Aruba Network Security Professional study plan
Aruba Network Security Professional · Give each week a clear focus.
8 weeks · About 6 hours per week
Identity, Authentication, and Access Control (ClearPass and AAA)
Map the full 802.1X/EAP exchange flow (supplicant, authenticator, authentication server) and label each message on a hand-drawn diagram
Compare EAP-TLS, PEAP-MSCHAPv2, and EAP-TTLS in a table covering credential type, server certificate requirement, and typical failure modes
Explain the distinct roles of RADIUS authentication, authorization, and accounting and identify which attributes drive each
List the ClearPass service-selection inputs (NAS, SSID, port type, MAC, endpoint attributes) and describe evaluation order
Your checkpoint
A one-page 802.1X/EAP reference diagram plus a comparison table of the three EAP methods with at least five attributes each
Identity, Authentication, and Access Control (ClearPass and AAA)
Design a ClearPass service model for a mixed wired/wireless environment, specifying enforcement profiles for each outcome
Differentiate role mapping, enforcement policies, and enforcement profiles and show where each attaches in the request flow
Describe how posture and endpoint profiling inputs influence authorization decisions
Trace a failed authentication from supplicant to ClearPass and identify the three most likely cause categories
Your checkpoint
A written ClearPass service-design document covering at least four services with role mapping and enforcement outcomes for permit, deny, and quarantine
Role-Based Access Control and Policy Enforcement
Explain how vendor-specific attributes and RADIUS return attributes are translated into client-side roles
Design a role hierarchy for a campus network covering employees, contractors, guests, and IoT, with least-privilege intent per role
Define policy enforcement points and contrast role assignment at the controller/AP versus the switch port
Apply a deny-by-default posture by writing explicit allow rules and identifying implicit deny gaps
Your checkpoint
A role-and-policy matrix mapping at least five user/device categories to roles, permitted destinations, and enforcement point
Aruba Security Architecture and Solution Components
Diagram the Aruba security architecture layers and place ClearPass, controllers/gateways, switches, and APs at their correct enforcement positions
Distinguish which security functions live at the gateway/controller versus the access layer in a given deployment
Identify which solution component owns policy decision versus policy enforcement in three sample scenarios
Describe how centralized versus distributed enforcement changes trust boundaries
Your checkpoint
An annotated architecture diagram of a reference deployment with a written paragraph per component stating its decision/enforcement role
Secure WLAN and Wired Port Security Configuration
Configure a WLAN with WPA3-Enterprise and 802.1X, then verify the EAP method negotiated in client and server logs
Configure a wired port for 802.1X with MAC authentication fallback and describe the authentication order
Set up a guest SSID with captive-portal-based authorization and define the redirect and role-assignment steps
Compare WPA2-PSK, WPA2-Enterprise, and WPA3-SAE/Enterprise and select the correct mode for three stated requirements
Your checkpoint
A configuration checklist for one secure WLAN, one 802.1X wired port, and one guest SSID, each with the verification command or log entry that confirms success
Network Security Fundamentals and Threat Landscape & Monitoring, Threat Detection, and Incident Response
Catalog the major threat classes (rogue AP, evil twin, MAC spoofing, on-path interception, credential theft) and map each to a detection signal
Explain how WIDS/WIPS signatures, RF monitoring, and containment actions detect and respond to rogue devices
Describe how authentication and accounting logs feed threat detection and what anomalies indicate compromise
Draft an incident-response sequence for a detected rogue AP from alert through containment and documentation
Your checkpoint
A threat-to-detection-to-response table covering at least six threat classes with the monitoring signal and first response action for each
Security Troubleshooting and Validation
Build a troubleshooting decision tree for 802.1X failures branching on certificate, credential, VLAN, and RADIUS reachability causes
Identify the specific log source and field to inspect for each of five common authentication and authorization failures
Validate a role-based policy by predicting the outcome of four test cases and confirming against enforcement behavior
Distinguish client-side, authenticator-side, and server-side faults from a single symptom description
Your checkpoint
A troubleshooting runbook with at least eight symptom-to-root-cause-to-fix entries, each naming the log or command used to confirm
Network Security Fundamentals and Threat Landscape & Aruba Security Architecture and Solution Components & Identity, Authentication, and Access Control (ClearPass and AAA) & Role-Based Access Control and Policy Enforcement & Secure WLAN and Wired Port Security Configuration & Monitoring, Threat Detection, and Incident Response & Security Troubleshooting and Validation
Re-derive the 802.1X/EAP flow and ClearPass service model from memory and reconcile against week 1-2 notes
Re-run the role-and-policy matrix against the architecture diagram to confirm decision and enforcement points align
Complete a timed mixed-domain practice set and categorize every miss by domain
Re-teach the three weakest objectives in writing to confirm retention
Your checkpoint
A final one-page consolidated reference sheet plus a scored practice-set log with each missed item tagged to its domain and a remediation note
Milestones
Week 2: Can explain the full 802.1X/EAP exchange and the ClearPass service-selection and enforcement flow without notes
Week 4: Can place every major Aruba security component at its correct decision or enforcement position in an architecture diagram
Week 6: Can map six threat classes to concrete detection signals and first response actions
Week 8: Practice-set score log shows no domain below 70% and all missed items have a written remediation note