HP HPE7-A02 Practice Exams
Last updated on Oct 22,2026- Exam Code: HPE7-A02
- Exam Name: HPE Network Security Professional Exam
- Certification Provider: HP
- Latest update: Oct 22,2026
You need to set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to provide certificate-based authentication of 802.1X supplicants.
How should you upload the root CA certificate for the supplicants’ certificates?
- A . As a ClearPass Server certificate with the RADIUS/EAP usage
- B . As a Trusted CA with the AD/LDAP usage
- C . As a Trusted CA with the EAP usage
- D . As a ClearPass Server certificate with the Database usage
C
Explanation:
To set up HPE Aruba Networking ClearPass Policy Manager (CPPM) for certificate-based authentication of 802.1X supplicants, you need to upload the root CA certificate as a Trusted CA with the EAP usage. This configuration allows the ClearPass server to validate the certificates presented by the supplicants during the 802.1X authentication process. By marking the certificate for EAP usage, ClearPass can properly authenticate the supplicant devices using the trusted certificate authority (CA) that issued their certificates.
Reference: Configuration guidelines and best practices for ClearPass Policy Manager are available in Aruba’s ClearPass documentation, specifically detailing the steps for uploading and configuring root CA certificates for EAP-based authentication.
A port-access role for AOS-CX switches has this policy applied to it: plaintext
Copy code
port-access policy mypolicy
10 class ip zoneC action drop
20 class ip zoneA action drop
100 class ip zoneB
The classes have this configuration: plaintext
Copy code class ip zoneC
10 match tcp 10.2.0.0/16 eq https
class ip zoneA
10 match ip any 10.1.0.0/16
class ip zoneB
10 match ip any 10.0.0.0/8
The company wants to permit clients in this role to access 10.2.12.0/24 with HTTPS.
What should you do?
- A . Add this rule to zoneC: 5 match any 10.2.12.0/24 eq https
- B . Add this rule to zoneA: 5 ignore tcp any 10.2.12.0/24 eq https
- C . Add this rule to zoneB: 5 match tcp any 10.2.12.0/24 eq https
- D . Add this rule to zoneC: 5 ignore tcp any 10.2.12.0/24 eq https
A
Explanation:
Comprehensive Detailed Explanation
The requirement is to permit HTTPS traffic from clients to the 10.2.12.0/24 subnet.
ZoneC is configured to drop all HTTPS traffic to the 10.2.0.0/16 subnet. Therefore, the first match in the zoneC class (priority 10) will drop the desired traffic.
To override this behavior, you must add a higher-priority rule (lower rule number) to zoneC that explicitly matches 10.2.12.0/24 and permits the traffic.
Thus, adding the rule 5 match any 10.2.12.0/24 eq https to zoneC ensures the desired traffic is permitted while maintaining the drop behavior for the rest of 10.2.0.0/16.
Reference
AOS-CX Role-Based Access Control documentation.
Understanding class priority and policy rule ordering in AOS-CX.
A port-access role for AOS-CX switches has this policy applied to it: plaintext
Copy code
port-access policy mypolicy
10 class ip zoneC action drop
20 class ip zoneA action drop
100 class ip zoneB
The classes have this configuration: plaintext
Copy code class ip zoneC
10 match tcp 10.2.0.0/16 eq https
class ip zoneA
10 match ip any 10.1.0.0/16
class ip zoneB
10 match ip any 10.0.0.0/8
The company wants to permit clients in this role to access 10.2.12.0/24 with HTTPS.
What should you do?
- A . Add this rule to zoneC: 5 match any 10.2.12.0/24 eq https
- B . Add this rule to zoneA: 5 ignore tcp any 10.2.12.0/24 eq https
- C . Add this rule to zoneB: 5 match tcp any 10.2.12.0/24 eq https
- D . Add this rule to zoneC: 5 ignore tcp any 10.2.12.0/24 eq https
A
Explanation:
Comprehensive Detailed Explanation
The requirement is to permit HTTPS traffic from clients to the 10.2.12.0/24 subnet.
