HP HPE6-A78 Exam Prep
Aruba Certified Network Security Associate Exam (Page 8 )

• Core idea: Diffie-Hellman (DH) by itself only establishes a shared secret; it does not authenticate who you’re talking to. If the exchange is unauthenticated, it’s vulnerable to a man-in-the-middle (MITM) attack.
• How MITM works in this context: An attacker intercepts the DH public values exchanged by the two legitimate parties and substitutes their own values. Each party then ends up with a shared secret with the attacker, not with the intended peer.
• Consequences: The attacker can decrypt, read, and possibly modify messages between the two parties, all without either party realizing.
• Why the other options are not correct:

• A — Reports: Reports are informational and don’t enforce access during an SSO transaction.
• B — Apex trigger and Permission Sets: A trigger could update permissions when a Case changes, but this creates synchronization and timing issues. It also changes Salesforce permissions rather than making a direct, real-time decision for the external system.
• C — Custom SAML JIT Provisioning: JIT provisioning is primarily for creating or updating users at login. It isn’t the appropriate mechanism for dynamically querying business records and deciding whether access should be granted.
• D — Connected App Handler: Designed for custom, programmatic control during connected-app authentication and authorization. Apex can check the user’s current open classified cases and permit or reject the SSO request.

1. Create a custom Sensitive Information Type (SIT) in the Microsoft Purview portal.
2. Use a regular expression to match the 32-character alphanumeric account number.
3. Reference that SIT in the DLP policy protecting SharePoint Online.

• Format-based data ? custom SIT with RegEx
• Built-in sensitive data ? Microsoft-provided SIT
• Document classification/protection ? sensitivity labels
• Security investigation queries ? Advanced Hunting, not DLP detection

• A — VARIANT "null" values are not the same as SQL NULL: Correct.

• B — Frequent, single-row DMLs: Incorrect.

• C — Validate data before loading into the target table: Correct.

• D — Use staging tables to manage MERGE statements: Correct.

• Personally identifiable information (PII) detection

• Prompt Shields

• Self-harm content filtering addresses self-harm-related content.
• Violence content filtering addresses violent content.
• Neither protects customer PII or detects document-based prompt injection.

• Restarting the device: may fix software problems, but not a directional connection issue.
• Swollen battery: is a safety concern, but would not typically cause recognition only in one orientation.
• Failing cable: possible in general, but less likely because it works on other similar devices.
• Dirty or damaged port: best matches the symptoms. Inspect and carefully clean the port, or have it serviced if damaged.

• Creating and managing users and roles
• Granting and revoking roles and privileges
• Managing access-control responsibilities

• SYSADMIN: Manages warehouses, databases, schemas, and other objects—not primarily users and roles.
• PUBLIC: Automatically granted to every user; it is not an administrative role.
• ACCOUNTADMIN: Has the highest level of access, but should be reserved for account-level administration and emergencies rather than routine security tasks.

• Restarting the device: May fix software glitches, but would not usually make cable orientation matter.
• Swollen battery: A safety concern, but it would not typically cause recognition only in one cable orientation.
• Failing cable: Possible, but less likely because the problem occurs with this particular device and not other devices of the same type.

• Generates a syslog message
• Shuts down the PoE port
• Places the port into error-disabled (err-disabled) state
• Frees the power allocation

• A device starting to draw power does not necessarily generate a syslog message.
• Monitoring does not pause data traffic while checking power.
• Drawing less than the configured minimum does not automatically mean the device has failed and should be disconnected.

• Planning — identify the need, objectives, resources and feasibility.
• Analysis — determine user requirements and examine the existing system.
• Design — specify how the new system will work.
• Implementation — build, test, install and introduce the system.
• Maintenance/evaluation — monitor and improve the system after implementation.

• A. Extranet
• B. VLAN
• C. Intranet
• D. VPN

• Fileless malware: Nothing in the command indicates malware executing only in memory.
• Living-off-the-land binaries: Mimikatz is a credential-access tool, not a normal system utility used for LOLBin abuse.
• Social engineering: The command shows technical credential abuse, not manipulation of an accountant.

