QUESTION: 17

A company has HPE Aruba Networking Central-managed APs. The company wants to block all clients connected through the APs from using YouTube.

Which steps should you take?

Deploy gateways and have the APs tunnel traffic to the gateways. Then, enable the gateway IDS/IPS engine.
Enable Client IPS at the "custom" level, and then specify the check for YouTube.
Enable WebCC on all client firewall roles. Then, create WebCC category rules that deny suspicious URLs.
Enable DPI. Then, create application rules to deny YouTube on the firewall roles.

Answer(s): D

Explanation:

To block all clients connected through HPE Aruba Networking Central-managed APs from accessing YouTube, you should enable DPI (Deep Packet Inspection) and then create application rules to deny YouTube on the firewall roles. DPI allows the network to inspect and classify traffic based on application signatures, making it possible to enforce application-specific policies. By creating rules that specifically block YouTube traffic, you can effectively prevent clients from accessing the service.

Reference:

Aruba Central's documentation on firewall and application control provides detailed instructions on enabling DPI and creating application rules to manage and restrict access to specific applications such as YouTube.

Reveal Solution Next Question

QUESTION: 18

What is one use case for implementing user-based tunneling (UBT) on AOS-CX switches?

Centralizing the distribution of wired traffic without requiring HPE Aruba Networking gateways
Tunneling traffic directly to a third-party firewall in a client data center
Adding 802.1X while continuing to use the existing VLAN and ACL structure in the Ethernet network
Applying enhanced security features such as deep packet inspection (DPI) to wired traffic

Answer(s): D

Explanation:

Implementing user-based tunneling (UBT) on AOS-CX switches is beneficial for applying enhanced security features such as deep packet inspection (DPI) to wired traffic. UBT allows the traffic from specific users or devices to be tunneled to a central controller or security appliance where advanced security policies, including DPI, can be applied. This approach ensures that even wired traffic benefits from the same level of security and inspection typically available for wireless traffic, thus enhancing overall network security.

Reference:

Aruba's documentation on UBT and AOS-CX configuration guides detail how to set up user-based tunneling and the benefits of applying advanced security features like DPI to tunneled traffic.

Reveal Solution Next Question

QUESTION: 19

A company has HPE Aruba Networking APs running AOS-10 that connect to AOS-CX switches. The

APs will:

. Authenticate as 802.1X supplicants to HPE Aruba Networking ClearPass Policy Manager (CPPM) . Be assigned to the "APs" role on the switches
. Have their traffic forwarded locally

What information do you need to help you determine the VLAN settings for the "APs" role?

Whether the APs have static or DHCP-assigned IP addresses
Whether the switches are using local user-roles (LURs) or downloadable user-roles (DURs)
Whether the switches have established tunnels with an HPE Aruba Networking gateway
Whether the APs bridge or tunnel traffic on their SSIDs

Answer(s): D

Explanation:

To determine the VLAN settings for the "APs" role on AOS-CX switches, it is crucial to know whether the APs bridge or tunnel traffic on their SSIDs. If the APs are bridging traffic, the VLAN settings on the switch need to align with the VLANs used by the SSIDs. If the APs are tunneling traffic to a controller or gateway, the VLAN settings might differ as the traffic is encapsulated and forwarded through the tunnel. Understanding this aspect ensures that the VLAN configuration on the switches correctly supports the traffic forwarding method employed by the APs.

Reference:

Aruba's AOS-10 and AOS-CX documentation provide guidance on VLAN configuration and traffic forwarding methods, highlighting the importance of aligning VLAN settings with the APs' traffic handling mode.

Reveal Solution Next Question

QUESTION: 20

Your company wants to implement Tunneled EAP (TEAP).

How can you set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to enforce certificated-

based authentication for clients using TEAP?

For the service using TEAP, set the authentication source to an internal database.
Select a service certificate when you specify TEAP as a service's authentication method.
Create an authentication method named "TEAP" with the type set to EAP-TLS.
Select an EAP-TLS-type authentication method for the TEAP method's inner method.

Answer(s): D

Explanation:

To set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to enforce certificate-based authentication for clients using Tunneled EAP (TEAP), you need to select an EAP-TLS-type authentication method for TEAP's inner method. TEAP allows for a combination of certificate-based (EAP-TLS) and password-based (EAP-MSCHAPv2) authentication. By choosing EAP-TLS as the inner method, you ensure that the clients are authenticated using their certificates, thus enforcing certificate-based authentication within the TEAP framework.

Reference:

Aruba ClearPass documentation provides detailed steps for configuring TEAP and selecting appropriate inner authentication methods to ensure secure certificate-based client authentication.

Reveal Solution Next Question

Free HPE7-A02 Exam Braindumps (page: 6)

QUESTION: 17

Explanation:

Reference:

QUESTION: 18

Explanation:

Reference:

QUESTION: 19

Explanation:

Reference:

QUESTION: 20

Explanation:

Reference: