HPE7-A01 Aruba Certified Campus Access Professional Exam Questions and Answers

To create a new OSPF configuration for a separate routing table, you need to create a new OSPF process ID with vrf name. This will create a new OSPF instance that is associated with the specified VRF and its routing table. The other options are incorrect because they either do not create a new OSPF instance or do not associate it with a VRF. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch02.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch03.html

The show aaa authentication port-access interface all client-status command displays the status of all clients authenticated by port-based access control on all interfaces. The output includes the MAC address, user role, VLAN ID, and session timeout for each client. This command can be used to examine information on which role the guest user has been assigned by the AOS-CX switch. References: https://techhub.hpe.com/eginfolib/Aruba/OS-CX_10.04/5200-6692/GUID-9B8F6E8F-9C7A-4F0D-AE7B-9D8E6C5B6A7F.html

CoS and DSCP are both methods of marking packets for quality of service (QoS) purposes. QoS is a mechanism that allows network devices to prioritize and differentiate traffic based on certain criteria, such as application type, source, destination, etc. CoS stands for Class of Service and is a 3-bit field in the 802.1Q VLAN tag header. CoS can only be used on Ethernet frames that have a VLAN tag, and it can only be preserved within a single VLAN domain. DSCP stands for Differentiated Services Code Point and is a 6-bit field in the IP header. DSCP can be used on any IP packet, regardless of the underlying layer 2 technology, and it can be preserved throughout the IP packet flow, unless it is modified by intermediate devices. References: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos/configuration/15-mt/qos-15-mt-book/qos-overview.html https://www.cisco.com/c/en/us/support/docs/lan-switching/8021q/17056-741-4.html https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10103-dscpvalues.html

multicast transmission optimization is a feature that allows the IAP to select the optimal rate for sending broadcast and multicast frames based on the lowest of unicast rates across all associated clients 1 . When this option is enabled, multicast traffic can be sent at up to 24 Mbps. The default rate for sending frames for 2.4 GHz is 1 Mbps and 5.0 GHz is 6 Mbps.  This option is disabled by default 1 .

To onboard a new UXI in an existing environment with 802.1X authentication, you need to use the UXI app on your smartphone and connect the UXI via Bluetooth. The UXI app allows you to scan the QR code on the UXI sensor and configure its network settings, such as SSID, password, IP address, etc. The Bluetooth connection allows you to communicate with the UXI sensor without requiring any network access or cellular connection. The other options are incorrect because they either do not use the UXI app or do not use Bluetooth. References: https://www.arubanetworks.com/products/network-management-operations/analytics-monitoring/user-experience-insight-sensors/ https://help.centralon-prem.arubanetworks.com/2.5.4/documentation/online_help/content/nms-on-prem/aos-cx/get-started/uxi-sensor.htm

 The system-mac command is used to configure a fixed MAC address for the VSX system. This MAC address is used as the source MAC address for all routed traffic from the VSX node.  The system-mac command is highly recommended for preventing traffic disruptions when the primary VSX switch restores after the secondary VSX switch, such as during a primary switch hardware replacement or a power outage 2 . During the initial VSX configuration, the system-mac is assigned with a fixed MAC based on VSX ID.  The system-mac command can be used to change this default MAC address if needed 2 . Therefore, answer D is correct.

To allow a new VLAN 100 between VSX pair inter-switch-link 256 for port 1/45 and 2/45, you need to use the command  vlan trunk allowed 100 in LAG256 . This will add VLAN 100 to the list of allowed VLANs on the trunk port LAG256, which is part of the inter-switch-link between VSX peers. The other options are incorrect because they either do not use the correct command or do not specify the correct port or VLAN. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch07.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch02.html

AOS 10 Gateways can have the following personas: Mobility, Branch, and VPN Concentrator 1  However, the Mobility persona is only available when configuring a Gateway-only group, which is a group that contains only one gateway device 2  The Mobility persona provides Overlay WLAN and (or) wired LAN functionalities for campus networks 1  The Branch persona provides the Aruba Instant OS and SD-Branch (LAN + WAN) functionality for branch and microbranch networks 1  The VPN Concentrator persona provides VPN termination and routing functionality for remote access networks 3  The Edge persona is not a valid option, as it is not a supported device persona for AOS 10 Gateways.

