[Q93-Q115] Dec-2025 Realistic HPE6-A78 Accurate & Verified Answers As Experienced in the Actual Test!

Dec-2025 Realistic HPE6-A78 Accurate & Verified Answers As Experienced in the Actual Test!

Latest HP HPE6-A78 Practice Test Questions, Aruba Certified Network Security Associate Exam Exam Dumps

NEW QUESTION # 93
What is a consideration for using MAC authentication (MAC-Auth) to secure a wired or wireless connection?

• A. As a Layer 2 authentication method, MAC-Auth cannot be used to authenticate devices to an external authentication server.
• B. MAC-Auth can add a degree of security to an open WLAN by enabling the generation of a PMK to encrypt traffic.
• C. It is very easy for hackers to spoof their MAC addresses and get around MAC authentication.
• D. Headless devices, such as Internet of Things (loT) devices, must be configured in advance to support MAC-Auth.

Answer: C

Explanation:
MAC authentication, also known as MAC-Auth, is a method used to authenticate devices based on their Media Access Control (MAC) address. It is often employed in both wired and wireless networks to grant network access based solely on the MAC address of a device. While MAC-Auth is straightforward and doesn't require complex configuration, it has significant security limitations primarily because MAC addresses can be easily spoofed. Attackers can change the MAC address of their device to match an authorized one, thereby gaining unauthorized access to the network. This susceptibility to MAC address spoofing makes MAC-Auth a weaker security mechanism compared to more robust authentication methods like 802.1X, which involves mutual authentication and encryption protocols.

NEW QUESTION # 94
What is an example or phishing?

• A. An attacker lures clients to connect to a software-based AP that is using a legitimate SSID.
• B. An attacker checks a user's password by using trying millions of potential passwords.
• C. An attacker sends emails posing as a service team member to get users to disclose their passwords.
• D. An attacker sends TCP messages to many different ports to discover which ports are open.

Answer: C

NEW QUESTION # 95
What role does the Aruba ClearPass Device Insight Analyzer play in the Device Insight architecture?

• A. It resides in the cloud and manages licensing and configuration for Collectors
• B. It resides In the cloud and applies machine learning and supervised crowdsourcing to metadata sent by Collectors
• C. It resides on-prem and is responsible for running active SNMP and Nmap scans
• D. It resides on-prem and provides the span port to which traffic is mirrored for deep analytics.

Answer: B

Explanation:
The Aruba ClearPass Device Insight Analyzer plays a crucial role within the Device Insight architecture by residing in the cloud and applying machine learning and supervised crowdsourcing to the metadata sent by Collectors. This component of the architecture is responsible for analyzing vast amounts of data collected from the network to identify and classify devices accurately. By utilizing machine learning algorithms and crowdsourced input, the Device Insight Analyzer enhances the accuracy of device detection and classification, thereby improving the overall security and management of the network.
References:
Aruba ClearPass official documentation and whitepapers that detail the functionality and deployment of the Device Insight Analyzer.
Technical articles and presentations on network security solutions that discuss the use of machine learning and data analytics in device management.

NEW QUESTION # 96
Refer to the exhibit.
Device A is establishing an HTTPS session with the Arubapedia web sue using Chrome. The Arubapedia web server sends the certificate shown in the exhibit What does the browser do as part of vacating the web server certificate?

• A. It uses the public key in the DigCen SHA2 Secure Server CA certificate to check the certificate's signature.
• B. It uses the private key in the DigiCert SHA2 Secure Server CA to check the certificate's signature.
• C. It uses the private key in the Arubapedia web site's certificate to check that certificate's signature
• D. It uses the public key in the DigCert root CA certificate to check the certificate signature

Answer: A

Explanation:
When a browser, like Chrome, is validating a web server's certificate, it uses the public key in the certificate's signing authority to verify the certificate's digital signature. In the case of the exhibit, the browser would use the public key in the DigiCert SHA2 Secure Server CA certificate to check the signature of the Arubapedia web server's certificate. This process ensures that the certificate was indeed issued by the claimed Certificate Authority (CA) and has not been tampered with.
:
Browser security documentation and SSL/TLS standards that explain the certificate validation process.
Cybersecurity educational resources that cover the principles of public key infrastructure (PKI) and certificate validation.

NEW QUESTION # 97
A company with 439 employees wants to deploy an open WLAN for guests. The company wants the experience to be as follows:
* Guests select the WLAN and connect without having to enter a password.
* Guests are redirected to a welcome web page and log in.
The company also wants to provide encryption for the network for devices that are capable. Which security options should you implement for the WLAN?

