I85PREP
⌘ K
Aruba Network Security Associate study materials
Aruba Network Security Associate study resources

Aruba Network Security Associate practice questions

One question at a time. Build your Aruba Network Security Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security fundamentals and threat landscape

Which security principle states that a user should be granted only the minimum access necessary to perform their job?

  1. Zero trust
  2. Principle of least privilege Correct answer.
  3. Defense in depth
  4. Separation of duties

Explanation

Least privilege limits each account to only the permissions required for its function, reducing the blast radius of a compromise. It is applied to users, services, and processes alike.

Question 2Security fundamentals and threat landscape

What is the primary purpose of a DMZ in a network architecture?

  1. To segment publicly reachable services away from the internal network Correct answer.
  2. To encrypt all traffic between internal hosts
  3. To speed up internal DNS resolution
  4. To provide backup power to network devices

Explanation

A DMZ is a buffer zone that hosts internet-facing services while restricting their access to internal systems. If a public server is compromised, the internal network remains shielded by the intervening controls.

Question 3Security fundamentals and threat landscape

A phishing email tricks an employee into revealing credentials by impersonating the IT helpdesk. Which category of threat does this represent?

  1. Social engineering Correct answer.
  2. Packet sniffing
  3. Privilege escalation
  4. Denial of service

Explanation

Social engineering manipulates people into divulging information or performing actions that weaken security. Impersonation of a trusted party is a classic social-engineering technique.

Question 4Security fundamentals and threat landscape

Which malware type self-replicates across networks without requiring a host file or user action?

  1. Rootkit
  2. Trojan
  3. Worm Correct answer.
  4. Adware

Explanation

A worm is self-contained and spreads autonomously by exploiting network services. It does not need to attach to a host file or rely on a user to launch it.

Question 5Security fundamentals and threat landscape

What does the CIA triad stand for in information security?

  1. Confidentiality, Integrity, Availability Correct answer.
  2. Cryptography, Identity, Auditing
  3. Containment, Isolation, Authentication
  4. Control, Inspection, Authorization

Explanation

The CIA triad names the three core security goals: keeping data secret, keeping it unaltered, and keeping it reachable. Every control can be mapped to one or more of these goals.

Question 6Security fundamentals and threat landscape

Which authentication factor category does a fingerprint scan belong to?

  1. Something you have
  2. Somewhere you are
  3. Something you are Correct answer.
  4. Something you know

Explanation

Biometrics measure a physical characteristic of the person, which is the 'something you are' factor. Combining it with a password yields multi-factor authentication because the categories differ.

Question 7Security fundamentals and threat landscape

What is the main security benefit of network segmentation?

  1. It limits how far an attacker can move after an initial compromise Correct answer.
  2. It guarantees that no malware can enter the network
  3. It removes the requirement for logging
  4. It eliminates the need for user authentication

Explanation

Segmentation divides the network into zones with enforced boundaries, so a breach in one zone does not automatically grant access to others. This constrains lateral movement and buys defenders time.

Question 8Security fundamentals and threat landscape

Which term describes an attack that floods a service with traffic until legitimate users cannot access it?

  1. Shoulder surfing
  2. SQL injection
  3. Man-in-the-middle
  4. Denial of service Correct answer.

Explanation

A denial-of-service attack exhausts bandwidth, connections, or processing capacity so that real users are starved of service. Distributed variants use many sources to amplify the effect.

Question 9Security fundamentals and threat landscape

An attacker intercepts traffic between a user and a web server and relays it while reading the contents. Which threat is this?

  1. Brute force
  2. Phishing
  3. Man-in-the-middle Correct answer.
  4. Ransomware

Explanation

A man-in-the-middle attacker positions itself between two communicating parties to observe or alter traffic. Strong mutual authentication and encryption are the primary defenses against it.

Question 10Security fundamentals and threat landscape

Which control is an example of a preventive control?

  1. A firewall rule that blocks unauthorized inbound traffic Correct answer.
  2. A backup restored following data loss
  3. A security awareness poster in the break room
  4. A log review performed after an incident

Explanation

Preventive controls stop an event from occurring in the first place, and a blocking firewall rule does exactly that. Detective and corrective controls come into play after or during an event.

Question 11Security fundamentals and threat landscape

What does a salt add to password storage?

  1. A unique random value per password that defeats precomputed rainbow tables Correct answer.
  2. A fixed value shared by all accounts
  3. A reversible key that allows password recovery
  4. A second password that must also be entered

Explanation

A salt is unique per stored password, so identical passwords hash differently and precomputed tables become useless. It is stored alongside the hash and need not be secret.

Question 12Security fundamentals and threat landscape

Which statement best describes the difference between symmetric and asymmetric encryption?

  1. Symmetric is only used for signatures, while asymmetric is only used for bulk data
  2. Symmetric provides authentication, while asymmetric provides confidentiality
  3. Symmetric uses a key pair, while asymmetric uses one shared key
  4. Symmetric uses one shared key, while asymmetric uses a public and private key pair Correct answer.

Explanation

Symmetric algorithms use the same secret key for encryption and decryption, which is fast but requires secure key distribution. Asymmetric algorithms use a mathematically related key pair, solving distribution at the cost of speed.

Question 13Security fundamentals and threat landscape

Why is a hash function such as SHA-256 useful for verifying file integrity?

  1. It compresses the file to save storage
  2. It encrypts the file so it cannot be read
  3. It authenticates the sender's identity
  4. Any change to the file produces a different hash value Correct answer.

Explanation

A cryptographic hash is a one-way digest that changes unpredictably when the input changes, so comparing digests detects tampering. The hash itself does not hide the file contents.

Question 14Security fundamentals and threat landscape

A user receives a message urging immediate action and threatening account closure unless a link is clicked. Which social-engineering lever is being used?

  1. Reciprocity
  2. Authority of a known colleague
  3. Urgency and fear Correct answer.
  4. Curiosity

Explanation

Attackers manufacture time pressure and fear of loss to short-circuit careful thinking. The threat of account closure is designed to make the target act before verifying.

Question 15Security fundamentals and threat landscape

What is the role of a certificate authority in a public key infrastructure?

  1. It stores private keys for all subscribers
  2. It assigns IP addresses to clients
  3. It encrypts all traffic on the network
  4. It signs certificates that bind a public key to an identity Correct answer.

Explanation

A CA vouches for the association between a subject and its public key by signing a certificate. Relying parties trust the CA's signature to decide whether to trust the presented key.

Question 16Security fundamentals and threat landscape

Which practice most directly reduces the impact of a stolen laptop containing sensitive data?

  1. Using a shorter user password
  2. Full-disk encryption with strong key protection Correct answer.
  3. Storing data in an unencrypted shared folder
  4. Disabling the screen lock timeout

Explanation

Full-disk encryption makes the data unreadable without the key, so physical possession of the device does not equal access to the contents. Key protection prevents trivial bypass.

Question 17Security fundamentals and threat landscape

What distinguishes a vulnerability from a threat?

  1. A vulnerability is a patch, while a threat is a log event
  2. A vulnerability is a weakness, while a threat is a potential cause of harm Correct answer.
  3. A vulnerability is an attacker, while a threat is a weakness
  4. A vulnerability is a policy, while a threat is a control

Explanation

A vulnerability is an internal weakness such as a missing patch, and a threat is an external or internal actor or event that could exploit it. Risk arises when the two intersect.

Question 18Security fundamentals and threat landscape

An organization wants to detect unauthorized changes to critical configuration files. Which control is most appropriate?

  1. File integrity monitoring Correct answer.
  2. Load balancing
  3. Password complexity policy
  4. Network address translation

Explanation

File integrity monitoring records baseline hashes and alerts when files change unexpectedly, which is a detective control for tampering. The other options do not observe file contents.

Question 19Security fundamentals and threat landscape

Why should default credentials on network devices be changed before deployment?

  1. They interfere with DHCP
  2. They are widely known and allow trivial unauthorized access Correct answer.
  3. They consume excessive bandwidth
  4. They prevent firmware updates

Explanation

Default accounts and passwords are published in documentation and used by attackers as a first attempt. Changing them removes an easy entry point that requires no exploitation.

Question 20Security fundamentals and threat landscape

Which statement best characterizes zero trust architecture?

  1. Every access request is authenticated and authorized regardless of network location Correct answer.
  2. All users inside the perimeter are trusted by default
  3. Trust is granted once and persists for the session
  4. Only external traffic is inspected

Explanation

Zero trust removes implicit trust based on network position and evaluates each request against policy. Identity and device posture are checked continuously rather than once.

Question 21Security fundamentals and threat landscape

What is the purpose of a honeypot in a security program?

  1. To replace the need for firewalls
  2. To back up critical servers
  3. To accelerate legitimate user logins
  4. To attract and observe attacker activity away from production systems Correct answer.