• The user authenticates with the external Identity Provider.
• Salesforce receives the SAML assertion.
• Salesforce uses attributes in that assertion—such as username, email, first name, last name, and profile/community information—to create the user during the first login.
• On later logins, Salesforce updates or uses the existing user record.

• On-the-fly provisioning is a general phrase; the Salesforce capability being tested is specifically JIT provisioning.
• Salesforce APIs would require a separate integration and provisioning process.
• Identity Connect is designed primarily to synchronize users from an identity directory, not to create users at the moment of their first SAML login.

• AWS Budgets lets you create a cost or usage budget and configure alerts when actual or forecasted spending reaches a threshold. Notifications can be sent through email or Amazon SNS.
• Amazon CloudWatch can monitor AWS billing metrics and trigger an alarm when estimated charges exceed a specified amount.

• Amazon SQS is a message queue, not a cost-monitoring service.
• Cost Explorer analyzes spending but does not directly provide threshold notifications.
• AWS Cost and Usage Report delivers detailed billing data for analysis; it does not itself send threshold alerts.

• ADF: Automatic Document Feeder; a printer/scanner hardware component.
• USB: A short-range wired connection, not a protocol for accessing a remote shared folder.
• PCL: Printer Control Language; it describes how print jobs are formatted, not how files or printers are shared over a network.

• Looking up accounts, contacts, and opportunities
• Logging calls and updating Salesforce records
• Accessing previously available customer information when temporarily offline

• Salesforce Touch App: Primarily an older tablet-focused experience, not the best general solution for the sales team.
• Custom hybrid app: Unnecessary development when Salesforce provides the required capabilities natively.
• SalesforceA: Intended mainly for Salesforce administrators, not sales representatives.

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

• Internal interface ? connected toward the corporate network/internal firewall
• External interface ? connected toward the Internet-facing firewall

1. A route for the internal corporate network through the internal-facing interface/firewall.
2. A default route (0.0.0.0/0) through the Internet-facing interface/firewall.

• Red team: Simulates attackers; exploits weaknesses to test security.
• Blue team: Defends systems; monitors, detects, and responds to attacks.
• Purple team: Combines red- and blue-team efforts to improve detection and defense.
• White team: Oversees or manages the test, defining rules, scope, and authorization.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio management
• Data governance
• Risk management
• Compliance

• B: Trigger.Once + scheduled job

• C: 10-minute processing-time trigger

• Remote and global access: Employees can authenticate from anywhere, not just a specific location.
• Seamless login: The device can authenticate in the background, reducing repeated password or MFA prompts.
• Minimal equipment: It uses devices employees already have, rather than requiring separate hardware.

• Geotagging: Identifies location but is not a complete authentication method and can be spoofed.
• Smart cards: Can provide strong authentication, but require cards and often readers, adding equipment and user steps.
• Time-based logins: Restrict access by time but do not verify the user or device adequately.

• vBond — orchestration plane: Authenticates devices, helps them discover each other, and assists with NAT traversal and initial control-connection setup.
• vSmart — control plane: Distributes routing and policy information to WAN Edge devices using the overlay control plane.
• vManage — management plane: Provides centralized configuration, monitoring, and orchestration through its GUI/API.
• WAN Edge — data plane: Forwards user traffic across the SD-WAN fabric.

• You provision the virtual machine.
• You manage the guest operating system, applications, and configuration.
• Azure manages the physical servers, datacenter, and underlying virtualization infrastructure.

• A — Add a Path for Stage: A Path lets users update the Opportunity’s Stage directly from the record page, without opening the full edit form. It can also display guidance and key fields.
• B — Use a Kanban list view: Users can move Opportunities between stages by dragging records between columns, which is ideal when Stage is the only field they normally change.