ZoneC is configured to drop all HTTPS traffic to the 10.2.0.0/16 subnet. Therefore, the first match in the zoneC class (priority 10) will drop the desired traffic.
To override this behavior, you must add a higher-priority rule (lower rule number) to zoneC that explicitly matches 10.2.12.0/24 and permits the traffic.
Thus, adding the rule 5 match any 10.2.12.0/24 eq https to zoneC ensures the desired traffic is permitted while maintaining the drop behavior for the rest of 10.2.0.0/16.
Reference
AOS-CX Role-Based Access Control documentation.
Understanding class priority and policy rule ordering in AOS-CX.
A company has a variety of HPE Aruba Networking solutions, including an HPE Aruba Networking infrastructure and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company passes traffic from the corporate LAN destined to the data center through a third-party SRX firewall. The company would like to further protect itself from internal threats.
What is one solution that you can recommend?
- A . Have the third-party firewall send Syslogs to CPPM, which can work with network devices to lock internal attackers out of the network.
- B . Add ClearPass Device Insight (CPDI) to the solution, integrate it with the third-party firewall to develop more complete device profiles.
- C . Configure CPPM to poll the third-party firewall for a broad array of information about internal clients, such as profile and posture.
- D . Use tunnel mode SSIDs and user-based tunneling (UBT) on AOS-CX switches to pass all internal traffic directly through the third-party firewall.
A
Explanation:
Syslog Integration with CPPM:
ClearPass Policy Manager (CPPM) can integrate with third-party firewalls via Syslog messages to detect and respond to internal threats.
The Syslog integration enables CPPM to gather context on suspicious activity and enforce appropriate policies such as isolating attackers by working with network devices like Aruba switches and APs.
Option A: Correct. This method allows for dynamic response to threats and leverages existing infrastructure without requiring major reconfiguration.
Option B: Incorrect. CPDI is primarily used for profiling devices, not directly for threat response based on Syslog information.
Option C: Incorrect. While it is possible for CPPM to poll information, this approach is less dynamic and not focused on immediate threat response.
Option D: Incorrect. Tunnel mode SSIDs and UBT are designed for forwarding user traffic securely but do not directly enhance threat detection or mitigation.
A company has a variety of HPE Aruba Networking solutions, including an HPE Aruba Networking infrastructure and HPE Aruba Networking ClearPass Policy Manager (CPPM). The company passes traffic from the corporate LAN destined to the data center through a third-party SRX firewall. The company would like to further protect itself from internal threats.
What is one solution that you can recommend?
- A . Have the third-party firewall send Syslogs to CPPM, which can work with network devices to lock internal attackers out of the network.
- B . Add ClearPass Device Insight (CPDI) to the solution, integrate it with the third-party firewall to develop more complete device profiles.
- C . Configure CPPM to poll the third-party firewall for a broad array of information about internal clients, such as profile and posture.
- D . Use tunnel mode SSIDs and user-based tunneling (UBT) on AOS-CX switches to pass all internal traffic directly through the third-party firewall.
A
Explanation:
Syslog Integration with CPPM:
ClearPass Policy Manager (CPPM) can integrate with third-party firewalls via Syslog messages to detect and respond to internal threats.
The Syslog integration enables CPPM to gather context on suspicious activity and enforce appropriate policies such as isolating attackers by working with network devices like Aruba switches and APs.
Option A: Correct. This method allows for dynamic response to threats and leverages existing infrastructure without requiring major reconfiguration.
Option B: Incorrect. CPDI is primarily used for profiling devices, not directly for threat response based on Syslog information.
Option C: Incorrect. While it is possible for CPPM to poll information, this approach is less dynamic and not focused on immediate threat response.
Option D: Incorrect. Tunnel mode SSIDs and UBT are designed for forwarding user traffic securely but do not directly enhance threat detection or mitigation.
A company wants to turn on Wireless IDS/IPS infrastructure and client detection at the high level on HPE Aruba Networking APs. The company does not want to enable any prevention settings.
What should you explain about HPE Aruba Networking recommendations?
- A . HPE Aruba Networking recommends turning on both wired and wireless prevention whenever you enable detection at high.