Explanation

A honeypot is a decoy system with no legitimate production role, so any interaction with it is suspicious and can be studied. It provides early warning and intelligence about attacker techniques.

Question 22Security fundamentals and threat landscape

An attacker uses a list of common passwords against many accounts, trying a few guesses per account to avoid lockout. Which attack is this?

  1. Password spraying Correct answer.
  2. Rainbow table lookup
  3. Session fixation
  4. Credential stuffing with breached pairs

Explanation

Password spraying tries a small set of likely passwords across many accounts, staying under per-account lockout thresholds. It differs from trying many passwords against one account.

Question 23Security fundamentals and threat landscape

Which combination correctly pairs a security objective with a control that supports it?

  1. Confidentiality with public read access to backups
  2. Availability with redundant power and link failover Correct answer.
  3. Availability with a single unmonitored server
  4. Integrity with disabling audit logging

Explanation

Availability is supported by redundancy that keeps services running when a component fails, such as backup power and alternate links. The other pairings actively undermine the stated objective.

Question 24Security fundamentals and threat landscape

A vendor discloses a flaw in a protocol that lets an on-path attacker downgrade a session to a weaker cipher. Which property is most directly violated?

  1. Integrity of the vendor's website
  2. Availability of the server
  3. Confidentiality of the session Correct answer.
  4. Non-repudiation of the vendor

Explanation

A downgrade to a weak cipher lets an on-path attacker recover or read protected session data, which breaks confidentiality. The attack targets the protection of the communication channel.

Question 25Security fundamentals and threat landscape

Why does encrypting data at rest not by itself satisfy the confidentiality goal for data in use?

  1. Encryption at rest is reversible only by the attacker
  2. At-rest encryption applies only to backups
  3. Data must be decrypted to be processed, exposing it in memory and to the host Correct answer.
  4. Data in use is always transmitted over the internet

Explanation

At-rest encryption protects stored media, but applications must decrypt data to operate on it, so plaintext exists in memory and is accessible to a compromised host. Protecting data in use requires additional controls such as memory isolation or confidential computing.

Question 26Security fundamentals and threat landscape

Which category of malware self-replicates across networks without requiring a user to open a file or click a link?

  1. A worm Correct answer.
  2. A logic bomb
  3. A rootkit
  4. A trojan horse

Explanation

A worm spreads autonomously by exploiting reachable services and does not depend on user interaction to propagate. A trojan relies on deceiving a user into running it, while a rootkit focuses on hiding an intruder's presence.

Question 27Security fundamentals and threat landscape

What is the primary purpose of a DMZ in a network design?

  1. To encrypt all traffic leaving the data center
  2. To serve as the backup site for disaster recovery
  3. To provide redundant links between core switches
  4. To host internet-facing services in a segment isolated from the internal network Correct answer.

Explanation

A DMZ places externally reachable systems in a buffer zone so that a compromise there does not grant direct access to internal assets. Traffic between the DMZ and the internal network is restricted by policy.

Question 28Security fundamentals and threat landscape

What does the principle of least privilege require?

  1. Logging every action taken by privileged users
  2. Granting each identity only the access needed for its current tasks Correct answer.
  3. Requiring two administrators to approve every change
  4. Rotating all passwords on a fixed schedule

Explanation

Least privilege limits permissions to what is strictly necessary, reducing the blast radius if an account is misused or compromised. Approval workflows and logging are supporting controls, not the principle itself.

Question 29Security fundamentals and threat landscape

Which attack relies on tricking a user into revealing credentials through a counterfeit login page?

  1. Port scanning
  2. Packet sniffing
  3. Privilege escalation
  4. Phishing Correct answer.

Explanation

Phishing uses deceptive messages and fake pages to capture credentials or other sensitive data from the victim. The attacker exploits user trust rather than a technical flaw in the service.

Question 30Security fundamentals and threat landscape

An employee finds a USB drive in the parking lot and plugs it into a corporate workstation. Which threat is this scenario testing?

  1. Credential stuffing against web applications
  2. Denial of service against the endpoint
  3. On-path interception of wireless traffic
  4. Baiting with physical media to deliver malicious code Correct answer.

Explanation

Baiting exploits curiosity by leaving infected media where a target will find it and connect it. The success of the attack depends on the user's action, not on a network or application flaw.

Question 31Security fundamentals and threat landscape

An on-path attacker alters the payload of a message so that the receiver accepts modified data as genuine. Which security property has been violated?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Scalability
  4. Availability

Explanation

Integrity ensures data is not altered undetected between sender and receiver. Because the modification was accepted as genuine, the integrity guarantee failed even if the data remained readable.

