HPE6-A78 HPE Network Security Associate Exam Topics and Questions

This is where the exam lives. Seventy percent of your score comes from this single topic, which spans the full width of network security: threat recognition, protocol selection, wireless and wired segmentation, PKI, policy enforcement, and endpoint classification. If you are thin on any of those areas, this is where the points bleed out. The topic rewards breadth as much as depth, and candidates who know one layer well but skip another pay for it here.

– Threats, vulnerabilities, and the protocols that sit between them

The exam draws a hard line between a threat and a vulnerability, and conflating the two costs marks. A threat is an actor or event with the potential to cause harm; a vulnerability is the condition that makes harm possible. Man-in-the-middle attacks, DDoS, spoofing, and zero-day exploits each have a distinct mechanism, and the exam expects you to identify which mechanism is in play from a scenario description.

Protocol choice is examined in terms of use cases, not just names. Knowing that SNMPv3 encrypts where v1 does not, or that RADIUS and TACACS+ serve different purposes in an Aruba environment, is the kind of distinction that separates right from wrong at the item level. PKI components sit here too: certificate authorities, certificate chains, and the role of each component in establishing trust. The non-obvious angle is revocation: CRL and OCSP behaviour is where candidates who only memorised the happy path get caught.

– Firewalls, segmentation, and policy enforcement

Aruba's Policy Enforcement Firewall, dynamic segmentation, role-based access control, and AppRF are all examinable together because they form a single enforcement chain. PEF applies stateful inspection at the edge of the user session; dynamic segmentation extends that enforcement across wired and wireless without requiring a separate VLAN architecture for every user class; RBAC determines which role a user lands in; AppRF classifies traffic by application so that policy can follow the app rather than the port.

User roles tie the whole chain together. The exam tests whether you understand how a role is constructed, where it is applied, and what happens when a user does not match any explicit rule. Default-deny behaviour and the order of rule evaluation are common trap points. Candidates who understand the concept but have never configured or traced a role often pick options that are logically reasonable but wrong for the Aruba-specific enforcement model.

– Secure management and infrastructure hardening

This group covers the operational hygiene that protects the devices doing the enforcement. The exam is specific about which protocols are acceptable: SSH over Telnet, HTTPS over HTTP, authenticated NTP rather than unauthenticated, and CPsec for control-plane communication between APs and controllers. Disabling insecure protocols is tested as a configuration decision, not just a policy preference.

Password management, physical security, and out-of-band management round out infrastructure hardening. The out-of-band angle is worth attention: the exam distinguishes management traffic that travels the production network from management that uses a dedicated path, and the reason that distinction matters (availability during an incident) is the kind of reasoning items reward.

External authentication for network managers, typically through TACACS+, is tested in terms of what it adds over local accounts: centralised audit trails, per-command authorisation, and the ability to revoke access without touching every device individually. Packet capture purpose and method sit here as well: knowing when to capture, where to place the capture point, and what the output tells you about a security event.

– Wireless and wired security methodologies

Wireless LAN security is examined at the methodology level: WPA2 versus WPA3, Personal versus Enterprise, 802.1X authentication flow, and the role of a RADIUS server in that flow. Deploying basic WLAN security means being able to choose the right method for a given scenario and identify what is missing when a scenario describes an insecure setup.

User roles for wireless users are configured at the controller and applied post-authentication. The exam tests the basic deployment: what a role contains, how it is assigned, and what enforcement looks like in practice.

Wired LAN methodologies follow the same compare-and-contrast pattern. 802.1X on a wired port, MAC authentication, and the fallback behaviour when authentication fails are all in scope. Basic user roles for wired users mirror the wireless model but apply at the switch port level.

Endpoint classification methods close out the topic. The exam expects you to distinguish profiling techniques such as DHCP fingerprinting, HTTP user-agent inspection, and active scanning, and to understand what each method can and cannot reliably determine about a device. Social engineering and its defences also appear here, with phishing and pretexting being the scenarios most likely to surface.

How Protect and Defend is tested

With seventy percent of the exam weight here, you will see scenario-based items that require you to apply a concept rather than recall a definition. A typical item describes a network condition or a user complaint and asks what is most likely causing it, or what configuration change resolves it. Items reward the candidate who can trace cause to effect through the Aruba enforcement model.

The most common trap is choosing an option that is generically correct for network security but wrong for the Aruba-specific implementation. Knowing that dynamic segmentation exists is not enough; you need to know how it behaves when a wired user authenticates and what role assignment looks like in that context.

