2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free HPE HPE7-A02 Network Security Professional Practice Questions

15 free HPE HPE7-A02 Network Security Professional practice questions from the CertStash pack of 118, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 15 free here, all 118 in the pack, and each step includes the one before it.

Get all 118 questions (US$39) · Download the first 10 as a PDF

Question 1

A company uses HPE Networking ClearPass Policy Manager (CPPM) as a TACACS+ server to authenticate managers on its AOS-CX switches. The company wants CPPM to control commands managers are allowed to enter.

Which service must you add to the managers’ TACACS+ enforcement profile?

  1. Cpass: HTTP
  2. Shell
  3. ARAP
  4. Aruba:Common
Show answer and explanation

Correct answer: B. Shell

For CPPM to control which CLI commands a TACACS+ user can enter, the enforcement profile must include the Shell service. The Shell service is where command authorization is defined: the profile lists the commands the user is permitted or denied, and the switch checks each command with CPPM before running it. Without the Shell service, CPPM can authenticate the manager and assign a privilege level, but it has no command set to authorize against.

Why the other options are wrong

  • A. An HTTP service relates to web-based administration access, not to authorizing individual CLI commands.
  • C. ARAP is a legacy AppleTalk Remote Access service and plays no role in AOS-CX command authorization.
  • D. The Aruba:Common service carries attributes such as the admin role name, not per-command authorization rules.

Question 2

An AOS-CX switch has this admin user account configured on it: netadmin in the operators group You have configured these commands on an AOS-CX switch: tacacs-server host cp.example.com key plaintext &12xl.powmay7855 aaa authentication login ssh group tacacs local aaa authentication allow-fail-through A user accesses the switch with SSH and logs in as netadmin with the correct password.

When switch sends a TACACS+ request to the ClearPass server at cp.example.com, the server does not send a response. Authentication times out.

What happens?

  1. The user is logged in and granted operator access.
  2. The user is logged in and allowed to enter auditor commands only.
  3. The user is logged in and granted administrators access.
  4. The user is not allowed to log in.
Show answer and explanation

Correct answer: A. The user is logged in and granted operator access.

The login order is TACACS+ first and then the local database. When the TACACS+ server does not respond and the request times out, the switch treats the server as unreachable and moves to the next method in the list, which is local authentication. The netadmin account exists locally in the operators group, and the user supplied the correct password, so the switch logs the user in with operator privileges. The allow-fail-through command additionally lets the switch try the next method after an explicit reject, but a timeout already triggers the fallback.

Why the other options are wrong

  • B. Auditor privileges would require the local account to belong to the auditors group, but netadmin is in the operators group.
  • C. Administrator access is not granted because the local account that authenticates the user is an operator account.
  • D. The switch falls back to the local database after the timeout, and the local credentials are valid, so login succeeds.

Question 3

You have created this rule in an HPE Aruba Networking ClearPass Policy Manager (CPPM) service’s enforcement policy. IF Authorization [Endpoints Repository] Conflict EQUALS true THEN apply “quarantine_profile”

What information can help you determine whether you need to configure cluster-wide profiler parameters to ignore some conflicts?

  1. Whether the company has devices that use PXE boot
  2. Whether some devices are incapable of captive portal or 802.1X authentication
  3. Whether the company has rare Internet of Things (IoT) devices
  4. Whether some devices are running legacy operating systems
Show answer and explanation

Correct answer: A. Whether the company has devices that use PXE boot

CPPM flags an endpoint conflict when a device's profile changes in a way that suggests spoofing, for example when its DHCP fingerprint suddenly matches a different device type. Devices that use PXE boot legitimately present one DHCP fingerprint during the network boot and a different one once the operating system loads, so they trigger false conflicts. Knowing whether the company has PXE boot devices tells you whether to configure the cluster-wide profiler parameters to ignore those conflicts, so that legitimate devices are not sent to quarantine.