• A. Opportunistic Wireless Encryption (OWE) and WPA3-Personal
• B. WPA3-Personal and MAC-Auth
• C. Captive portal and WPA3-Personal
• D. Captive portal and Opportunistic Wireless Encryption (OWE) in transition mode

Answer: D

Explanation:
Opportunistic Wireless Encryption (OWE) provides encrypted communications on open Wi-Fi networks, which addresses the company's desire to have encryption without requiring a password for guests. It can work in transition mode, which allows for the use of OWE by clients that support it, while still permitting legacy clients to connect without encryption. Combining this with a captive portal enables the desired welcome web page for guests to log in.

NEW QUESTION # 98
What is a benefit of Opportunistic Wireless Encryption (OWE)?

• A. It allows both WPA2-capabie and WPA3-capable clients to authenticate to the same WPA-Personal WLAN
• B. It offers more control over who can connect to the wireless network when compared with WPA2-Personal
• C. It provides protection for wireless clients against both honeypot APs and man-in-the-middle (MUM) attacks
• D. It allows anyone lo connect, but provides better protection against eavesdropping than a traditional open network

Answer: D

NEW QUESTION # 99
From which solution can ClearPass Policy Manager (CPPM) receive detailed information about client device type OS and status?

• A. ClearPass Guest
• B. ClearPass Access Tracker
• C. ClearPass Onboard
• D. ClearPass OnGuard

Answer: D

NEW QUESTION # 100
What is a benefit of Protected Management Frames (PMF). sometimes called Management Frame Protection (MFP)?

• A. PMF helps to protect APs and MCs from unauthorized management access by hackers.
• B. PMF ensures trial traffic between APs and Mobility Controllers (MCs) is encrypted.
• C. PMF prevents hackers from capturing the traffic between APs and Mobility Controllers.
• D. PMF protects clients from DoS attacks based on forged de-authentication frames

Answer: D

Explanation:
Protected Management Frames (PMF), also known as Management Frame Protection (MFP), is designed to protect clients from denial-of-service (DoS) attacks that involve forged de-authentication and disassociation frames. These attacks can disconnect legitimate clients from the network. PMF provides a way to authenticate these management frames, ensuring that they are not forged, thus enhancing the security of the wireless network.
:
IEEE 802.11w amendment, which introduces PMF as a security enhancement to protect management frames.
Wi-Fi Alliance security guidelines for Protected Management Frames (PMF).

NEW QUESTION # 101
Refer to the exhibit.

This company has ArubaOS-Switches. The exhibit shows one access layer switch, Swllcn-2. as an example, but the campus actually has more switches. The company wants to slop any internal users from exploiting ARP What Is the proper way to configure the switches to meet these requirements?

• A. On Switch-2, make ports connected to employee devices trusted ports for ARP protection
• B. On Swltch-2, configure static PP-to-MAC bindings for all end-user devices on the network
• C. On Swltch-2, enable DHCP snooping globally and on VLAN 201 before enabling ARP protection
• D. On Switch-1, enable ARP protection globally, and enable ARP protection on ail VLANs.

Answer: C

Explanation:
To prevent users from exploiting Address Resolution Protocol (ARP) on a network with ArubaOS-Switches, the correct approach would be to enable DHCP snooping globally and on VLAN 201 before enabling ARP protection, as stated in option C. DHCP snooping acts as a foundation by tracking and securing the association of IP addresses to MAC addresses. This allows ARP protection to function effectively by ensuring that only valid ARP requests and responses are processed, thus preventing ARP spoofing attacks.
Trusting ports that connect to employee devices directly could lead to bypassing ARP protection if those devices are compromised.
The company's goal is to prevent internal users from exploiting ARP within their ArubaOS-Switch network.
Let's break down the options:
Option A (Incorrect): Enabling ARP protection globally on Switch-1 and all VLANs is not the best approach. ARP protection should be selectively applied where needed, not globally. It's also not clear why Switch-1 is mentioned when the exhibit focuses on Switch-2.
Option B (Incorrect): Making ports connected to employee devices trusted for ARP protection is a good practice, but it's not sufficient by itself. Trusted ports allow ARP traffic, but we need an additional layer of security.
Option C (Correct): This is the recommended approach. Here's why:
DHCP Snooping: First, enable DHCP snooping globally. DHCP snooping helps validate DHCP messages and builds an IP-MAC binding table. This table is crucial for ARP protection to function effectively.
VLAN 201: Enable DHCP snooping specifically on VLAN 201 (as shown in the exhibit). This ensures that DHCP messages within this VLAN are validated.
ARP Protection: Once DHCP snooping is in place, enable ARP protection. ARP requests/replies from untrusted ports with invalid IP-to-MAC bindings will be dropped. This prevents internal users from exploiting ARP for attacks like man-in-the-middle.
Option D (Incorrect): While static ARP bindings can enhance security, they are cumbersome to manage and don't dynamically adapt to changes in the network.
References:
ArubaOS-Switch Management and Configuration Guide for WB_16_10 - Chapter 15: IP Routing Features Aruba Security Guide

