Aruba Network Security Expert (Written) flashcards
Aruba Network Security Expert (Written) · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Zero Trust principle
- No implicit trust is granted from network location; every session is authenticated, authorized, and encrypted based on identity and policy, regardless of whether the endpoint sits inside or outside the perimeter.
- DMZ role in design
- A segmented zone that terminates external-facing sessions before any internal resource is reached, so a compromised public service cannot directly touch internal trust zones.
- Defense in depth
- Layering independent controls across physical, network, identity, endpoint, encryption, and monitoring domains so failure of one control does not collapse overall protection.
- ClearPass cluster HA
- One publisher plus subscribers replicate configuration; any node can serve RADIUS authentication, giving load distribution and failover if a node becomes unavailable.
- 802.1X authenticator role
- The switch, AP, or controller that relays EAP frames between supplicant and RADIUS server over EAPOL and enforces the resulting authorization on the port.
- EAP-TLS characteristics
- Mutual certificate-based authentication where both client and server present certificates; strongest EAP method but requires a client certificate and trusted CA chain.
- Tunnel-Private-Group-ID attribute
- RADIUS attribute carrying the VLAN ID a NAD should assign after successful authentication, used together with Tunnel-Type and Tunnel-Medium-Type.
- RADIUS CoA purpose
- RFC 5176 mechanism letting the RADIUS server push a new role, VLAN, or session disconnect to the NAD without waiting for the client to reauthenticate.
- MAB security limitation
- MAC authentication bypass uses a spoofable MAC address as the only credential, so it should map to a restricted fallback role rather than full trust.
- 802.1X multi-domain mode
- Port mode allowing separate authentications for data and voice domains on the same physical port, so a phone and attached PC authenticate independently.
- ClearPass policy evaluation order
- Service match, then role mapping, then enforcement policy and profiles; first matching enforcement rule applies unless continue rules are configured.
- ClearPass Profiler inputs
- Device type is inferred from DHCP fingerprints, MAC OUI, SNMP data, NetFlow records, and active scans; the resulting category can drive role mapping.
- OnGuard posture purpose
- An agent-based check of antivirus, patch level, disk encryption, and firewall state that returns health tokens used to place non-compliant endpoints in remediation.
- ClearPass Onboard function
- Issues client certificates from an internal CA to managed and BYOD devices so those endpoints can perform certificate-based EAP-TLS authentication.
- ClearPass publisher role
- The cluster node that owns the authoritative configuration; changes made there replicate to subscriber nodes, which can still serve authentication requests.
- TLS hostname validation
- The client checks that the certificate SAN matches the FQDN it connected to; a mismatch breaks trust even when the chain is otherwise valid.
- EKU client authentication
- Extended Key Usage extension that must be present on a client certificate for EAP-TLS; without it, the RADIUS server rejects the certificate.
- SNMPv3 authPriv
- Security level using authentication plus encryption, typically SHA for integrity and AES for privacy, replacing cleartext SNMPv1 and v2c community strings.
- WPA3 SAE handshake
- Simultaneous Authentication of Equals provides a PSK exchange resistant to offline dictionary attacks, replacing the WPA2 four-way PSK handshake weakness.
- RADIUS shared secret role
- A key used to integrity-protect RADIUS messages and to trust CoA sources; a mismatch causes silent discards and leaks enable spoofed authentication.
- Rogue AP classification
- An unauthorized BSSID seen on the wired network is rogue; off-wire with the same SSID is interfering; off-wire with a different SSID is a neighbor.
- DHCP snooping dependency
- Dynamic ARP inspection and IP source guard rely on the DHCP snooping binding table to validate ARP and IP-to-MAC mappings on untrusted ports.
- Evil twin signature
- A WIDS event where an AP advertises the same SSID as a legitimate network but with a different BSSID, typically to lure clients into connecting.
- Quarantine role design
- A role that denies all traffic except remediation services and DNS/DHCP, requiring posture fix plus reauthentication or CoA to regain normal access.
- Dynamic Segmentation outcome
- Role determines VLAN and policy, and traffic may be tunneled to a gateway rather than locally switched, containing a compromised endpoint to its role scope.
- MPSK per-device keys
- Multi-PSK assigns each device a unique pre-shared key mapped to a role, so one leaked key can be revoked without rekeying the entire SSID.
- Switch device profile
- A set of port attributes such as VLAN, PoE, and auth mode applied automatically when a device is detected, enabling consistent automated port provisioning.
- Role-based ACL default
- Role ACLs should deny inter-role traffic by default and permit only required flows, applied on ingress and egress where the platform supports it.
- TACACS+ versus RADIUS
- TACACS+ separates authentication, authorization, and accounting and encrypts the full payload, making it preferred for device administration; RADIUS encrypts only the password.
- ClearPass Access Tracker
- A diagnostic view showing the full policy evaluation trace for one request: matched service, role mapping, enforcement rule, and returned attributes.
- EAP timeout meaning
- The supplicant received no RADIUS response, indicating unreachable server, wrong shared secret, or a NAD that is not forwarding requests.
- Wrong VLAN after auth
- Usually caused by missing Tunnel-Type, Tunnel-Medium-Type, or Tunnel-Private-Group-ID attributes, or by role precedence overriding the intended role.