Free HPE Network Security Expert Written Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the HPE Network Security Expert Written Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An AOS-CX 10.13 8400 switch already runs classifier policies. Before adding a forensic mirror policy, which pair of commands should an engineer use to inspect existing policies and competing hardware resources?

   1. A.show policy and show resourcesCorrect answer: A
   2. B.show policy and show class
   3. C.show resources and show interface
   4. D.show mirror and show interface

   Explanation: "Prior to configuring and installing a policy for troubleshooting purposes, issue the show policy commands and show resources commands to determine what existing features are consuming hardware resources on the switch." Filtering mirrored packets competes for hardware resources, so inspect policies and resources first.

   Reference: AOS-CX 10.13 Diagnostics and Supportability Guide — Chapter 11, Using classifier policies for traffic capture and analysis, p. 78

2. 2The ClearPass Monitoring guide describes an indicator of password guessing against an administrator account. Which log pattern matches that indicator?

   1. A.Many failures for the same account in a short intervalCorrect answer: A
   2. B.A single failure for the same account in a short interval
   3. C.Many successful logins for the same account in a short interval
   4. D.A small number of failures spread over a long interval

   Explanation: "The indicator of this type of attack is usually a large number of failed authentications in a short period of time to the same account." The guide associates this pattern with password guessing; it warrants investigation rather than automatic proof of compromise.

   Reference: ClearPass Monitoring — Excessive Failed Admin Login Attempts

3. 3A forensic investigator needs to determine the documented maximum retention of activity displayed in the ClearPass Device Insight Network Activity card. What is that interval?

   1. A.One week
   2. B.Two weeksCorrect answer: B
   3. C.Three weeks
   4. D.Four weeks

   Explanation: "ClearPass Device Insight retains the network activity records that are displayed in this card for two weeks." An investigation of older activity needs another source.

   Reference: Device Details Network Tab — Network Activity card

4. 4An investigator needs to capture egress traffic with a classifier policy on an AOS-CX 10.13 8400 switch. Which application context supports this?

   1. A.A global policy applied in the egress direction
   2. B.A physical interface policy applied in the egress directionCorrect answer: B
   3. C.A global policy applied in the ingress direction
   4. D.An out-of-band management port classifier policy

   Explanation: "AOS-CX does not allow you to apply a policy globally in the egress direction; apply a policy to a specific interface, VLAN, or LAG if egress traffic is required." The interface egress policy matches the requirement; global egress is unsupported and ingress does not select egress traffic.

   Reference: AOS-CX 10.13 Diagnostics and Supportability Guide — Chapter 11, Step three: apply the policy, p. 79

5. 5An investigator logs in to the ClearPass console and reviews the last-admin-login notification. What period do its failed-login counts cover?

   1. A.SSH and console failures since the most recent successful loginCorrect answer: A
   2. B.Only console failures since the latest configuration change
   3. C.Only SSH failures since the latest failed login
   4. D.All failures since the ClearPass server was first installed

   Explanation: "the number of failed attempts that were made through both SSH Secure Shell. SSH is a network protocol that provides secure access to a remote device. and the console since the most recent successful login." The notification combines SSH and console failures since the last successful login.

   Reference: ClearPass Monitoring — Last admin login notification – CLI

6. 6A ClearPass Insight 6.10 investigator needs a report for activity one month ago. What can the Reports page do with the time range?

   1. A.Use only the current four-hour time window
   2. B.Use a custom range covering the previous two monthsCorrect answer: B
   3. C.Use any custom range across all two years of retained data
   4. D.Use only the current day's authentication records

   Explanation: "The Reports page provides a method for creating reports with data filters and customized time ranges up to the previous two months." A one-month-old interval falls within the documented reporting range; two-year retention does not imply two-year report range.

   Reference: Creating ClearPass Insight Reports — Creating Reports, overview

7. 7An investigator captures EdgeConnect traffic on both LAN and WAN interfaces. Which observation is expected for traffic carried by an encrypted WAN tunnel?

   1. A.The WAN capture shows inner traffic before encryption and the LAN capture shows tunnel headers
   2. B.Both captures show only encrypted external tunnel headers
   3. C.The LAN capture shows traffic before encryption and the WAN capture shows external tunnel headersCorrect answer: C
   4. D.Both captures show the same unencrypted inner traffic

   Explanation: "WAN interface traffic encrypted, only the external tunnel headers are seen." The same guide states, "LAN traffic is captured at the LAN port and not yet encrypted by Edge Connect". Together these distinguish the WAN and LAN views.

   Reference: Packet Captures — Packet Captures, PCAP LIST

8. 8A Gateway IDS/IPS threat is marked Minor. How should an analyst interpret that severity according to the Threats List documentation?

   1. A.Reconnaissance or scanning that does not directly confirm malicious intentCorrect answer: A
   2. B.An active attempt to compromise a service or system
   3. C.The highest likelihood of a system compromise
   4. D.A signature that is not inherently malicious but provides context

   Explanation: "While these activities do not directly confirm malicious intent, they are often precursors to potential malicious actions." Reconnaissance is a potential precursor, not proof of compromise.

   Reference: Viewing the Threats List — Threats List, Severity, Minor

9. 9An analyst must deliver both the Device Insight dashboard summary and the underlying device list. Which report export option supplies both formats in one package?

   1. A.PDF only
   2. B.CSV only
   3. C.PDF AND CSVCorrect answer: C
   4. D.HTML only

   Explanation: "The information in the Dashboard is exported as a PDF file and the information in the List view is exported as a CSV file." The combined option packages the dashboard PDF and list CSV.

   Reference: Creating Device Insight Reports — Creating Reports, Export As, PDF AND CSV

10. 10A hunter merges EdgeConnect captures taken at several points on the path and sees many Wireshark retransmission flags. Why should the analyst verify the capture-point separation before interpreting the flags?

    1. A.The same packet can appear more than once and be flagged as retransmittedCorrect answer: A
    2. B.Each repeated packet must have been retransmitted by the sender
    3. C.A repeated packet necessarily proves it was lost between capture points
    4. D.Duplicate packet copies always indicate a TCP timeout at the sender

    Explanation: "It flags the extra copies as retransmissions and duplicate ACKs, which buries the real ones." Each capture point contributes a copy, so the merged view can produce misleading retransmission and duplicate-ACK indicators.

    Reference: Packet Captures — Packet Captures, Merging captures from several EdgeConnects