Aruba Network Security Professional flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Core security model: Confidentiality protects data from unauthorized disclosure, Integrity ensures data is unaltered, and Availability ensures systems remain accessible to authorized users.

On-path attack

An attacker positioned between two parties intercepts or alters traffic, often via ARP poisoning or rogue APs; mitigated by TLS, mutual authentication, and DAI.

Evil twin AP

A rogue access point broadcasting a legitimate SSID to lure clients, enabling credential capture or traffic interception; detected by WIDS and mitigated by server certificate validation.

PKI trust chain

Hierarchy of root CA, intermediate CA, and leaf certificates where each certificate is signed by the one above, validating identity and enabling secure authentication.

HMAC

Keyed hash function combining a secret key with a message to provide integrity and authenticity, commonly used in RADIUS message authenticators and API signing.

Dynamic Segmentation

Aruba architecture assigning a user or device role independent of physical topology, enforced consistently across wired, wireless, and WAN via role-based ACLs.

Policy Enforcement Point

The network access device, such as an AOS-CX switch, AP, controller, or gateway, that applies the role and ACL returned by ClearPass.

ClearPass Policy Manager

The Aruba AAA and policy decision point that authenticates users and devices, evaluates authorization rules, and returns enforcement profiles to network devices.

AOS-CX role ACL

Hardware-enforced access control list bound to a port-access role, permitting or denying traffic based on assigned role rather than static VLAN membership.

ClearPass OnGuard

Posture assessment module checking endpoint health, such as antivirus, patch level, and firewall state, before granting full network access.

EAP-TLS

Mutual certificate-based 802.1X method where both client and server present certificates; strongest EAP method and resistant to credential theft.

PEAP

802.1X tunneled EAP method using a server certificate to build a TLS tunnel, then authenticating the user with inner MSCHAPv2 credentials.

RADIUS Access-Accept

Server response indicating successful authentication, optionally carrying attributes such as role, VLAN, or ACL used by the network device for enforcement.

Change of Authorization

RFC 5176 mechanism letting the RADIUS server push updated policy to an active session, forcing a new role or disconnect without reauthentication.

MAC authentication bypass

Fallback authentication using the device MAC address as credential; spoofable, so pair with profiling and treat as lower trust than 802.1X.

TACACS+

Cisco-originated AAA protocol on TCP port 49 that encrypts the full payload and is typically used for administrative device access control.

ClearPass service

Ordered rule set matching NAD, SSID or port, and authentication method to determine which auth sources and role mapping apply.

Role mapping

ClearPass authorization step evaluating attributes such as AD group, posture, or device type to assign a role used for enforcement.

Enforcement profile

ClearPass object defining the RADIUS attributes returned on success, such as role name, VLAN, or downloadable ACL.

Least privilege

Design principle granting only the access required for a function; in Aruba, implemented via narrow roles and default-deny fallback policies.

Fallback role

Role applied when no authorization rule matches; should be restrictive, such as captive portal or deny, to avoid unintended access.

WPA3-SAE

WPA3-Personal authentication using Simultaneous Authentication of Equals, a password-authenticated key exchange resistant to offline dictionary attacks on captured handshakes.

802.11w PMF

Protected Management Frames encrypting and integrity-protecting management frames such as deauth and disassoc, preventing spoofed disconnection attacks.

DHCP snooping

Switch feature blocking unauthorized DHCP servers and building a trusted binding table used by Dynamic ARP Inspection and IP Source Guard.

BPDU guard

Access-port safeguard that err-disables a port receiving BPDUs, preventing rogue switches from altering spanning-tree topology.

Tunneled node

Aruba mode sending user traffic from an access device to a gateway for centralized policy enforcement, common for WAN and guest segmentation.

ClearPass Access Tracker

Diagnostic view showing each authentication request, matched service, source result, and enforcement profile; primary tool for AAA troubleshooting.

Rogue AP classification

Distinguishing a rogue (unauthorized AP on the wired network) from an interfering neighbor AP; only rogues typically warrant containment action.

Incident response lifecycle

Structured phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned with evidence preservation.

Syslog and NTP

Forwarding device logs to a central collector while synchronizing clocks, enabling accurate correlation of security events across Aruba infrastructure.

CoA port 3799

Default UDP port a network access device listens on for Change of Authorization messages; mismatched port or secret prevents dynamic policy updates.

show port-access clients

AOS-CX command displaying connected clients with authentication state, assigned role, and VLAN, used to validate 802.1X and role enforcement.

RADIUS shared secret

Pre-shared key between network device and RADIUS server protecting message integrity; a mismatch causes silent authentication failures or timeouts.