Why the other options are wrong

  • B. Whether a device can perform captive portal or 802.1X affects the authentication method chosen, not how profile conflicts are flagged.
  • C. Rare IoT devices may need custom fingerprints, but a stable device does not change its fingerprint and trigger conflicts.
  • D. A legacy operating system keeps a consistent fingerprint, so it does not by itself cause conflicts.

Question 4

You are setting up HPE Aruba Networking SSE to prohibit users from uploading and downloading files from Dropbox.

What is part of the process?

  1. adding a web category that includes Dropbox
  2. installing the HPE Aruba Networking SSE root certificate on clients
  3. deploying a connector that can reach the remote users
  4. deploying a connector that can reach Dropbox
Show answer and explanation

Correct answer: B. installing the HPE Aruba Networking SSE root certificate on clients

Blocking uploads and downloads within Dropbox, rather than blocking the whole site, requires the SSE to see inside the encrypted HTTPS sessions to identify file transfer actions. That needs TLS inspection, where the SSE decrypts and re-encrypts traffic using its own certificate. For clients to accept the SSE's re-signed certificates without errors, the HPE Aruba Networking SSE root certificate must be installed as trusted on the clients.

Why the other options are wrong

  • A. A web category controls access to whole sites, not specific upload and download actions within an allowed application.
  • C. Connectors give access to private applications in the company's network; they do not reach out to remote users.
  • D. Dropbox is a public SaaS application reached through the SSE's cloud points of presence, so no connector is needed.

Question 5

You are setting up user based tunneling (UBT) between access layer AOS-CX switches and AOS-10 gateways. You have selected reserved (local) VLAN mode.

Tunneled devices include IoT devices, which should be assigned to:

*Roles: iot on the switches and iot-wired on the gateways *VLAN: 64, for which the gateways route traffic IoT devices connect to the access layer switches’ edge ports, and the access layer switches reach the gateways on their uplinks.

Where must you configure VLAN 64?

  1. In the iot-wired role and on no physical interfaces
  2. In the iot role and the iot-wired role and on no physical interfaces
  3. In the iot-wired role and the access switch uplinks
  4. In the iot role and the access switch uplinks
Show answer and explanation

Correct answer: A. In the iot-wired role and on no physical interfaces

In this UBT design, the switch tunnels the IoT devices' traffic to the gateways, and the gateways route traffic for VLAN 64. The client VLAN is therefore assigned by the gateway's role, iot-wired, which places the tunneled traffic into VLAN 64 on the gateway. The access switch does not need VLAN 64 on its edge ports or uplinks because the traffic travels inside the UBT tunnel, not as native 802.1Q traffic on physical interfaces.

Why the other options are wrong

  • B. The switch-side iot role only needs to send the traffic into the tunnel; the client VLAN is assigned by the gateway role.
  • C. Tunneled traffic reaches the gateway inside the UBT tunnel, so VLAN 64 is not needed on the access switch uplinks.
  • D. The VLAN is not set in the switch's iot role, and carrying it on the uplinks defeats the purpose of tunneling.

Question 6

A company has a third-party security appliance deployed in its data center. The company wants to pass all traffic for certain clients through that device before forwarding that traffic toward its ultimate destination.

Which AOS-CX switch technology fulfills this use case?

  1. Virtual Network Based Tunneling (VNBT)
  2. MC-LAG
  3. Network Analytics Engine (NAE)
  4. Device profiles
Show answer and explanation

Correct answer: A. Virtual Network Based Tunneling (VNBT)

Virtual Network Based Tunneling (VNBT) lets AOS-CX switches place selected clients' traffic into VXLAN tunnels. The traffic can then be carried across the network to a specific point in the data center, where it is handed to the third-party security appliance for inspection before it is forwarded to its final destination. This provides a tunneled path for chosen clients without redesigning the underlying network.

Why the other options are wrong

  • B. MC-LAG provides link aggregation across two switches for redundancy and does not steer traffic through a security appliance.
  • C. The Network Analytics Engine monitors and analyzes switch data and does not forward client traffic anywhere.
  • D. Device profiles apply port settings to recognized devices such as APs and do not tunnel traffic to the data center.

Question 7

You manage AOS-10 APs with HPE Aruba Networking Central. A role is configured on these APs with these rules:

1. Allow udp on port 67 to any destination

2. Allow any to network 10.1.6.0/23

3. Deny any to network 10.1.0.0/16 + log

4. Deny any to network 10.0.0.0/8

5. Allow any to any destination

You add this new rule immediately before rule 2:

Deny ssh to network 10.1.4.0/23 + denylist After this change, what happens when a client assigned to this role sends SSH traffic to 10.1.11.42?

  1. The traffic is permitted.
  2. The traffic is dropped and logged.
  3. The traffic is dropped (without any logging or further action against the client).
  4. The traffic is dropped, and the client is denylisted.
Show answer and explanation

Correct answer: B. The traffic is dropped and logged.

Rules are evaluated top down and the first match applies. SSH to 10.1.11.42 is not UDP port 67, so rule 1 does not match. The new SSH rule covers only 10.1.4.0/23 (10.1.4.0 to 10.1.5.255), and rule 2 covers only 10.1.6.0/23 (10.1.6.0 to 10.1.7.255), so neither matches. The next rule, deny any to 10.1.0.0/16 with log, does match, so the traffic is dropped and logged.

Why the other options are wrong

  • A. The traffic matches the deny rule for 10.1.0.0/16 before it can reach the final allow-any rule.
  • C. The matching rule includes the log action, so the drop is logged.
  • D. The denylist action belongs to the rule for 10.1.4.0/23, which does not include 10.1.11.42.

Question 8

HPE Aruba Networking ClearPass Device Insight (CPDI) could not classify some endpoints using system and user rules. Using machine learning, it did assign those endpoints to a cluster and discover a recommendation. In which of these circumstances does CPDI automatically classify the endpoints based on that recommendation?

  1. The recommendation has 96% confidence, and it is based on 13 classified devices.
  2. The recommendation has 98% confidence, and it is based on 5 classified devices.
  3. The recommendation has 93% confidence, and it is based on 36 classified devices.
  4. The recommendation has 100% confidence, and it is based on 4 classified devices.
Show answer and explanation

Correct answer: C. The recommendation has 93% confidence, and it is based on 36 classified devices.

CPDI's machine learning groups unclassified endpoints into clusters and recommends a classification based on similar devices that are already classified. It applies a recommendation automatically only when the recommendation has high confidence and is backed by a sufficiently large set of classified devices, so that a handful of samples cannot drive automatic classification. A recommendation with 93 percent confidence based on 36 classified devices meets both conditions.

Why the other options are wrong

  • A. The confidence is high, but 13 classified devices is too small a sample for automatic classification.
  • B. Five classified devices is too small a sample, however high the confidence.
  • D. Even 100 percent confidence is not enough when it comes from only four classified devices.

Question 9

You are setting up HPE Aruba Networking SSE.

Which use case requires you to apply a non-default posture in a rule?

  1. applying threat inspection to users when they access certain web sites
  2. checking whether a client has antivirus software as a condition for receiving access to resources
  3. redirecting compromised clients to a remediation server
  4. integrating with HPE Aruba Networking ClearPass OnGuard
Show answer and explanation

Correct answer: B. checking whether a client has antivirus software as a condition for receiving access to resources

In HPE Aruba Networking SSE, a posture profile defines device health conditions, such as whether antivirus software is installed and running. The default posture applies no specific checks. To make access to resources depend on whether a client has antivirus software, you create a non-default posture with that check and apply it in the policy rule, so only compliant devices receive access.

Why the other options are wrong

  • A. Threat inspection for web access is set through web and security profiles in the rule, not through posture.
  • C. Redirecting compromised clients to a remediation server is not done by applying a posture in an SSE rule.
  • D. ClearPass OnGuard is a separate on-premises posture agent and does not require a non-default SSE posture.

Question 10

Which statement describes Zero Trust Security?

  1. Companies must apply the same access controls to all users, regardless of identity.
  2. Companies that support remote workers cannot achieve zero trust security and must determine if the benefits outweigh the cost.
  3. Companies should focus on protecting their resources rather than on protecting the boundaries of their internal network.
  4. Companies can achieve zero trust security by strengthening perimeter security to detect a wider range of threats.
Show answer and explanation

Correct answer: C. Companies should focus on protecting their resources rather than on protecting the boundaries of their internal network.

Zero Trust Security assumes that no user or device is trusted simply because it sits inside the network perimeter. Instead of concentrating on defending the boundary of the internal network, organizations protect each resource directly, verifying identity, device posture and context for every access request and granting least-privilege access. The focus therefore moves from the network edge to the resources themselves.

Why the other options are wrong

  • A. Zero trust applies access controls based on identity and context, not the same controls for everyone.
  • B. Zero trust is well suited to remote workers because access decisions do not depend on being on the corporate network.
  • D. Strengthening the perimeter is the traditional model that zero trust moves away from.

Question 11

A company has AOS-CX switches at the access layer, these switches are managed by the HPE Aruba Networking Central. You have identified suspicious activity on a wired client. You want to analyze the client’s traffic with Wireshark, which you have on your management station.

What should you do?

  1. Access the client’s switch’s CLI from your management station. Access the switch shell and run a TCP dump on the client port.
  2. Go to the client’s switch in HPE Aruba Networking Central. Use the “Security” page to run a packet capture.
  3. Set up a policy that implements a captive portal redirect to your management station. Apply that policy to the client’s port.
  4. Set up a mirror session on the client’s switch; set the client port as the source and your station IP address as the tunnel destination.
Show answer and explanation

Correct answer: B. Go to the client’s switch in HPE Aruba Networking Central. Use the “Security” page to run a packet capture.

HPE Aruba Networking Central provides built-in packet capture for the AOS-CX switches it manages. From the client's switch in Central you can start a capture on that switch, and Central collects the packets as a file you can download and open in Wireshark on your management station. This avoids building mirroring sessions or working in the switch shell.

Why the other options are wrong

  • A. The switch shell is not a supported way to capture data plane traffic on a client port for Wireshark analysis.
  • C. A captive portal redirect sends the client's web sessions to a portal and does not capture its traffic.
  • D. A tunneled mirror session takes more configuration than Central's built-in capture and is not the intended workflow here.

Question 12

A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). You have identified a device, which is currently classified as one type, but you want to classify it as a custom type. You also want to classify all devices with similar attributes as this type, both already-discovered devices and new devices discovered later.

What should you do?

  1. Create a user tag from the Generic Devices page, select the desired attributes for the tag, and save the tag.
  2. In the device details, select filter, create a user tag based on the device attributes, and save the tag.
  3. In the device details, select reclassify, create a user rule based on its attributes, and choose “Save & Reclassify.”
  4. Create a user rule from the Generic Devices page, select the desired attributes for the rule, and choose “Save.”
Show answer and explanation

Correct answer: C. In the device details, select reclassify, create a user rule based on its attributes, and choose “Save & Reclassify.”

In CPDI, a user rule defines classification criteria that apply to every matching device. Starting from the device's details and choosing reclassify lets you build a user rule from that device's attributes and assign the custom type. Choosing Save & Reclassify both saves the rule, so newly discovered devices with similar attributes are classified the same way, and reclassifies the devices already discovered.

Why the other options are wrong

  • A. Tags label devices but do not change their classification to a custom type.
  • B. A filter with a user tag only labels devices and does not create a classification rule.
  • D. Choosing Save alone stores the rule for future matches but does not reclassify devices already discovered.

Question 13

A company is using HPE Aruba Networking ClearPass Device Insight (CPDI) (the standalone application). In the CPDI security settings, Security Analysis is On, the Data Source is ClearPass Device Insight, and Enable Posture Assessment is On. You see that device has a Risk Score of 90.