Question 32Security fundamentals and threat landscape

Why is signature-based detection alone insufficient against a newly written malware sample?

  1. The sample has no known signature, so behavior-based analysis is needed to catch it Correct answer.
  2. The sample cannot execute without a valid digital signature
  3. Signatures are only effective for network traffic
  4. Antivirus engines cannot inspect files larger than one megabyte

Explanation

Signature detection matches known patterns, so novel or polymorphic code evades it until a signature is published. Behavioral or heuristic analysis observes what the code does instead of what it looks like.

Question 33Security fundamentals and threat landscape

A security team wants to reduce the risk of credential replay when an attacker captures authentication traffic. Which measure addresses this directly?

  1. Increasing the minimum password length
  2. Enabling verbose authentication logs
  3. Using challenge-response or time-based one-time credentials Correct answer.
  4. Segmenting the authentication server into its own VLAN

Explanation

Replay attacks succeed when a captured credential remains valid on reuse. Challenge-response and one-time codes make each captured value useless for a later attempt.

Question 34Security fundamentals and threat landscape

Which statement describes the role of a vulnerability scanner in a security program?

  1. It blocks malicious traffic inline based on signatures
  2. It identifies known weaknesses in hosts and services so they can be remediated Correct answer.
  3. It proves that an application has no exploitable flaws
  4. It encrypts sensitive fields in a database

Explanation

A scanner compares discovered software and configurations against known weakness databases and reports findings for remediation. It is an assessment tool and does not guarantee the absence of flaws.

Question 35Security fundamentals and threat landscape

An attacker with physical access to a switch connects a rogue device and begins sending forged frames to map the network. Which risk does this illustrate?

  1. Weak physical and port-level access controls on network infrastructure Correct answer.
  2. Missing encryption of backups
  3. Poor patching of server operating systems
  4. Insufficient password complexity for user accounts

Explanation

Unauthorized devices attached to accessible ports can observe and influence Layer 2 traffic. Port security, disabling unused ports, and locked wiring closets mitigate this class of risk.

Question 36Security fundamentals and threat landscape

What is the main risk of granting a service account interactive logon rights on many servers?

  1. Audit logs will be written more slowly
  2. The account cannot use certificate-based authentication
  3. Compromise of that account gives an attacker broad reach across systems Correct answer.
  4. The account will expire sooner than intended

Explanation

A shared, widely privileged service account becomes a high-value pivot point; compromising it once yields access to every system it can reach. Limiting where such accounts may log on contains the impact.

Question 37Security fundamentals and threat landscape

Which practice best limits the damage an attacker can do after stealing an employee's session token?

  1. Increasing the token's character length
  2. Binding sessions to additional context and enforcing short session lifetimes Correct answer.
  3. Storing the token in a longer-lived cookie
  4. Disabling multi-factor authentication for the user

Explanation

Short lifetimes and context binding reduce the window and conditions under which a stolen token is accepted. A stolen token remains usable until it expires or fails a binding check.

Question 38Security fundamentals and threat landscape

A company discovers that a former contractor's account still has active access months after the engagement ended. Which control failure does this represent?

  1. Insufficient network bandwidth planning
  2. Weak encryption of data in transit
  3. Missing redundancy in the authentication tier
  4. Inadequate identity lifecycle management for joiners, movers, and leavers Correct answer.

Explanation

Access must be revoked promptly when a relationship ends; otherwise orphaned accounts become an unmonitored entry point. Formal deprovisioning tied to HR or contract events prevents this.

Question 39Security fundamentals and threat landscape

An organization wants to reduce the likelihood that a compromised IoT camera can be used to reach internal file servers. Which approach is most effective?

  1. Placing IoT devices on a separate segment with deny-by-default rules to internal networks Correct answer.
  2. Enabling verbose syslog from the cameras
  3. Renaming the default administrator account on each camera
  4. Assigning static IP addresses to all IoT devices

Explanation

Isolation plus default-deny policy prevents a compromised device from initiating connections to sensitive internal systems. Address assignment and renaming do not change reachability.

Question 40Security fundamentals and threat landscape

A penetration test reports that an attacker chained a low-severity information leak with a misconfiguration to obtain administrative access. What does this demonstrate?

  1. Penetration tests cannot identify chained attack paths
  2. Low-severity findings can safely be ignored
  3. Misconfigurations are always more severe than software flaws
  4. Risk depends on how findings combine, so severity must be assessed in context Correct answer.

