QUESTION: 32

What is the best practice for handling voice traffic with dynamic segmentation on AOS-CX switches?

Switch authentication and local forwarding of the voice traffic
Switch authentication and user-based tunneling of the voice traffic.
Central authentication and port-based tunneling of the voice traffic.
Controller authentication and port-based tunneling of all traffic

Answer(s): A

Explanation:

This is the best practice for handling voice traffic with dynamic segmentation on AOS-CX switches. Dynamic segmentation is a feature that allows AOS-CX switches to tunnel user traffic to a controller or another switch based on user roles and policies. For voice traffic, it is recommended to use switch authentication and local forwarding, which means the voice devices are authenticated by the switch and their traffic is forwarded locally without tunneling. This reduces latency and jitter for voice traffic and improves voice quality. The other options are incorrect because they either use central authentication or tunneling, which are not optimal for voice traffic.

Reference:

https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch05.html https://www.arubanetworks.com/assets/ds/DS_AOS-CX.pdf

Reveal Solution Next Question

QUESTION: 33

A network administrator is attempting to troubleshoot a connectivity issue between a group of users and a particular server The administrator needs to examine the packets over a period of time from their desktop; however, the administrator is not directly connected to the AOS-CX switch involved with the traffic flow.

What statements are correct regarding the ERSPAN session that needs to be established on an AOS- CX switch'? (Select two )

On the source AOS-CX switch, the destination specified is the switch to which the administrator's desktop is connected
The encapsulation protocol used is GRE.
The encapsulation protocol used is VXLAN.
The encapsulation protocol is UDP.
On the source AOS-CX switch, the destination specified is the administrators desktop

Answer(s): B,E

Explanation:

These are the correct statements regarding the ERSPAN session that needs to be established on an AOS-CX switch for a network administrator to examine the packets over a period of time from their desktop. ERSPAN (Encapsulated Remote Switched Port Analyzer) is a feature that allows an AOS-CX switch to mirror traffic from one or more source ports or VLANs to a remote destination IP address over a GRE (Generic Routing Encapsulation) tunnel. The destination IP address must be the IP address of the administrator's desktop, which must have a packet capture tool installed to receive and analyze the mirrored traffic. The encapsulation protocol used for ERSPAN is GRE, which adds a header to the mirrored packets with information such as source and destination IP addresses, session ID, etc. The other statements are incorrect because they either do not specify the correct destination IP address or do not use ERSPAN or GRE.

Reference:

https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch02.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch03.html

Reveal Solution Next Question

QUESTION: 34

On AOS10 Gateways, which device persona is only available when configuring a Gateway-only group'?

Edge
Mobility
Branch
VPN Concentrator

Answer(s): B

Explanation:

AOS 10 Gateways can have the following personas: Mobility, Branch, and VPN Concentrator1 However, the Mobility persona is only available when configuring a Gateway-only group, which is a group that contains only one gateway device2 The Mobility persona provides Overlay WLAN and (or) wired LAN functionalities for campus networks1 The Branch persona provides the Aruba Instant OS and SD-Branch (LAN + WAN) functionality for branch and microbranch networks1 The VPN Concentrator persona provides VPN termination and routing functionality for remote access networks3 The Edge persona is not a valid option, as it is not a supported device persona for AOS 10 Gateways.

Reveal Solution Next Question

QUESTION: 35

A company deployed Dynamic Segmentation with their CX switches and Gateways After performing a security audit on their network, they discovered that the tunnels built between the CX switch and the Aruba Gateway are not encrypted. The company is concerned that bad actors could try to insert spoofed messages on the Gateway to disrupt communications or obtain information about the network.
Which action must the administrator perform to address this situation?

Enable Secure Mode Enhanced
Enable Enhanced security
Enable Enhanced PAPI security
Enable GRE security

Answer(s): C

Explanation:

PAPI is the protocol that is used to establish tunnels between the CX switch and the Aruba Gateway for Dynamic Segmentation. By default, PAPI uses a simple checksum to verify the integrity of the messages, but it does not encrypt the payload. This could expose the network to spoofing or replay attacks by malicious actors. To address this situation, the administrator must enable Enhanced PAPI security, which uses AES-256 encryption and HMAC-SHA1 authentication to protect the tunnel traffic. Enhanced PAPI security can be enabled on the CX switch by using the command system papi enhanced-security enable. This will ensure that the tunnels built between the CX switch and the Aruba Gateway are encrypted and authenticated.

Reveal Solution Next Question

Free HPE7-A01 Exam Braindumps

QUESTION: 32

Explanation:

Reference:

QUESTION: 33

Explanation:

Reference:

QUESTION: 34

Explanation:

QUESTION: 35

Explanation: