HP HPE6-A84 Value Pack (Frequently Bought Together)

Refer to the scenario.
A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):
Permitted to receive IP addresses with DHCP
* Permitted access to DNS services from 10.8.9.7 and no other server
* Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22
* Denied access to other 10.0.0.0/8 subnets
* Permitted access to the Internet
* Denied access to the WLAN for a period of time if they send any SSH traffic
* Denied access to the WLAN for a period of time if they send any Telnet traffic
* Denied access to all high-risk websites
External devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.
The line below shows the effective configuration for the role.

There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example,
"medical-mobile" rule 1 is "ipv4 any any svc-dhcp permit," and rule 6 is "ipv4 any any any permit'.)

• A. In the "medical-mobile" policy, change the action for rules 2 and 3 to reject.
• B. In the "medical-mobile" policy, move rule 5 under rule 6.
• C. Apply the "apprf-medical-mobile-sjcT policy explicitly to the 'medical-mobile' user-role under the
  'medical-mobile" policy.
• D. In the "medical-mobile* policy, change the subnet mask in rule 5 to 255.255.252.0.

A customer wants CPPM to authenticate non-802.1X-capable devices. An admin has created the service shown in the exhibits below:

What is one recommendation to improve security?

• A. Enabling caching of posture and roles
• B. Creating and using a custom MAC-Auth authentication method
• C. Using Active Directory as the authentication source
• D. Adding an enforcement policy rule that denies access to endpoints with the Conflict flaq

A company has an Aruba ClearPass server at 10.47.47.8, FQDN radius.acnsxtest.local. This exhibit shows ClearPass Policy Manager's (CPPM's) settings for an Aruba Mobility Controller (MC).

The MC is already configured with RADIUS authentication settings for CPPM, and RADIUS requests between the MC and CPPM are working. A network admin enters and commits this command to enable dynamic authorization on the MC:
aaa rfc-3576-server 10.47.47.8
But when CPPM sends CoA requests to the MC, they are not working. This exhibit shows the RFC 3576 server statistics on the MC:

How could you fix this issue?

• A. Enable RadSec on the MCs' RFC 3676 server config.
• B. Make sure that CPPM is using an ArubaOS Wireless RADIUS CoA enforcement profile.
• C. Configure the MC to obtain the time from a valid NTP server.
• D. Change the UDP port in the MCs' RFC 3576 server config to 3799.

A customer has an AOS 10-based solution, including Aruba APs. The customer wants to use Cloud Auth to authenticate non-802.1X capable IoT devices.
What is a prerequisite for setting up the device role mappings?

• A. Configuring Device Insight (client profile) tags in Central
• B. Creating global role-to-role firewall policies in Central
• C. Integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight
• D. Configuring a NetConductor-based fabric

How does Aruba Central handle security for site-to-site connections between AOS 10 gateways?

• A. It automatically establishes IPsec tunnels for all site-to-site (all HUBs and Branches) connections using keys securely distributed by Central.
• B. It automatically steers traffic away from Internet-based connections to more secure MPLS connections to reduce encryption overhead.
• C. It automatically establishes simple-to-manage and highly secure TLSv1.3 tunnels between gateways.
• D. It uses an Aruba proprietary integrity and encryption technologies to secure site-to-site connections, making them resistant to zero day attacks.