HPE Aruba Network Security Expert (HPE7-A10) Certification Sample Questions

02. Three engineers edit NAE scripts on their own laptops and upload them to AOS-CX switches directly. Last month, one engineer's change to a MAC-move script reached every campus switch on the afternoon it was written and flooded the SOC with false alerts. Backing it out took two days, because the three engineers held different copies of the script and none matched what the agents were running.
Which two practices should the development workflow add?
(Select two.)
a) Have each engineer keep a dated copy of every script they upload, stored in a personal folder on their own laptop
b) Keep every script in a version-control repository with its history
c) Require peer review and a lab test of each change before the new version is uploaded to any switch
d) Rename each uploaded script with the author's initials so that its owner is known

03. After an outage that nobody could explain, a manager asks the network team to write a Network Analytics Engine (NAE) script that monitors everything on the AOS-CX core switches. The team has not yet agreed what the script should detect or who will respond when it triggers.
What should the team do first in its NAE script development workflow?
a) Define the symptom to detect, the evidence needed and who acts on the alert
b) Enable all available monitors in one script so that no symptom goes unrecorded
c) Choose the alert actions, severity and recipients first, then add monitors to match
d) Deploy an agent from an existing sample script and adjust it after the next outage

04. Users on one floor report intermittent certificate warnings and slow access to internal applications. An analyst reviews the AOS-CX ARP tables, DHCP snooping bindings and NAE ARP alerts for the floor's VLAN over the past day. The VLAN's default gateway is a virtual address shared by two core switches running VRRP, and a planned failover between them took place during that day.
Which two observations indicate that a host is intercepting traffic by ARP spoofing?
(Select two.)
a) The gateway's IP address maps to a MAC address learned on a user access port
b) A workstation sends unsolicited ARP replies claiming other hosts' IP addresses
c) Gratuitous ARP for the virtual gateway address, sent by the standby core switch as it took over the VRRP role
d) Clients renewing DHCP leases for the same addresses

05. Employee-owned phones join a BYOD SSID with 802.1X, and ClearPass profiling classifies them so that policy limits phones to internet and email access. The team also maintains a list of approved phone MAC addresses built from earlier profiling results. After recent operating-system updates, many phones present a randomized MAC address that differs per network and changes over time, so they fall off the list and appear as new, unknown endpoints.
How should the design be changed?
a) Deny any endpoint whose MAC address has the locally administered bit set, since randomization sets it
b) Map the randomized addresses to manufacturers with the OUI list so that the phones keep their device type
c) Have users register each new MAC address through a self-service portal whenever their phone changes it
d) Base access on the 802.1X identity and each session's current profile, not on stored MACs

06. NAE agents on the AOS-CX switches detect abnormal MAC moves, but their alerts are visible only on each switch. The SOC wants these events correlated with ClearPass and gateway events in its SIEM. The engineers do not want to change what the agents detect.
Which change to the scripts meets the SOC's requirement?
a) Have AirWave poll the switches and forward NAE alerts to the SIEM
b) Add a show-command capture action to each condition on the switches
c) Add a syslog action to each condition so the events reach the SIEM
d) Raise each script's alert severity so its events appear in the SIEM

07. A company has 300 IP cameras of one model. Some serve the physical security team and must reach its video management servers; the rest sit in research labs and must reach only a lab recording server. CPDI classifies all of them identically, since they share a model and behave alike, and it shares its data with ClearPass.
Which two steps let access policy treat the two groups differently?
(Select two.)
a) Tag each camera in CPDI with the group it belongs to, such as security or lab
b) Give all cameras the security role, since both groups use the same model
c) Retrain the CPDI models until they assign the two groups different device types
d) Reference the tags in ClearPass role mapping

08. Legal counsel reviews the draft report of a threat analysis before it is delivered. The report states that the attacker exfiltrated HR records, but the supporting material is the analyst's working notes. Some conclusions rest on direct evidence such as packet captures, while others are inferred from flow volumes.
How should the report be revised before delivery?
a) Have the CISO approve the conclusions in writing, so that the report carries executive authority
b) Tie each conclusion to the hashed evidence items behind it, and state how sure the team is of each inferred finding
c) Remove each conclusion not proven by direct evidence, so the report holds only confirmed facts and no inference
d) Attach the complete raw log archive to the report so that readers can verify any conclusion themselves

09. During a time-boxed threat analysis, an analyst merges records from ClearPass (recorded in UTC), a branch gateway (recorded in local time) and a cloud proxy service (recorded in UTC with a known two-minute clock offset). The timeline must hold up when the findings are reviewed by others.
Which two practices should the analyst apply while building the timeline?
(Select two.)
a) Drop the proxy records from the timeline, since their clock was known to be inaccurate
b) Order events by the time each record arrived at the SIEM rather than by their own timestamps
c) Record the source and original timestamp of each entry
d) Convert all timestamps to one time zone and apply the proxy's known offset

10. ClearPass Device Insight (CPDI) is integrated with ClearPass Policy Manager (CPPM), and the role-mapping rules that reference CPDI categories work at every site except a new plant. As at the other sites, the plant's devices use MAC authentication. CPDI's only data source at the plant is a mirror of the plant router's uplink to the data center, taken beyond the point where the traffic is routed. CPDI lists the plant's devices by IP address with confident classifications, yet their CPPM endpoint records show no CPDI category.
What is the most likely cause?
a) Past the routed hop, frames carry the router's MAC address, so CPDI cannot tie each IP address to the device's own MAC
b) CPDI shares a classification with CPPM only after a device has completed a full learning period of observed traffic at its site
c) The plant's devices use MAC authentication instead of 802.1X
d) The plant's role-mapping rules were copied from another site and reference categories that CPDI has never assigned to the plant's devices