Online Access Free HPE6-A84 Exam Questions

Refer to the scenario.
An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.
You are helping the developer understand how to develop an NAE script for this use case.
The developer explains that they plan to define the rule with logic like this:
monitor > value
However, the developer asks you what value to include.
What should you recommend?

• A.Using 10 (per hour) as a good starting point for the value
• B.Defining a parameter and referring to it (self ^ramsfname]) for the value
• C.Defining a baseline and referring to it for the value
• D.Checking one of the access switches' RADIUS statistics and adding 10 to the number listed for rejects

Refer to the scenario.
A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).
The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).
The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.
Assume that the Azure AD deployment has the proper prerequisites established.
You are planning the CPPM authentication source that you will reference as the authentication source in
802.1X services.
How should you set up this authentication source?

• A.As Kerberos type
• B.AS HTTP type, referencing Azure AD's FODN
• C.As Active Directory type
• D.As HTTP type, referencing the Intune extension

Refer to the scenario.
A customer is using an AOS 10 architecture with Aruba APs and Aruba gateways (two per site). Admins have implemented auto-site clustering for gateways with the default gateway mode disabled. WLANs use tunneled mode to the gateways.
The WLAN security is WPA3-Enterprise with authentication to an Aruba ClearPass Policy Manager (CPPM) cluster VIP. RADIUS communications use RADIUS, not RadSec.
For which devices does CPPM require network device entries?

• A.Forgateways' actual IP addresses and dynamic authorization VRRP addresses
• B.For gateways' actual IP addresses and AP clusters' virtual IP addresses for dynamic authorization
• C.ForAP clusters'virtual IP addresses
• D.For APs' actual IP addresses

A company has Aruba gateways and wants to start implementing gateway IDS/IPS. The customer has selected Block for the Fail Strategy.
What might you recommend to help minimize unexpected outages caused by using this particular fall strategy?

• A.Making sure that the gateways have formed a cluster and operate in default gateway mode
• B.Enabling alerts and email notifications for events related to gateway IPS engine utilization and errors
• C.Setting the IDS or IPS policy to the least restrictive option, Lenient
• D.Configuring a relatively high threshold for the gateway threat count alerts

Refer to the scenario.
A customer requires these rights for clients in the "medical-mobile" AOS firewall role on Aruba Mobility Controllers (MCs):
Permitted to receive IP addresses with DHCP
* Permitted access to DNS services from 10.8.9.7 and no other server
* Permitted access to all subnets in the 10.1.0.0/16 range except denied access to 10.1.12.0/22
* Denied access to other 10.0.0.0/8 subnets
* Permitted access to the Internet
* Denied access to the WLAN for a period of time if they send any SSH traffic
* Denied access to the WLAN for a period of time if they send any Telnet traffic
* Denied access to all high-risk websites
External devices should not be permitted to initiate sessions with "medical-mobile" clients, only send return traffic.
The line below shows the effective configuration for the role.

There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example,
"medical-mobile" rule 1 is "ipv4 any any svc-dhcp permit," and rule 6 is "ipv4 any any any permit'.)

• A.Apply the "apprf-medical-mobile-sjcT policy explicitly to the 'medical-mobile' user-role under the
  'medical-mobile" policy.
• B.In the "medical-mobile" policy, change the action for rules 2 and 3 to reject.
• C.In the "medical-mobile* policy, change the subnet mask in rule 5 to 255.255.252.0.
• D.In the "medical-mobile" policy, move rule 5 under rule 6.