NEW QUESTION # 102
What is symmetric encryption?

• A. It simultaneously creates ciphertext and a same-size MAC.
• B. It any form of encryption mat ensures that thee ciphertext Is the same length as the plaintext.
• C. It uses the same key to encrypt plaintext as to decrypt ciphertext.
• D. It uses a Key that is double the size of the message which it encrypts.

Answer: C

NEW QUESTION # 103
A company has an Aruba solution with a Mobility Master (MM) Mobility Controllers (MCs) and campus Aps. What is one benefit of adding Aruba Airwave from the perspective of forensics?

• A. AirWave enables low level debugging on the devices across the ArubaOS solution
• B. Airwave can provide more advanced authentication and access control services for the AmbaOS solution
• C. Airwave retains information about the network for much longer periods than ArubaOS solution
• D. Airwave is required to activate Wireless Intrusion Prevention (WIP) services on the ArubaOS solution

Answer: C

Explanation:
Adding Aruba Airwave to an Aruba solution that includes a Mobility Master (MM), Mobility Controllers (MCs), and campus APs offers several benefits, notably in the realm of network forensics. One of the significant advantages is that Airwave can retain detailed information about the network for much longer periods than what is typically possible with just ArubaOS solutions. This extensive data retention is crucial for forensic analysis, allowing network administrators and security professionals to conduct thorough investigations of past incidents. With access to historical data, professionals can identify trends, pinpoint security breaches, and understand the impact of specific changes or events within the network over time.
:
Aruba's official product documentation and user guides for Airwave and ArubaOS, which outline features, benefits, and use cases related to network management and forensic capabilities.
Industry case studies and whitepapers that discuss the implementation and advantages of integrating Airwave into existing network infrastructure for enhanced monitoring and security.

NEW QUESTION # 104
What is a correct guideline for the management protocols that you should use on ArubaOS-Switches?

• A. Disable HTTPS and use SSH instead
• B. Disable Telnet and use TFTP instead.
• C. Disable SSH and use https instead.
• D. Disable Telnet and use SSH instead

Answer: C

NEW QUESTION # 105
Your company policies require you to encrypt logs between network infrastructure devices and Syslog servers. What should you do to meet these requirements on an ArubaOS-CX switch?

• A. Specify the Syslog server with the UDP option and then add an CPsec tunnel that selects Syslog.
• B. Set up RadSec and then enable Syslog as a protocol carried by the RadSec tunnel.
• C. Specify a priv key with the Syslog settings that matches a priv key on the Syslog server.
• D. Specify the Syslog server with the TLS option and make sure the switch has a valid certificate.

Answer: D

Explanation:
To ensure secure transmission of log data over the network, particularly when dealing with sensitive or critical information, using TLS (Transport Layer Security) for encrypted communication between network devices and syslog servers is necessary:
Secure Logging Setup: When configuring an ArubaOS-CX switch to send logs securely to a Syslog server, specifying the server with the TLS option ensures that all transmitted log data is encrypted. Additionally, the switch must have a valid certificate to establish a trusted connection, preventing potential eavesdropping or tampering with the logs in transit.
Other Options:
Option B, Option C, and Option D are less accurate or applicable for directly encrypting log data between the device and Syslog server as specified in the company policies.

NEW QUESTION # 106
Refer to the exhibit, which shows the current network topology.

You are deploying a new wireless solution with an Aruba Mobility Master (MM). Aruba Mobility Controllers (MCs). and campus APs (CAPs). The solution will Include a WLAN that uses Tunnel for the forwarding mode and Implements WPA3-Enterprise security What is a guideline for setting up the vlan for wireless devices connected to the WLAN?

• A. Use wireless user roles to assign the devices to a range of new vlan IDs.
• B. Use wireless user roles to assign the devices to different VLANs in the 100-150 range
• C. Assign the WLAN to a single new VLAN which is dedicated to wireless users
• D. Assign the WLAN to a named VLAN which specified 100-150 as the range of IDs.

