The ArubaOS Security Dashboard, part of the AOS-8 architecture (Mobility Controllers or Mobility

Master), provides visibility into wireless clients and access points (APs) through its Wireless Intrusion

Prevention (WIP) system. The goal is to identify clients that belong to the company (i.e., authorized

clients) and have connected to devices that might belong to hackers (i.e., rogue APs).

Client Classification:

Authorized: A client that has successfully authenticated to an authorized AP and is recognized as part

of the company’s network (e.g., an employee device).

Interfering: A client that is not authenticated to the company’s network and is considered external or

potentially malicious.

AP Classification:

Authorized: An AP that is part of the company’s network and managed by the MC/MM.

Rogue: An AP that is not authorized and is suspected of being malicious (e.g., connected to the

company’s wired network without permission).

Neighbor: An AP that is not part of the company’s network but is not connected to the wired

network (e.g., a nearby AP from another organization).

The requirement is to find a client that is authorized (belongs to the company) and connected to a

rogue AP (might belong to hackers).

Option A: MAC address: d8:50:e6:f3:70:ab; Client Classification: Interfering; AP Classification: Rogue

This client is classified as "Interfering," meaning it does not belong to the company. Although it is

connected to a rogue AP, it does not meet the requirement of being a company client.

Option B: MAC address: d8:50:e6:f3:6e:c5; Client Classification: Interfering; AP Classification:

Neighbor

This client is "Interfering" (not a company client) and connected to a "Neighbor" AP, which is not

considered a hacker’s device (it’s just a nearby AP).

Option C: MAC address: d8:50:e6:f3:6e:60; Client Classification: Interfering; AP Classification:

Authorized

This client is "Interfering" (not a company client) and connected to an "Authorized" AP, which is part

of the company’s network, not a hacker’s device.

Option D: MAC address: d8:50:e6:f3:6d:a4; Client Classification: Authorized; AP Classification: Rogue

This client is "Authorized," meaning it belongs to the company, and it is connected to a "Rogue" AP,

which might belong to hackers. This matches the requirement perfectly.

The HPE Aruba Networking AOS-8 8.11 User Guide states:

"The Security Dashboard in ArubaOS provides a client list that includes the client classification and

the AP classification for each client. A client classified as ‘Authorized’ has successfully authenticated

to an authorized AP and is part of the company’s network. A ‘Rogue’ AP is an unauthorized AP that is

suspected of being malicious, often because it is connected to the company’s wired network (e.g.,

detected via Eth-Wired-Mac-Table match). To identify potential security risks, look for authorized

clients connected to rogue APs, as this may indicate that a company device has connected to a

hacker’s AP." (Page 415, Security Dashboard Section)

Additionally, the HPE Aruba Networking Security Guide notes:

"An ‘Authorized’ client is one that has authenticated to an AP managed by the controller, typically an

employee or corporate device. A ‘Rogue’ AP is classified as such if it is not authorized and poses a

potential threat, such as being connected to the corporate LAN. Identifying authorized clients

connected to rogue APs is critical for detecting potential man-in-the-middle attacks." (Page 78, WIP

Classifications Section)

:

HPE Aruba Networking AOS-8 8.11 User Guide, Security Dashboard Section, Page 415.

HPE Aruba Networking Security Guide, WIP Classifications Section, Page 78.

===========