Aruba Network Security Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

The three core security goals: confidentiality protects data from unauthorized disclosure, integrity protects against unauthorized modification, and availability ensures timely access to resources.

Risk Formula

Risk is commonly expressed as likelihood of a threat exploiting a vulnerability multiplied by the impact. Reducing either factor reduces overall risk.

Symmetric Encryption

Encryption using the same key for encryption and decryption, such as AES. It is fast and used for bulk data, but key distribution is a challenge.

Asymmetric Encryption

Encryption using a public/private key pair, such as RSA or ECDSA. It enables key exchange and digital signatures but is slower than symmetric encryption.

Hashing Purpose

A one-way function such as SHA-256 that produces a fixed-length digest. It verifies integrity and detects tampering but does not provide confidentiality.

Evil Twin Attack

A rogue access point that impersonates a legitimate SSID to lure clients into connecting, enabling on-path interception of credentials and traffic.

Rogue AP

An unauthorized access point connected to the corporate wired network. It bypasses security policy and can expose the internal network to wireless intruders.

Zero Trust

A security model that never trusts implicitly, verifies every request explicitly, and enforces least privilege regardless of whether the user is inside or outside the network.

802.1X Roles

The supplicant is the client requesting access, the authenticator is the switch or controller enforcing access, and the authentication server is typically a RADIUS server.

EAP-TLS

An 802.1X EAP method requiring certificates on both client and server. It is strong because it avoids passwords, but it requires a PKI.

PEAP

An EAP method that creates a TLS tunnel using a server certificate, then authenticates the user inside with MS-CHAPv2. Clients must validate the server certificate.

MAB

MAC Authentication Bypass. It authenticates devices that cannot run 802.1X by their MAC address. It is weak because MAC addresses can be spoofed.

RADIUS Ports

RADIUS uses UDP port 1812 for authentication and authorization and UDP port 1813 for accounting. Legacy deployments may use 1645 and 1646.

RADIUS Shared Secret

A pre-shared value used to authenticate and encrypt communication between the authenticator and the RADIUS server. A mismatch causes authentication failures.

Tunnel-Private-Group-ID

A RADIUS attribute that tells the authenticator which VLAN to assign to the client after successful authentication, enabling dynamic VLAN assignment.

WPA3 SAE

Simultaneous Authentication of Equals. WPA3-Personal's handshake replaces the WPA2 PSK exchange and resists offline dictionary attacks on captured handshakes.

Captive Portal

An authentication method that intercepts client web traffic and redirects to a login page before granting access. It authenticates users rather than devices.

Role Definition

A named collection of permissions and ACLs assigned to a user or device after authentication. Roles can be assigned statically or dynamically via RADIUS attributes.

Policy Enforcement Point

The device that enforces access policy, such as a mobility controller, AP, or access switch. It applies the role-based ACLs determined by the policy decision point.

Least Privilege

The principle that users and devices receive only the minimum access needed for their function. It limits the blast radius of a compromised account or device.

Unauthenticated Role

The default restrictive role for clients that have not yet authenticated. It typically permits only DHCP, DNS, and captive portal traffic.

Role-Based ACL

An access control list applied at the enforcement point based on the assigned role. It should default-deny and permit only least-privilege destinations.

Role vs VLAN

A role is a policy construct defining permissions, while a VLAN is a Layer 2 segment. Roles can be decoupled from VLANs, allowing multiple roles on one VLAN.

WPA2-Enterprise

A wireless security mode that uses 802.1X/EAP with a RADIUS server for per-user authentication, rather than a shared pre-shared key.

WPA3-Enterprise 192-bit

A WPA3 mode using stronger ciphers such as GCMP-256 and mandatory Protected Management Frames, intended for high-security environments.

WIPS Containment

A wireless intrusion prevention action that sends deauthentication frames to clients connected to a detected rogue or evil twin AP to sever the connection.

DHCP Snooping

A switch feature that tracks trusted DHCP servers and blocks rogue DHCP offers. It also builds a binding table used by Dynamic ARP Inspection.

Dynamic ARP Inspection

A switch feature that validates ARP packets against the DHCP snooping binding table, blocking ARP spoofing and on-path attacks on the wired LAN.

Management Plane Hardening

Restricting device administration by using HTTPS and SSH instead of HTTP and Telnet, disabling unused services, and limiting management access to trusted source subnets.

Incident Response Phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Each phase produces outputs that feed the next.

NTP for Log Correlation

Time synchronization across devices is required so that logs from controllers, switches, and RADIUS servers can be correlated into an accurate incident timeline.

Syslog Centralization

Sending device logs to a central syslog server or SIEM so they are retained off-device, protected from tampering, and searchable during investigations.