• Planning – identifying the need, objectives, scope and resources.
• Analysis – understanding business requirements and current problems.
• Design/development – determining how the system will work.
• Implementation – installing the system and putting it into operation.

• GPU: A failure may cause no video output, but the PC usually still powers on.
• RAM: Can prevent booting or produce error beeps, but fans and power indicators generally work.
• CPU: Can prevent startup or booting, but it usually does not cause a completely lifeless system.

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• A: Security groups do not control traffic to an S3 gateway endpoint in this way. Gateway endpoints are configured through route tables.
• B: An S3 bucket policy may be needed for authorization, but the error specifically indicates a connectivity or endpoint-routing problem.
• C: Glue connection settings do not require a fully qualified domain name to resolve this endpoint issue.

• Matching hashes: The software is unchanged.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality.
• Baselines: Define approved configurations or normal performance.
• Tokenization: Replaces sensitive data with tokens.

• How quickly the vendor must respond to an incident or request
• Target resolution times
• Availability or uptime requirements
• Performance metrics and penalties for not meeting them

• SOW (Statement of Work): Describes the project’s scope, tasks, deliverables, and timeline.
• MOA (Memorandum of Agreement): Documents a formal agreement to cooperate or perform specific activities.
• MOU (Memorandum of Understanding): Records a mutual understanding or intent, often less binding than a contract.

• BIOS language support: Useful for usability, but not whether the PC can operate electrically.
• Supply chain security: Concerns procurement and hardware trust, not deployment across countries.
• Power efficiency: Important for energy usage, but it does not ensure compatibility with local power systems.

• Use private connectivity from a cloud provider
• Set up SSO for federated authentication

• Private connectivity—such as a cloud provider’s private endpoint—keeps Snowflake access within the company’s private network path instead of exposing access over the public internet. This fits the VPN/VDI requirement.
• SSO for federated authentication allows Snowflake users to authenticate using the credentials already managed by the company’s identity provider—the same identity system used for VDI—eliminating separate Snowflake passwords.

• Tri-Secret Secure protects encryption keys; it does not provide private network access or credential reuse.
• A proxy Snowflake account outside the VPN conflicts with the requirement that Snowflake have no internet visibility and is not the normal solution for federated login reuse.

• A — Custom Button: A button can launch a flow, typically by passing the flow’s URL and record context.
• D — From a Process: A Process can invoke a flow using an Apex action configured for flow invocation. However, this is automation-triggered, not directly accessed by a user.
• B — Quick Action: In current Salesforce functionality, a Flow Quick Action can launch a screen flow directly from a record page. This makes B a valid modern method.
• C — Visual Workflow Launcher: This is not generally listed as a standard access method in current Salesforce terminology; Salesforce commonly uses the Flow component on Lightning pages instead.

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

• A laptop
• Software access
• A password reset
• A mobile phone

• They run behind the scenes — applies more to automation or workflows.
• They are optional — catalog items are fundamental to a request-based catalog.
• They provide options — variables and variable options collect the requester’s choices for an item; they are not the catalog item itself.

• Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.
• Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.
• Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

• Contributor access to Production (F), because that could allow changes or deployment there.
• Viewer access to Development/Test (C), because Viewer is insufficient for deployment.
• Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

• nomes de pessoas;
• organizações;
• locais;
• datas;
• números de processos;
• leis ou contratos.

• NER = identifica informações específicas e classificáveis.
• Sumarização = reduz um documento e apresenta seus pontos principais.

• Azure creates a corresponding service principal in Microsoft Entra ID.
• The identity’s lifecycle is tied to the Azure resource.
• If the resource is deleted, Azure automatically deletes the identity.
• Only the associated resource can use that identity to request tokens.
• You can grant the identity permissions to access services such as Key Vault or Storage without storing credentials in code.

• Elicited and documented customer requirements
• Converted them into clear, measurable specifications
• Validated the requirements with the customer
• Used them as the basis for design, quality checks, and acceptance

• A: Requirements should reflect the customer’s needs—not the supplier’s standards.
• B: Iteration review planning does not replace proper requirements collection.
• D: A retrospective occurs after work is completed and is mainly for process improvement, not initial requirements definition.