- B . HPE Aruba Networking recommends using hybrid AP mode, as opposed to Air Monitors (AMs), when implementing detection without prevention.
- C . HPE Aruba Networking recommends disabling client detection when you configure infrastructure detection at high, as infrastructure detection includes all the client checks and more.
- D . HPE Aruba Networking recommends configuring infrastructure and client detection at a custom level and disabling or tuning some of the settings that are likely to produce false positives.
D
Explanation:
When enabling Wireless IDS/IPS infrastructure and client detection at a high level on HPE Aruba Networking APs without enabling prevention settings, HPE Aruba Networking recommends configuring detection at a custom level and adjusting settings to minimize false positives. This approach allows for effective monitoring while reducing the risk of unnecessary alerts and maintaining the accuracy of detections.
What is a use case for running periodic subnet scans on devices from HPE Aruba Networking ClearPass Policy Manager (CPPM)?
- A . Using DHCP fingerprints to determine a client’s device category and OS
- B . Detecting devices that fail to comply with rules defined in CPPM posture policies
- C . Identifying issues with authenticating and authorizing clients
- D . Using WMI to collect additional information about Windows domain clients
A
Explanation:
Running periodic subnet scans on devices from HPE Aruba Networking ClearPass Policy Manager (CPPM) can be used to gather DHCP fingerprints, which help determine a client’s device category and operating system. DHCP fingerprints are unique patterns in DHCP request packets that provide valuable information about the device type and OS, assisting in device profiling and policy enforcement.
Assume that an AOS-CX switch is already implementing DHCP snooping and ARP inspection successfully on several VLANs.
What should you do to help minimize disruption time if the switch reboots?
- A . Configure the switch to act as an ARP proxy.
- B . Create static IP-to-MAC bindings for the DHCP and DNS servers.
- C . Save the IP-to-MAC bindings to external storage.
- D . Configure the IP helper address on this switch, rather than a core routing switch.
C
Explanation:
To minimize disruption time if an AOS-CX switch reboots while implementing DHCP snooping and ARP inspection, you should save the IP-to-MAC bindings to external storage. This ensures that the DHCP snooping and ARP inspection tables, which are crucial for preventing spoofing attacks, are preserved across reboots. When the switch restarts, it can reload these bindings from the external storage, thereby maintaining network security and reducing the downtime associated with rebuilding these tables.
Assume that an AOS-CX switch is already implementing DHCP snooping and ARP inspection successfully on several VLANs.
What should you do to help minimize disruption time if the switch reboots?
- A . Configure the switch to act as an ARP proxy.
- B . Create static IP-to-MAC bindings for the DHCP and DNS servers.
- C . Save the IP-to-MAC bindings to external storage.
- D . Configure the IP helper address on this switch, rather than a core routing switch.
C
Explanation:
To minimize disruption time if an AOS-CX switch reboots while implementing DHCP snooping and ARP inspection, you should save the IP-to-MAC bindings to external storage. This ensures that the DHCP snooping and ARP inspection tables, which are crucial for preventing spoofing attacks, are preserved across reboots. When the switch restarts, it can reload these bindings from the external storage, thereby maintaining network security and reducing the downtime associated with rebuilding these tables.
A company needs you to integrate HPE Aruba Networking ClearPass Policy Manager (CPPM) with HPE Aruba Networking ClearPass Device Insight (CPDI).
What is one task you should do to prepare?
- A . Install the root CA for CPPM’s HTTPS certificate as trusted in the CPDI application.
- B . Configure WMI, SSH, and SNMP external accounts for device scanning on CPPM.
- C . Enable Insight in the CPPM server configuration settings.
- D . Collect a Data Collector token from HPE Aruba Networking Central.
C
Explanation:
To integrate HPE Aruba Networking ClearPass Policy Manager (CPPM) with HPE Aruba Networking ClearPass Device Insight (CPDI), one of the necessary tasks is to enable Insight in the CPPM server configuration settings. This configuration allows CPPM to communicate and share data with CPDI, facilitating the integration and enabling enhanced device profiling and policy enforcement capabilities.