Explanation

Individually minor issues can combine into a serious path, so remediation priorities should consider exploitability in the environment. Scoring findings in isolation can understate real exposure.

Question 41Network access control and authentication

Which protocol is used by Aruba ClearPass to authenticate users against Active Directory?

  1. TACACS+
  2. LDAP Correct answer.
  3. Kerberos
  4. RADIUS

Explanation

ClearPass uses LDAP to query and authenticate users against Active Directory. LDAP is the standard directory access protocol for AD. RADIUS and TACACS+ are for network device authentication, and Kerberos is used for ticket-based authentication but is not the primary protocol ClearPass uses for AD authentication.

Question 42Network access control and authentication

In Aruba ClearPass, what is the primary function of a role?

  1. To define the authentication method used for a user
  2. To assign network privileges based on user attributes Correct answer.
  3. To determine the VLAN assignment for a switch port
  4. To specify the RADIUS shared secret

Explanation

A role in ClearPass is a logical grouping that determines network access privileges based on user or device attributes. Roles are used in enforcement policies to apply permissions. They do not define authentication methods, shared secrets, or VLANs directly.

Question 43Network access control and authentication

Which Aruba ClearPass feature allows you to create a custom portal for guest self-registration?

  1. Onboard
  2. Guest Correct answer.
  3. OnGuard
  4. Profiler

Explanation

The Guest feature in ClearPass provides self-registration portals for guests. Onboard is for device provisioning, OnGuard for endpoint posture assessment, and Profiler for device fingerprinting.

Question 44Network access control and authentication

What is the purpose of the Aruba ClearPass OnGuard agent?

  1. To authenticate users via RADIUS
  2. To enforce endpoint posture policies Correct answer.
  3. To provide guest access
  4. To manage network devices

Explanation

OnGuard is an endpoint agent that checks the posture of a device (e.g., antivirus status, OS patches) and enforces policies before allowing network access. It does not perform RADIUS authentication, provide guest access, or manage network devices.

Question 45Network access control and authentication

Which protocol does Aruba ClearPass use to authenticate users against an external LDAP server?

  1. RADIUS
  2. TACACS+
  3. Kerberos
  4. LDAP Correct answer.

Explanation

ClearPass uses LDAP to authenticate users against external LDAP servers such as Active Directory. RADIUS and TACACS+ are for network device authentication, and Kerberos is a ticket-based protocol not used for LDAP authentication.

Question 46Network access control and authentication

What is the default authentication protocol used by Aruba ClearPass Policy Manager for network devices?

  1. LDAP
  2. Kerberos
  3. TACACS+
  4. RADIUS Correct answer.

Explanation

ClearPass Policy Manager primarily uses RADIUS for network device authentication and authorization. TACACS+ is also supported but is not the default. LDAP and Kerberos are used for directory services, not for network device authentication.

Question 47Network access control and authentication

Which Aruba ClearPass feature is used to identify and classify devices connecting to the network?

  1. Profiler Correct answer.
  2. OnGuard
  3. Onboard
  4. Guest

Explanation

The Profiler feature in ClearPass collects attributes from network devices to fingerprint and classify endpoints. Guest is for visitor access, Onboard for device provisioning, and OnGuard for posture assessment.

Question 48Network access control and authentication

Which protocol is commonly used for secure web-based authentication in Aruba ClearPass?

  1. TACACS+
  2. HTTP
  3. HTTPS Correct answer.
  4. RADIUS

Explanation

HTTPS is used for secure web-based authentication, such as guest portals and administrative access, because it encrypts traffic with TLS. HTTP is unencrypted, and RADIUS and TACACS+ are not web protocols.

Question 49Network access control and authentication

In Aruba ClearPass, what is the purpose of an enforcement policy?

  1. To configure the RADIUS shared secret
  2. To determine the VLAN assignment for a switch port
  3. To define the authentication methods for a service
  4. To specify the actions to take based on the results of a service Correct answer.

Explanation

An enforcement policy in ClearPass determines the actions (e.g., permit, deny, VLAN assignment) based on the evaluation of conditions after authentication and authorization. It does not define authentication methods, shared secrets, or VLANs directly.

Question 50Network access control and authentication

Which Aruba ClearPass feature allows users to register their devices for network access?

  1. Guest
  2. Profiler
  3. OnGuard
  4. Onboard Correct answer.

Explanation

The Onboard feature in ClearPass enables users to register their devices and obtain certificates for secure network access. Guest is for visitor access, OnGuard for posture assessment, and Profiler for device classification.