Answer: B

NEW QUESTION # 107
Why might devices use a Diffie-Hellman exchange?

• A. to obtain a digital certificate signed by a trusted Certification Authority
• B. to signal that they want to use asymmetric encryption for future communications
• C. to prove knowledge of a passphrase without transmitting the passphrase
• D. to agree on a shared secret in a secure manner over an insecure network

Answer: D

Explanation:
Devices use the Diffie-Hellman exchange to agree on a shared secret in a secure manner over an insecure network. The main purpose of this cryptographic protocol is to enable two parties to establish a shared secret over an unsecured communication channel. This shared secret can then be used to encrypt subsequent communications using a symmetric key cipher. The Diffie-Hellman exchange is particularly valuable because it allows the secure exchange of cryptographic keys over a public channel without the need for a prior shared secret. This protocol is a foundational element for many secure communications protocols, including SSL/TLS, which is used to secure connections on the internet. References to the Diffie-Hellman protocol and its uses can be found in standard cryptographic textbooks and documentation such as those from the Internet Engineering Task Force (IETF) and security protocol specifications.

NEW QUESTION # 108
What is a difference between passive and active endpoint classification?

• A. Passive classification classifies endpoints based on entries in dictionaries, while active classification uses admin-defined rules to classify endpoints.
• B. Passive classification refers exclusively to MAC OUI-based classification, while active classification refers to any other classification method.
• C. Passive classification analyzes traffic that endpoints send as part of their normal functions; active classification involves sending requests to endpoints.
• D. Passive classification is only suitable for profiling endpoints in small business environments, while enterprises should use active classification exclusively.

Answer: C

Explanation:
HPE Aruba Networking ClearPass Policy Manager (CPPM) uses endpoint classification (profiling) to identify and categorize devices on the network, enabling policy enforcement based on device type, OS, or other attributes. CPPM supports two primary profiling methods: passive and active classification.
Passive Classification: This method involves observing network traffic that endpoints send as part of their normal operation, without CPPM sending any requests to the device. Examples include DHCP fingerprinting (analyzing DHCP Option 55), HTTP User-Agent string analysis, and TCP fingerprinting (analyzing TTL and window size). Passive classification is non-intrusive and does not generate additional network traffic.
Active Classification: This method involves CPPM sending requests to the endpoint to gather information. Examples include SNMP scans (to query device details), WMI scans (for Windows devices), and SSH scans (to gather system information). Active classification is more intrusive and may require credentials or network access to the device.
Option A, "Passive classification refers exclusively to MAC OUI-based classification, while active classification refers to any other classification method," is incorrect. Passive classification includes more than just MAC OUI-based classification (e.g., DHCP fingerprinting, TCP fingerprinting). MAC OUI (Organizationally Unique Identifier) analysis is one passive method, but not the only one. Active classification specifically involves sending requests, not just "any other method." Option B, "Passive classification classifies endpoints based on entries in dictionaries, while active classification uses admin-defined rules to classify endpoints," is incorrect. Both passive and active classification use CPPM's fingerprint database (not "dictionaries") to match device attributes. Admin-defined rules are used for policy enforcement, not classification, and apply to both methods.
Option C, "Passive classification is only suitable for profiling endpoints in small business environments, while enterprises should use active classification exclusively," is incorrect. Passive classification is widely used in enterprises because it is non-intrusive and scalable. Active classification is often used in conjunction with passive methods to gather more detailed information, but enterprises do not use it exclusively.
Option D, "Passive classification analyzes traffic that endpoints send as part of their normal functions; active classification involves sending requests to endpoints," is correct. This accurately describes the fundamental difference between the two methods: passive classification observes existing traffic, while active classification actively queries the device.
The HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide states:
"Passive classification analyzes traffic that endpoints send as part of their normal functions, such as DHCP requests, HTTP traffic, or TCP packets, without ClearPass sending any requests to the device. Examples include DHCP fingerprinting and TCP fingerprinting. Active classification involves ClearPass sending requests to the endpoint to gather information, such as SNMP scans, WMI scans, or SSH scans, which may require credentials or network access." (Page 246, Passive vs. Active Profiling Section) Additionally, the ClearPass Device Insight Data Sheet notes:
"Passive classification observes network traffic generated by endpoints during normal operation, such as DHCP or HTTP traffic, to identify devices without generating additional traffic. Active classification, in contrast, sends requests to endpoints (e.g., SNMP or WMI scans) to gather detailed information, which can be more intrusive but provides deeper insights." (Page 3, Profiling Methods Section)
:
HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide, Passive vs. Active Profiling Section, Page 246.
ClearPass Device Insight Data Sheet, Profiling Methods Section, Page 3.

