Free HPE7-A02 sample questions

Correct answer: Enable OCSP (Online Certificate Status Protocol) checks for the Intermediate CA.

OCSP (Online Certificate Status Protocol) provides real-time certificate status checks. Unlike CRLs (Certificate Revocation Lists), which are downloaded periodically and may have a latency window where a revoked certificate is still accepted, OCSP queries the CA's responder directly at the time of authentication. For high-security environments requiring immediate revocation validation, OCSP is the superior mechanism.

Correct answer: CPDI detects the flow, applies a specific Tag to the device; CPPM polls CPDI for tags and triggers a CoA based on a policy matching that Tag.

The integration relies on CPDI analyzing traffic and tagging devices (e.g., 'Anomalous-Behavior'). CPPM is configured to read these tags (often via endpoint attributes synced or polled) and use them in Enforcement Policies. When the tag appears, CPPM can trigger a Change of Authorization (CoA) to move the device to a quarantine VLAN.

Correct answers: SNMP Query; WMI (Windows Management Instrumentation) Scan

Active profiling involves the profiler initiating traffic to the endpoint. Sending an SNMP query (e.g., OID request) is an active method.

WMI scanning involves the profiler logging into or querying the Windows endpoint to gather system details, which is an active profiling technique.

Correct answer: ClearPass Policy Manager (CPPM)

ClearPass Policy Manager is the core Network Access Control (NAC) solution in the HPE Aruba Networking portfolio. It handles AAA (Authentication, Authorization, Accounting) and policy enforcement for wired, wireless, and VPN users.

Correct answer: To unify policy enforcement by tunneling traffic from access switches to a gateway, eliminating VLAN sprawl and ensuring consistent security policies.

Dynamic Segmentation (specifically User-Based Tunneling) extends the Policy Enforcement Firewall (PEF) capabilities of the gateway to the wired edge. It allows traffic to be tunneled back to the gateway where a single, consistent security policy is applied, regardless of port or VLAN, adhering to Zero Trust principles of least privilege and micro-segmentation.

Correct answer: False

False. WIDS (Detection System) only *detects* and alerts on threats. WIPS (Prevention System) is required to take active countermeasures like containment (deauthentication).