Aruba Network Security Expert (Written) key terms

A networking protocol that centralizes authentication, authorization, and accounting for users and devices connecting to network access equipment. A client device forwards credentials to a RADIUS server, which replies with an accept or reject decision plus attributes.

An IEEE standard for port-based network access control that blocks traffic on a switch port or wireless association until the supplicant authenticates successfully through an authenticator to an authentication server.

The client-side software component on an endpoint that responds to 802.1X authentication requests, typically supplying EAP credentials such as a certificate or username and password.

The network device, such as a switch or wireless controller, that enforces 802.1X by relaying EAP messages between the supplicant and the authentication server and controlling port or session access.

Extensible Authentication Protocol, a framework that carries pluggable authentication methods between supplicant and authentication server. EAP itself defines message exchange but relies on a specific method to perform the actual credential verification.

An EAP method in which both client and server prove identity with X.509 certificates, providing strong mutual authentication without passwords. It requires certificate provisioning on endpoints and is often paired with device identity checks.

Protected Extensible Authentication Protocol, a method that first builds a TLS tunnel using only a server certificate, then authenticates the user inside that tunnel with an inner method such as MSCHAPv2.

Change of Authorization, a RADIUS extension letting the server push new policy attributes to a network device mid-session, forcing reauthentication, VLAN change, or disconnect without waiting for the client to reconnect.

The policy step that assigns an enforcement role to a connecting endpoint based on collected attributes, such as group membership, device type, or posture result, so downstream enforcement can apply consistent rules.

An access model where permissions are attached to named roles rather than individual users or devices. Endpoints are classified into a role at authentication time and inherit that role's network privileges.

A network access control platform that collects identity and device context, evaluates policy rules, and returns enforcement decisions to network devices while offering guest, onboarding, and endpoint visibility services.

The ClearPass component that processes RADIUS, TACACS+, and web authentication requests, evaluates service rules and role mappings, and returns the enforcement profile to the requesting network device.

A named set of attributes returned to a network device to apply a decision, such as a VLAN identifier, downloadable role name, or access control list reference.

The process of checking an endpoint's security state, such as patch level, antivirus status, or disk encryption, before or during network admission, then using the result to grant, restrict, or remediate access.

An endpoint agent that reports health and compliance information to the policy server and can trigger remediation actions, supplying posture attributes used in admission decisions.

Passive and active discovery of device characteristics, such as MAC address vendor, DHCP fingerprint, and user agent, used to classify unknown devices and apply appropriate access policy without manual registration.

A stored classification of a device category, derived from observed fingerprints, that lets policy treat similar endpoints consistently, for example printers, cameras, or medical devices.

A set of technologies that identify and authorize devices and users before granting network access, and that can restrict, quarantine, or remediate noncompliant endpoints.

An approach that places users and devices into distinct logical network segments based on identity and context rather than physical port, applying role-based policy consistently across wired and wireless infrastructure.

A mode where a switch forwards a user's traffic to a gateway or controller over a tunnel, so the user's role and policy are enforced centrally instead of on the local access switch.

A role definition delivered from the policy server to a network device at authentication time, letting the device apply per-user or per-device permissions without local configuration changes.

A trusted entity that issues and signs digital certificates, binding a public key to an identity. Its root certificate must be trusted by clients and servers for TLS-based authentication to succeed.

A TLS exchange in which both parties present and verify certificates, so the client confirms the server's identity and the server confirms the client's identity before any credentials or data are exchanged.

The process of invalidating a certificate before its expiration, typically through a revocation list or an online status protocol, so relying parties reject credentials that are no longer trusted.

Public Key Infrastructure, the combination of certificate authorities, registration processes, policies, and repositories that issues, distributes, and validates certificates used for encryption and authentication.

A Cisco-developed protocol that separates authentication, authorization, and accounting and encrypts the full payload, commonly used to control administrative access to network devices with per-command authorization.

The channels used to administer network equipment, such as SSH, HTTPS, and console, which should be restricted by strong authentication, encrypted transport, and source-address controls.

A Wi-Fi security mode using 802.1X authentication with stronger key derivation and protection of management frames, intended for organizations requiring robust per-user wireless authentication.

Protected Management Frames, a Wi-Fi feature that encrypts and integrity-protects certain management frames such as deauthentication, preventing spoofed disassociation attacks against clients.

An unauthorized access point connected to the corporate network, which can bypass intended security controls and expose internal resources to unauthorized wireless clients.

A malicious access point that imitates a legitimate network name to lure clients into associating, enabling credential capture or traffic interception.

A system that monitors the radio spectrum for threats such as rogue access points, impersonation, and denial-of-service frames, and can automatically contain offending devices.

A standard protocol for sending event messages from network devices to a central collector, enabling correlation, retention, and alerting across the infrastructure.

Security Information and Event Management, a platform that aggregates logs and flow data from many sources, correlates events, and generates alerts for investigation by security analysts.

A flow-record export format that summarizes traffic metadata such as source, destination, ports, and byte counts, used for traffic visibility and anomaly detection without full packet capture.

The structured process of preparing for, detecting, containing, eradicating, and recovering from security incidents, followed by lessons learned to improve future defenses.

A management interface that exposes programmatic access to a platform's configuration and data, allowing automation, integration with ticketing or orchestration tools, and consistent change control.

An HTTP-based interface using standard methods and resource-oriented URLs, commonly used to query and modify policy server objects and to integrate security workflows with other systems.

The practice of combining related events from multiple sources by time, identity, or address to reconstruct an activity sequence, which is essential when troubleshooting authentication failures.