitigated.

Reference:

Aruba Central documentation and RAPIDS events management guides offer strategies for locating and responding to detected security threats, emphasizing the use of network tools and floorplans to effectively address potential vulnerabilities.

Reveal Solution Next Question

QUESTION: 21

A company has a variety of HPE Aruba Networking solutions, including an HPE Aruba Networking infrastructure and HPE Aruba Networking ClearPass Policy

Manager (CPPM). The company passes traffic from the corporate LAN destined to the data center through a third-party SRX firewall. The company would like to further protect itself from internal threats.

What is one solution that you can recommend?

Have the third-party firewall send Syslogs to CPPM, which can work with network devices to lock internal attackers out of the network.
Use tunnel mode SSIDs and user-based tunneling (UBT) on AOS-CX switches to pass all internal traffic directly through the third-party firewall.
Add ClearPass Device Insight (CPDI) to the solution; integrate it with the third-party firewall to develop more complete device profiles.
Configure CPPM to poll the third-party firewall for a broad array of information about internal clients, such as profile and posture.

Answer(s): A

Explanation:

To further protect the company from internal threats, you can recommend having the third-party SRX firewall send Syslogs to HPE Aruba Networking ClearPass Policy Manager (CPPM). ClearPass can analyze these logs to detect potential security incidents and coordinate with network devices to respond to threats. By integrating Syslog data from the firewall, CPPM can identify malicious activities and take actions such as locking internal attackers out of the network or triggering specific security policies. This approach enhances the company's internal threat detection and response capabilities.

Reference:

Aruba's ClearPass documentation on integrating with third-party security solutions and utilizing Syslog data for enhanced network security provides detailed guidance on setting up and using these features.

Reveal Solution Next Question

QUESTION: 22

A company wants to apply a standard configuration to all AOS-CX switch ports and have the ports dynamically adjust their configuration based on the identity of the user or device that connects. They want to centralize configuration of the identity-based settings as much as possible.

What should you recommend?

Having HPE Aruba Networking ClearPass Policy Manager (CPPM) send standard RADIUS AVPs to customize port settings
Having switches pull port configurations dynamically from HPE Aruba Networking Activate
Having switches download user-roles from HPE Aruba Networking gateways
Having switches download user-roles from HPE Aruba Networking ClearPass Policy Manager (CPPM)

Answer(s): D

Explanation:

For a company that wants to apply a standard configuration to all AOS-CX switch ports and dynamically adjust their configuration based on the identity of the user or device that connects, the best approach is to have the switches download user-roles from HPE Aruba Networking ClearPass Policy Manager (CPPM). This method centralizes the configuration of identity-based settings in

CPPM, allowing it to dynamically assign roles and policies to switch ports based on authentication and authorization results. This ensures consistent and secure network access control tailored to each user or device.

Reference:

Aruba ClearPass and AOS-CX documentation provide comprehensive details on configuring user-roles, dynamic port configuration, and integrating ClearPass for centralized identity- based network management.

Reveal Solution Next Question

QUESTION: 23

A company issues user certificates to domain computers using its Windows CA and the default user certificate template. You have set up HPE Aruba Networking

ClearPass Policy Manager (CPPM) to authenticate 802.1X clients with those certificates. However, during tests, you receive an error that authorization has failed because the usernames do not exist in the authentication source.

What is one way to fix this issue and enable clients to successfully authenticate with certificates?

Configure rules to strip the domain name from the username.
Change the authentication method list to include both PEAP MSCHAPv2 and EAP-TLS.
Add the ClearPass Onboard local repository to the authentication source list.
Remove EAP-TLS from the authentication method list and add TEAP there instead.

Answer(s): A

Explanation:

To fix the issue where authorization fails because the usernames do not exist in the authentication source, you can configure rules in HPE Aruba Networking ClearPass Policy Manager (CPPM) to strip the domain name from the username.
When certificates are issued by a Windows CA, the username in the certificate often includes the domain (e.g., user@domain.com). ClearPass might not be able to find this format in the authentication source. By stripping the domain name, you ensure that ClearPass searches for just the username (e.g., user) in the authentication source, allowing successful authentication.

Reference:

ClearPass configuration guides and documentation on certificate-based authentication detail the process of modifying and normalizing usernames to ensure successful authentication against authentication sources.

Reveal Solution Next Question

QUESTION: 24

You need to use "Tips:Posture" conditions within an 802.1X service's enforcement policy.

Which guideline should you follow?

Enable caching roles and posture attributes from previous sessions in the service's enforcement settings.
Create rules that assign postures in the service's role mapping policy.
Enable profiling in the service's general settings.
Select the Posture Policy type for the service's enforcement policy.

Answer(s): A

Explanation:

When using "Tips

" conditions within an 802.1X service's enforcement policy, you should enable caching roles and posture attributes from previous sessions in the service's enforcement settings. This ensures that ClearPass retains posture information from previous authentications, which is necessary for making decisions based on the current posture state of an endpoint. By caching these attributes, ClearPass can apply appropriate enforcement actions based on the device's posture status.

Reference:

Aruba ClearPass documentation provides guidelines on configuring enforcement policies and using posture attributes effectively, including the importance of caching for maintaining posture information across sessions.

Reveal Solution Next Question

HP HPE7-A02 Exam (page: 3) HP Aruba Certified Network Security Professional Updated on: 12-Feb-2026

QUESTION: 17

Explanation:

Reference:

QUESTION: 18

Explanation:

Reference:

QUESTION: 19

Explanation:

Reference:

QUESTION: 20

Explanation:

Reference:

QUESTION: 21

Explanation:

Reference:

QUESTION: 22

Explanation:

Reference:

QUESTION: 23

Explanation:

Reference:

QUESTION: 24

Explanation:

Reference:

HP HPE7-A02 Exam (page: 3)
HP Aruba Certified Network Security Professional
Updated on: 12-Feb-2026