NEW QUESTION # 109
You are managing an Aruba Mobility Controller (MC). What is a reason for adding a "Log Settings" definition in the ArubaOS Diagnostics > System > Log Settings page?

• A. Configuring the log facility and log format that the MC will use for forwarding logs to all Syslog servers
• B. Configuring the MC to generate logs for a particular event category and level, but only for a specific user or AP.
• C. Configuring a filter that you can apply to a defined Syslog server in order to filter events by subcategory
• D. Configuring the Syslog server settings for the server to which the MC forwards logs for a particular category and level

Answer: D

Explanation:
The primary reason for adding a "Log Settings" definition in the ArubaOS Diagnostics > System > Log Settings page is to configure the Syslog server settings for the server to which the Mobility Controller (MC) forwards logs for a particular category and level. This setting enables the MC to send detailed logs to a Syslog server for centralized logging and monitoring, which is essential for troubleshooting, security analysis, and compliance with various policies.
:
ArubaOS documentation on log management and Syslog configuration.

NEW QUESTION # 110
A company has AOS-CX switches deployed in a two-tier topology that uses OSPF routing at the core.
You need to prevent ARP poisoning attacks. To meet this need, what is one technology that you could apply to user VLANs on access layer switches? (Select two.)

• A. OSPF passive interface
• B. BPDU guard (protection)
• C. BPDU filtering
• D. DHCPv4 snooping
• E. ARP inspection

Answer: D,E

Explanation:
The scenario involves AOS-CX switches in a two-tier topology (access and core layers) using OSPF routing at the core. The goal is to prevent ARP poisoning attacks on user VLANs at the access layer switches, where end-user devices connect. ARP poisoning (also known as ARP spoofing) is an attack where a malicious device sends fake ARP messages to associate its MAC address with the IP address of another device (e.g., the default gateway), allowing the attacker to intercept traffic.
ARP Inspection (Dynamic ARP Inspection, DAI): This feature prevents ARP poisoning by validating ARP packets against a trusted database of IP-to-MAC bindings. On AOS-CX switches, ARP inspection uses the DHCP snooping binding table to verify that ARP messages come from legitimate devices. If an ARP packet does not match the binding table, it is dropped.
DHCPv4 Snooping: This feature protects against rogue DHCP servers and builds a binding table of legitimate IP-to-MAC mappings by snooping DHCP traffic. The binding table is used by ARP inspection to validate ARP packets. DHCP snooping must be enabled before ARP inspection can function effectively, as it provides the trusted data for validation.
Option A, "ARP inspection," is correct. ARP inspection (DAI) directly prevents ARP poisoning by ensuring that ARP packets are legitimate, making it a key technology for this purpose.
Option B, "OSPF passive interface," is incorrect. OSPF passive interface is used to prevent OSPF from sending routing updates on specific interfaces, typically to reduce routing protocol traffic on user-facing interfaces. It does not prevent ARP poisoning, which is a Layer 2 attack.
Option C, "BPDU guard (protection)," is incorrect. BPDU guard protects against spanning tree protocol (STP) attacks by disabling a port if it receives BPDUs (e.g., from an unauthorized switch). It does not address ARP poisoning, which is unrelated to STP.
Option D, "DHCPv4 snooping," is correct. DHCP snooping is a prerequisite for ARP inspection, as it builds the binding table used to validate ARP packets. It also protects against rogue DHCP servers, which can indirectly contribute to ARP poisoning by assigning incorrect IP addresses.
Option E, "BPDU filtering," is incorrect. BPDU filtering prevents a port from sending or receiving BPDUs, which can be used to protect against STP attacks, but it does not prevent ARP poisoning.
The HPE Aruba Networking AOS-CX 10.12 Security Guide states:
"To prevent ARP poisoning attacks on user VLANs, enable Dynamic ARP Inspection (DAI) on access layer switches. DAI validates ARP packets against the DHCP snooping binding table to ensure they come from legitimate devices. Use the command ip arp inspection vlan <vlan-list> to enable DAI on the specified VLANs. DHCP snooping must be enabled first with dhcp-snooping and dhcp-snooping vlan <vlan-list> to build the binding table used by DAI." (Page 145, ARP Inspection and DHCP Snooping Section) Additionally, the guide notes:
"DHCP snooping and ARP inspection work together to protect against Layer 2 attacks like ARP poisoning. DHCP snooping builds a trusted database of IP-to-MAC bindings, which ARP inspection uses to filter out malicious ARP packets." (Page 146, Best Practices Section)
:
HPE Aruba Networking AOS-CX 10.12 Security Guide, ARP Inspection and DHCP Snooping Section, Page 145.
HPE Aruba Networking AOS-CX 10.12 Security Guide, Best Practices Section, Page 146.

