Aruba Network Security Associate key terms

A framework that verifies who a user is, determines what that user is allowed to do, and records what the user actually did. Network devices often delegate these functions to a central server.

A client-server protocol that carries authentication, authorization, and accounting messages between a network device and a central policy server. It commonly transports credentials and returns access attributes used to assign roles.

An IEEE standard for port-based network access control that keeps a wired or wireless link blocked until the supplicant authenticates successfully. It uses three roles: supplicant, authenticator, and authentication server.

The client software or device that requests access to the network and presents credentials during an 802.1X exchange. It may use certificates, passwords, or both depending on the configured EAP method.

The network device, such as a switch or access point, that controls the physical or wireless port and relays credentials between the supplicant and the authentication server. It enforces the resulting permit or deny decision.

A flexible authentication framework that carries many credential methods between supplicant and server. EAP itself does not define a single method; variants such as PEAP and EAP-TLS define how credentials are exchanged.

An EAP method that first builds a protected TLS tunnel between client and server, then sends the user's credentials inside that tunnel. Clients typically validate the server certificate to prevent impersonation.

An EAP method in which both the client and the server prove their identity with digital certificates. It avoids password exposure but requires a certificate infrastructure and client certificate deployment.

A method that grants or denies network access based on a device's hardware address rather than user credentials. Because addresses can be spoofed, it is usually treated as a weak or fallback control.

A fallback technique that sends a device's MAC address to a RADIUS server when the device cannot perform 802.1X. It is intended for devices like printers and cameras that lack supplicant software.

A set of technologies that decides whether an endpoint may join the network and under what conditions. It often combines identity checks, device posture assessment, and enforcement through VLANs or firewall rules.

The process of checking an endpoint's health before or after it joins the network, such as verifying patch level, antivirus status, or disk encryption. Results can trigger full access, limited access, or remediation.

A restricted network segment where endpoints are placed when they fail authentication or posture checks. It typically allows only remediation resources and blocks access to production systems.

The corrective steps an endpoint must complete to move out of a restricted state, such as installing updates or enabling security software. Successful remediation usually triggers a re-check before full access is granted.

An access model where permissions are attached to roles rather than to individual users or devices. Users and devices are assigned roles, and policy is written once per role.

A named collection of permissions and network conditions assigned to a user or device after authentication. A role commonly determines VLAN, firewall policy, bandwidth limits, and session behavior.

The process of deciding which role applies to a session using inputs such as user group, device type, certificate attributes, location, or time. It can happen on the RADIUS server or on the network device.

Applying the decisions produced by authentication and authorization so that traffic is permitted, denied, or restricted as intended. Enforcement points include switches, access points, controllers, and firewalls.

An ordered set of rules that permits or denies traffic based on attributes such as source, destination, protocol, or port. Rules are evaluated in sequence, and the first match usually wins.

A design principle that gives users and devices only the access needed to perform their tasks, and no more. It limits the damage that a compromised account or endpoint can cause.

A security model that treats every request as untrusted until identity and context are verified, regardless of network location. It emphasizes continuous verification, least privilege, and micro-segmentation rather than a trusted internal perimeter.

Dividing a network into small zones with tightly scoped rules so that compromise of one zone does not grant broad lateral movement. It is often implemented with firewall policy tied to roles or workloads.

A logical grouping of switch ports or wireless clients that behaves like a separate network segment. VLANs are commonly used to separate traffic by role, department, or trust level.

A Wi-Fi security certification based on the 802.11i standard that provides strong encryption and integrity for wireless traffic. It supports personal mode with a shared passphrase and enterprise mode with 802.1X authentication.

A newer Wi-Fi security certification that improves on WPA2 with stronger handshakes, protection of open networks, and resistance to offline password guessing. It also supports enterprise authentication with 192-bit security options.

A Wi-Fi deployment mode where each user or device authenticates individually through an authentication server using 802.1X, rather than sharing one passphrase. It enables per-user roles and easier credential revocation.

A secret value shared by all users of a Wi-Fi network in personal mode. Anyone who knows it can join, and changing it requires updating every client, so it suits small or low-risk environments.

The password-based key exchange used in WPA3-Personal that resists offline dictionary attacks. It replaces the WPA2 personal handshake while still allowing a shared passphrase.

An unauthorized wireless access point connected to a network, whether maliciously or by an employee. It can bypass security controls and expose internal traffic to outsiders.

A fraudulent access point that imitates a legitimate network name to trick clients into connecting. Once clients connect, the attacker can capture credentials or inspect traffic.

A social engineering attack that uses deceptive messages to trick people into revealing credentials or running malicious content. It remains a common initial step in network intrusions.

Manipulating people through trust, urgency, or authority to obtain information or access. It targets human behavior rather than technical weaknesses.

Malware that encrypts or locks data and demands payment for restoration. Recovery depends on backups, segmentation, and rapid detection rather than paying the attacker.

An attack where an adversary secretly relays or alters traffic between two parties who believe they are communicating directly. Strong encryption and certificate validation help detect or prevent it.

A trusted entity that issues and signs digital certificates used to prove identity. Clients rely on it to validate that a server or device is genuine during encrypted authentication.

Monitoring radio activity to spot unauthorized access points, attacks, or policy violations. Alerts help administrators locate and remove threats that wired monitoring cannot see.

A wireless monitoring feature that classifies nearby access points and clients as authorized, rogue, or interfering. It helps administrators find unauthorized devices and contain them.

An action that isolates or disrupts a suspected threat, such as blocking a rogue access point or quarantining an endpoint. It aims to stop spread while investigation proceeds.

A structured process for preparing for, detecting, containing, eradicating, and recovering from security incidents. It ends with lessons learned that improve future defenses.

A platform that collects logs and events from many sources, correlates them, and generates alerts for investigation. It supports detection, compliance reporting, and incident response workflows.

A standard protocol and message format for sending log events from network devices to a central collector. Severity levels and facility codes help filter and route messages.

The part of AAA that records session activity such as start time, stop time, and data volume. These records support auditing, billing, and forensic investigation.

A protocol that synchronizes clocks across network devices. Accurate time is essential because log correlation and forensic timelines depend on consistent timestamps.