The ArubaOS Security Dashboard, part of the AOS-8 architecture (Mobility Controllers or Mobility Master), provides visibility into wireless clients and access points (APs) through its Wireless Intrusion Prevention (WIP) system. The goal is to identify clients that belong to the company (i.e., authorized clients) and have connected to devices that might belong to hackers (i.e., rogue APs).
Client Classification:
Authorized: A client that has successfully authenticated to an authorized AP and is recognized as part of the company’s network (e.g., an employee device).
Interfering: A client that is not authenticated to the company’s network and is considered external or potentially malicious.
AP Classification:
Authorized: An AP that is part of the company’s network and managed by the MC/MM.
Rogue: An AP that is not authorized and is suspected of being malicious (e.g., connected to the company’s wired network without permission).
Neighbor: An AP that is not part of the company’s network but is not connected to the wired network (e.g., a nearby AP from another organization).
The requirement is to find a client that is authorized (belongs to the company) and connected to a rogue AP (might belong to hackers).
Option A: MAC address: d8:50:e6:f3:70:ab; Client Classification: Interfering; AP Classification: RogueThis client is classified as "Interfering," meaning it does not belong to the company. Although it is connected to a rogue AP, it does not meet the requirement of being a company client.
Option B: MAC address: d8:50:e6:f3:6e:c5; Client Classification: Interfering; AP Classification: NeighborThis client is "Interfering" (not a company client) and connected to a "Neighbor" AP, which is not considered a hacker’s device (it’s just a nearby AP).
Option C: MAC address: d8:50:e6:f3:6e:60; Client Classification: Interfering; AP Classification: AuthorizedThis client is "Interfering" (not a company client) and connected to an "Authorized" AP, which is part of the company’s network, not a hacker’s device.
Option D: MAC address: d8:50:e6:f3:6d:a4; Client Classification: Authorized; AP Classification: RogueThis client is "Authorized," meaning it belongs to the company, and it is connected to a "Rogue" AP, which might belong to hackers. This matches the requirement perfectly.
The HPE Aruba Networking AOS-8 8.11 User Guide states:
"The Security Dashboard in ArubaOS provides a client list that includes the client classification and the AP classification for each client. A client classified as ‘Authorized’ has successfully authenticated to an authorized AP and is part of the company’s network. A ‘Rogue’ AP is an unauthorized AP that is suspected of being malicious, often because it is connected to the company’s wired network (e.g., detected via Eth-Wired-Mac-Table match). To identify potential security risks, look for authorized clients connected to rogue APs, as this may indicate that a company device has connected to a hacker’s AP." (Page 415, Security Dashboard Section)
Additionally, the HPE Aruba Networking Security Guide notes:
"An ‘Authorized’ client is one that has authenticated to an AP managed by the controller, typically an employee or corporate device. A ‘Rogue’ AP is classified as such if it is not authorized and poses a potential threat, such as being connected to the corporate LAN. Identifying authorized clients connected to rogue APs is critical for detecting potential man-in-the-middle attacks." (Page 78, WIP Classifications Section)
[References:, HPE Aruba Networking AOS-8 8.11 User Guide, Security Dashboard Section, Page 415., HPE Aruba Networking Security Guide, WIP Classifications Section, Page 78.===========]