What can you know from this information?

  1. The posture is unknown, and CPDI has detected exactly four vulnerabilities on the device.
  2. The posture is healthy, but CPDI has detected multiple vulnerabilities on the device.
  3. The posture is unhealthy, and CPDI has also detected at least one vulnerability on the device.
  4. The posture is unhealthy, but CPDI has not detected any vulnerabilities on the device.
Show answer and explanation

Correct answer: C. The posture is unhealthy, and CPDI has also detected at least one vulnerability on the device.

With Security Analysis on and posture assessment enabled, CPDI calculates each device's risk score from its posture together with the vulnerabilities it has detected. An unhealthy posture raises the score significantly, and detected vulnerabilities raise it further. A risk score as high as 90 cannot come from posture alone or from vulnerabilities alone, so it shows that the device's posture is unhealthy and that CPDI has also detected at least one vulnerability on it.

Why the other options are wrong

  • A. An unknown posture combined with vulnerabilities does not produce this score, and the score does not reveal an exact vulnerability count.
  • B. A healthy posture does not add to the risk, so the score would not reach 90 from these factors.
  • D. An unhealthy posture with no detected vulnerabilities produces a lower risk score than 90.

Question 14

A company has Aruba APs that are controlled by Central and that implement WIDS.

When you check WIDS events, you see a “detect valid SSID misuse” event.

What can you interpret from this event, and what steps should you take?

  1. Clients are failing to authenticate to corporate SSIDs. You should first check for misconfigured authentication settings and then investigate a possible threat.
  2. Admins have likely misconfigured SSID security settings on some of the company’s APs. You should have them check those settings.
  3. Hackers are likely trying to pose as authorized APs. You should use the detecting radio information and immediately track down the device that triggered the event.
  4. This event might be a threat but is almost always a false positive. You should wait to see the event over several days before following up on it.
Show answer and explanation

Correct answer: C. Hackers are likely trying to pose as authorized APs. You should use the detecting radio information and immediately track down the device that triggered the event.

A valid SSID misuse event means a device that is not part of the company's valid infrastructure is advertising one of the company's legitimate SSIDs. That is the behavior of an attacker impersonating authorized APs, often as an evil twin, to lure clients into connecting. The event should be treated as a real threat: use the detecting radio information to locate the offending device quickly.

Why the other options are wrong

  • A. Client authentication failures produce authentication events, not valid SSID misuse events.
  • B. Misconfigured security settings on the company's own APs do not cause an unauthorized device to advertise a valid SSID.
  • D. The event signals likely impersonation and should be investigated promptly rather than ignored for days.

Question 15

A company has several use cases for using its AOS-CX switches’ HPE Aruba Networking Network Analytics Engine (NAE).

What is one guideline to keep in mind as you plan?

  1. Each switch model has a maximum number of supported monitors, and one agent might have multiple monitors.
  2. You can install multiple scripts on a switch, but you can deploy only one agent per script.
  3. The switch will permit you to deploy as many NAE agents as you want, but they might degrade the switch functionality.
  4. When you use custom scripts, you can create as many agents from each script as you want.
Show answer and explanation

Correct answer: A. Each switch model has a maximum number of supported monitors, and one agent might have multiple monitors.

NAE resources are limited per switch platform. Each switch model supports a maximum number of scripts, agents and monitors, and a single agent can contain several monitors. When planning multiple NAE use cases you must count the total monitors your agents will consume and make sure the count stays within the limit of the switch models in use.

Why the other options are wrong

  • B. One script can be used to create multiple agents, each with its own parameter values.
  • C. The switch enforces limits on the number of NAE agents, so it does not allow unlimited deployments.
  • D. Agents created from custom scripts are subject to the same platform limits as any other agents.

That was 15 of 118.

The full HPE HPE7-A02 Network Security Professional pack has all 118 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 59 free as one PDF by email. Get the Half Pack →