HPE6-A84 試験問題を無料オンラインアクセス

Refer to the scenario.
An organization wants the AOS-CX switch to trigger an alert if its RADIUS server (cp.acnsxtest.local) rejects an unusual number of client authentication requests per hour. After some discussions with other Aruba admins, you are still not sure how many rejections are usual or unusual. You expect that the value could be different on each switch.
You are helping the developer understand how to develop an NAE script for this use case.
You are helping a customer define an NAE script for AOS-CX switches. The script will monitor statistics from a RADIUS server defined on the switch. You want to future proof the script by enabling admins to select a different hostname or IP address for the monitored RADIUS server when they create an agent from the script.
What should you recommend?

• A.Define a parameter for the RADIUS server; reference that parameter instead of the server name/ip when defining the monitor URI.
• B.Make the script editable so that admins can edit it on demand when they are creating scripts.
• C.Use a callback action to collect the name of any RADIUS servers defined on the switch at the time the agent is created.
• D.Use this variable, %{radius-ipV when defining the monitor URI in the NAE agent script.

Several AOS-CX switches are responding to SNMPv2 GET requests for the public community. The customer only permits SNMPv3. You have asked a network admin to fix this problem. The admin says, "I tried to remove the community, but the CLI output an error." What should you recommend to remediate the vulnerability and meet the customer's requirements?

• A.Setting the snmp-server settings to "snmpv3-only"
• B.Enabling control plane policing to automatically drop SNMP GET requests
• C.Enabling SNMPv3, which implicitly disables SNMPv1/v2
• D.Adding an SNMP community with a long random name

Refer to the scenario.
A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).
Switches are using local port-access policies.
The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth-internet" role. The gateway should also handle assigning clients to their VLAN, which is VLAN 20.
The plan for the enforcement policy and profiles is shown below:

The gateway cluster has two gateways with these IP addresses:
* Gateway 1
o VLAN 4085 (system IP) = 10.20.4.21
o VLAN 20 (users) = 10.20.20.1
o VLAN 4094 (WAN) = 198.51.100.14
* Gateway 2
o VLAN 4085 (system IP) = 10.20.4.22
o VLAN 20 (users) = 10.20.20.2
o VLAN 4094 (WAN) = 198.51.100.12
* VRRP on VLAN 20 = 10.20.20.254
The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.
What is one change that you should make to the solution?

• A.Remove VLAN assignments from role configurations on the gateways.
• B.Change the ubt-client-vlan to VLAN 13.
• C.Configure edge ports in VLAN trunk mode.
• D.Configure the UBT solution to use VLAN extend mode.

Refer to the scenario.
A hospital has an AOS10 architecture that is managed by Aruba Central. The customer has deployed a pair of Aruba 9000 Series gateways with Security licenses at each clinic. The gateways implement IDS/IPS in IDS mode.
The Security Dashboard shows these several recent events with the same signature, as shown below:

Which step could give you valuable context about the incident?

• A.View the user-table on APs and record the threat sources' 802.11 settings.
• B.View the RAPIDS Security Dashboard and see if the threat sources are listed as rogues.
• C.View firewall sessions on the APs and record the threat sources' type and OS.
• D.Find the Central client profile for the threat sources and note their category and family.

Refer to the exhibit.

Which IP address should you record as a possibly compromised client?

• A.10.1.26.151
• B.10.1J.100
• C.10.254.1.21
• D.10.1.26.1