• B — Single customer login across properties: Customer 360 Identity provides centralized identity services, allowing an organization to recognize a customer across multiple digital properties and applications. This helps UC understand authenticated activity as part of a broader customer identity.

• C — Multi-brand support: Customer 360 Identity can support multiple brands and user experiences. Identity services can remain centralized while correlating a customer’s activity across different corporate brands or channels.

• A: Customer 360 Identity does not automatically populate all data into Customer 360 Data Manager and Customer 360 Audiences. Integration and data configuration are still required.
• D: Tracking anonymous activity and linking it after sign-up may be possible through broader customer-data and tracking implementations, but it is not the primary Customer 360 Identity benefit tested here. Identity focuses mainly on authentication, registration, and cross-property identity correlation.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually does not provide dedicated file-upload malware scanning. It is generally detective rather than preventive.
• C. Load balancer: Distributes traffic among servers and improves availability; it does not inspect documents for malware.
• D. WAF: Helps block web-application attacks such as SQL injection, command injection, and XSS. Although a WAF may inspect upload requests, malware detection in PDF files is more directly addressed by antivirus or content-scanning functionality.

• Azure Machine Learning is the overall Azure service.
• Machine Learning designer is the visual, drag-and-drop interface within Azure Machine Learning.
• Microsoft may refer to the broader product as Azure Machine Learning studio, while “Designer” remains the specific visual workflow tool.

• Azure Logic Apps: Workflow and integration automation.
• Azure Batch: Large-scale parallel or batch compute.
• Azure Cosmos DB: Globally distributed NoSQL database.

1. Selling price per unit: $750
2. Required annual return:

1. Required profit per unit:

1. Target cost per unit:

• Basic: No technical or architectural guidance.
• Standard: Technical support, but not the required design-assessment service.
• Professional Direct: Provides advisory and architecture guidance.
• Premier: Provides it too, but is unnecessarily expensive for this requirement.

• Monitoring: Detects activity but does not remove the underlying risk.
• Patching: Useful for systems that must remain operational, but these desktops are unused.
• Isolating: Can be a temporary containment measure, but permanently removing unnecessary systems is more appropriate.

• Who performed the action
• What action occurred
• When it occurred
• Where it originated
• Whether it succeeded or failed

• Investigating suspicious activity: Important, but investigation depends on having adequate audit data first.
• Storage allocation: Necessary for retention, but storage does not help if the records lack meaningful details.
• Actions after audit failure: Part of operational planning, not the primary assessment of the application’s audit capability.

• Prevent connections to malware command-and-control servers
• Identify infected systems making those DNS requests
• Collect information for incident response

• A: Attackers do not normally use sinkholes to map a company’s domain structure.
• B: Redirecting employees from legitimate sites to attacker-owned sites describes malicious DNS manipulation, not a defensive sinkhole.
• D: Attracting attackers away from real resources is more closely associated with a honeypot or deception system.

• A. Microsoft 365 group with Assigned membership
• C. Microsoft 365 group with Dynamic User membership

Why?

• Assigned membership: You explicitly add User1, User2, and User3.
• Dynamic User membership: Membership is automatically determined by a rule based on user attributes.

Why the other options are incorrect

• B and D: Security groups do not support the Microsoft 365 group expiration policy.
• E: Dynamic Device groups are intended for devices, not these users, and are also security groups.

• The VPN gateway is in VirtualNetworkA.
• Gateway transit is configured on the peering associated with the VNet that contains the gateway—here, VirtualNetworkA.
• A peered VNet may use the remote gateway through the appropriate peering option, but this does not automatically update an existing P2S client’s routes.
• The Windows 10 workstation’s P2S VPN client package was created before VirtualNetworkB was peered, so it may not have a route for VirtualNetworkB.