Protocol items reward precision. Saying SSH is secure is not the same as knowing which cipher or version is acceptable under Aruba best-practice guidance. PKI items reward understanding trust chains rather than just knowing what a certificate is.

Candidates lose marks most often on role evaluation order, default-deny logic, and the distinction between threat and vulnerability when both appear in the same scenario. Work through those areas actively, not by re-reading notes.

After the enforcement layer comes the detection and investigation layer. Protect and Defend sets the policy; Analyze is about reading what the network is telling you once that policy is running. This topic covers alarms, logs, access tracking, endpoint evaluation, and historical pattern data. Candidates who treat it as secondary because the weight is lower than the first topic often find it is precisely where their preparation had the thinnest coverage.

– Intrusion detection, alarms, and attack context

WIPS and WIDS alarms are the starting point. The exam distinguishes between the two systems: a Wireless Intrusion Detection System identifies suspicious activity and raises an alert, while a Wireless Intrusion Prevention System can act on that alert automatically. Viewing and acknowledging alarms in the Aruba environment is a procedural skill the exam tests directly, and the acknowledgement step matters because unacknowledged alarms affect how the system prioritises future events.

Attack stages and the kill chain sit alongside alarm interpretation because understanding where in the kill chain a detected event falls changes what the appropriate response is. The exam does not require deep threat-intelligence knowledge, but it does expect you to map a described behaviour to a stage: reconnaissance, weaponisation, delivery, exploitation, and so on. Items here reward candidates who can read a scenario describing an observed event and place it correctly in the sequence, because the stage determines which containment action is proportionate.

– Logs, access tracking, and endpoint visibility

Log collection is tested as a practical skill: where logs come from in an Aruba deployment, how they are forwarded to a centralised system, and what information they contain. The exam is less interested in syslog configuration syntax and more interested in whether you understand what a log entry tells you about a security event and how to use that information.

The access tracker is an Aruba-specific tool for tracing authentication and authorisation events per user or per device. Items on this sub-topic describe a symptom, such as a user landing in the wrong role or failing authentication, and reward candidates who know which fields in the access tracker output point to the cause.

Historical network pattern data is about baselining: knowing what normal looks like so that anomalies are visible. The exam tests the principle rather than a specific tool configuration. Endpoint discovery and evaluation close the group. Identifying what is on the network and classifying it feeds directly back into policy, so the exam treats it as an analytical output, not just an inventory exercise.

How Analyze is tested

Items in this topic tend to be scenario-driven: a network event has occurred, and you are given a set of observed outputs such as an alarm state, a log excerpt description, or an access tracker result, and asked what it indicates or what to do next. The exam rewards candidates who can move from observation to conclusion without skipping steps.

The kill chain sub-topic is a common trap. Candidates who have memorised the stage names but not the observable indicators associated with each stage pick the wrong stage in a scenario context. Items reward placing the observed behaviour correctly, not reciting the sequence.

Access tracker items are specific to the Aruba platform. Generic networking knowledge about authentication is not enough if you have not worked with the tool or seen what its output looks like. The trap is applying a general RADIUS troubleshooting approach when the item is asking about Aruba-specific fields.

Log collection items reward understanding the purpose of centralised logging in a security context, particularly retention and correlation, rather than configuration detail. Candidates lose marks by focusing on how to configure forwarding rather than on what the logs are used for once they arrive.

Investigate sits at six percent of the exam, which makes it the smallest topic by a significant margin. That does not mean you can skip it. Six percent is still multiple items, and the concepts here, log collection, chain of custody, and initiating an investigation, are precise enough that guessing is unreliable. The topic is narrow, the terminology is specific, and candidates who have only a vague familiarity with forensic process find the items harder than the weight suggests.

How Investigate is tested

Items in this topic are short on context and high on precision. Chain of custody is a legal and procedural concept, and the exam tests whether you know what it requires in practice: documentation of who handled evidence, when, and in what state. Items reward candidates who treat evidence handling as a formal process rather than an informal one.

Initiating an investigation is tested as a sequencing and escalation problem. The exam is interested in what happens first and who is notified, not in the technical details of forensic tooling. Candidates lose marks by jumping to technical action before the procedural steps are in place.

Log collection appears in both Analyze and Investigate, but the angle differs. In Analyze, logs are an operational monitoring tool. In Investigate, they are potential evidence, and that changes how they must be handled and preserved. Items reward recognising that distinction.

With only a few items in this topic, every one counts. Treat each sub-topic as a guaranteed item rather than a probable one, and make sure your understanding of chain of custody is specific rather than general.