NEW QUESTION # 111
Refer to the exhibit.

This Aruba Mobility Controller (MC) should authenticate managers who access the Web Ul to ClearPass Policy Manager (CPPM) ClearPass admins have asked you to use RADIUS and explained that the MC should accept managers' roles in Aruba-Admin-Role VSAs Which setting should you change to follow Aruba best security practices?

• A. Disable local authentication
• B. Change the local user role to read-only
• C. Change the default role to "guest-provisioning"
• D. Clear the MSCHAP check box

Answer: C

NEW QUESTION # 112
Refer to the exhibit.

You need to ensure that only management stations in subnet 192.168.1.0/24 can access the ArubaOS-Switches' CLI. Web Ul. and REST interfaces The company also wants to let managers use these stations to access other parts of the network What should you do?

• A. Specify 192.168.1.0.255.255.255.0 as authorized IP manager address
• B. Configure the switch to listen for these protocols on OOBM only.
• C. Establish a Control Plane Policing class that selects traffic from 192.168 1.0/24.
• D. Specify vlan 100 as the management vlan for the switches.

Answer: C

NEW QUESTION # 113
Refer to the exhibit.

You have set up a RADIUS server on an ArubaOS Mobility Controller (MC) when you created a WLAN named "MyEmployees .You now want to enable the MC to accept change of authorization (CoA) messages from this server for wireless sessions on this WLAN.
What Is a part of the setup on the MC?

• A. Configure a ClearPass username and password in the MyEmployees AAA profile.
• B. Install the root CA associated with the 10 5.5.5 server's certificate as a Trusted CA certificate.
• C. Create a dynamic authorization, or RFC 3576, server with the 10.5.5.5 address and correct shared secret.
• D. Enable the dynamic authorization setting in the "clearpass" authentication server settings.

Answer: C

Explanation:
To enable an ArubaOS Mobility Controller (MC) to accept Change of Authorization (CoA) messages from a RADIUS server for wireless sessions on a WLAN, part of the setup on the MC involves creating a dynamic authorization, or RFC 3576, server with the provided IP address (10.5.5.5) and the correct shared secret. This setup allows the MC to handle CoA requests, which are used to change the authorization attributes of a session after it has been authenticated, such as disconnecting a user or changing a user's VLAN assignment.

NEW QUESTION # 114
A company is deploying ArubaOS-CX switches to support 135 employees, which will tunnel client traffic to an Aruba Mobility Controller (MC) for the MC to apply firewall policies and deep packet inspection (DPI). This MC will be dedicated to receiving traffic from the ArubaOS-CX switches.
What are the licensing requirements for the MC?

• A. one PEF license per-switch
• B. one PEF license per-switch. and one WCC license per-switch
• C. one AP license per-switch
• D. one AP license per-switch. and one PEF license per-switch

Answer: A

Explanation:
When deploying ArubaOS-CX switches that tunnel client traffic to an Aruba Mobility Controller (MC), the licensing requirements typically involve Policy Enforcement Firewall (PEF) licenses. These licenses enable the MC to enforce firewall policies and perform deep packet inspection (DPI). Therefore, for each switch tunneling traffic to the MC, a PEF license would be necessary.

NEW QUESTION # 115
......

To prepare for the HPE6-A78 exam, candidates can take advantage of various resources, such as study guides, practice exams, and online training courses. These resources are designed to help candidates gain a deeper understanding of the exam topics and increase their chances of passing the exam. Additionally, candidates can participate in study groups or online communities to connect with other IT professionals who are preparing for the exam.

 

Free HPE6-A78 Exam Files Downloaded Instantly 100% Dumps & Practice Exam: https://www.exam4free.com/HPE6-A78-valid-dumps.html

Dec-2025 Pass HP HPE6-A78 Exam in First Attempt Easily: https://drive.google.com/open?id=1eqDLEXiYDAxqjTVNMw4AMtvKE2fxSr5q