The Aruba CX 6400 switch is a modular switch that supports high-performance and high-density Ethernet switching for campus and data center networks. One of the features that distinguishes the Aruba CX 6400 switch from most typical campus switches is virtual output queueing (VOQ).  VOQ is a technique that implements large ingress packet buffers on each port to prevent head-of-line blocking and packet loss due to congestion 2 .  VOQ allows each port to have multiple queues for different output ports and prioritize packets based on their destination and QoS class 2 .  VOQ enables the Aruba CX 6400 switch to achieve high throughput and low latency for various traffic types and scenarios. References:  2  https://www.arubanetworks.com/assets/ds/DS_CX6400Series.pdf

To configure an IP address for an interface in default state for interface 1/1/1 on Aruba CX 6300 switch, you need to disable switching on the interface first with the command  no switching . Then you can assign an IP address with the command  ip address . The other options are incorrect because they either do not disable switching or use invalid keywords such as  switching  or  routing . References: https://www.arubanetworks.com/techdocs/AOS-CX_10_08/UG/bk01-ch01.html https://www.arubanetworks.com/techdocs/AOS-CX_10_08/UG/bk01-ch02.html

According to the Aruba Documentation Portal 1 , user-based tunneling (UBT) is a feature that uses GRE to tunnel ingress traffic on a switch interface to a gateway for further processing. UBT enables a switch to provide a centralized security policy, using per-user authentication and access control to ensure consistent access and permissions.

Option A: The switch will put the client on the access VLAN

This is because option A shows how UBT works on an Aruba switch. When a device connects to the network, it is authenticated using either MAC Authentication or 802.1X and triggers an enforcement policy from ClearPass, which contains an enforcement profile with a user role configuration. The user role can be assigned locally on the switch or on ClearPass as part of an enforcement profile.  The user role determines the VLAN that the device belongs to and the access policies that apply to it 2 3 .

Therefore, option A is correct.

1 : https://www.arubanetworks.com/techdocs/central/latest/content/nms/aos-cx/cfg/conf-cx-ubt.htm  2 : https://www.arubanetworks.com/techdocs/AOS-CX/10.06/HTML/5200-7696/GUID-581D2976-694B-46C7-8497-F6B788AA05B2.html  3 : https://community.arubanetworks.com/viewdocument/?DocumentKey=c740df4e-3e26-4cc5-9126-355a18709c44 & CommunityKey=2fd943a6-8898-4dbe-915f-4f09e4d3c317 & tab=librarydocuments

The show arp command displays the ARP table for a specific VRF or all VRFs on the switch. The ARP table contains the IP address to MAC address mappings for hosts that are directly connected to the switch or reachable through a gateway. If the client device is connected to another switch by VSX LAG, the ARP entry for the client device will not be present on the primary switch unless it has communicated with it recently. Therefore, to find the IP address of the client device, the administrator should run the show arp command on the secondary switch in the VSX pair, specifying the VRF name that contains the client device’s subnet. References: https://techhub.hpe.com/eginfolib/Aruba/OS-CX_10.04/5200-6692/GUID-9B8F6E8F-9C7A-4F0D-AE7B-9D8E6C5B6A7F.html

Proves knowledge of the PMK

Exchanges messages for generating PTK

Distributes an encrypted GTK to the client

Sets first initialization vector (IV)

These are two benefits enabled by LLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery). LLDP-MED is an extension of LLDP that provides additional capabilities for network devices such as VoIP phones and APs. One of the capabilities is to automatically configure voice VLANs for VoIP phones, which allows them to be placed in a separate VLAN from data devices and receive QoS and security policies. Another capability is to request power as needed from PoE-enabled switch ports, which allows APs to adjust their power consumption and performance based on the available power budget. The other options are incorrect because they are either not enabled by LLDP-MED or not related to LLDP-MED. References: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/wlan-qos/lldp-med.htm https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/wlan-rf/poe.htm

MPSK Local is a feature that can reduce the IT administration overhead associated with deploying devices that do not support 802.1X authentication while maintaining a secure environment. MPSK Local allows the switch to automatically generate and assign unique pre-shared keys for devices based on their MAC addresses, without requiring any configuration on the devices or an external authentication server. The other options are incorrect because they either require manual intervention by the installers or the MPSK gateway, or they do not provide unique pre-shared keys for devices. References: https://www.arubanetworks.com/techdocs/AOS-CX_10_08/UG/bk01-ch05.html https://www.arubanetworks.com/techdocs/AOS-CX_10_08/UG/bk01-ch06.html

The important advantage supplied by SNMPv3 is enhanced security, including authentication and message integrity . SNMPv3 employs a User-based Security Model in which authentication protocols such as MD5 or the SHA family can validate the sender and verify that the SNMP message has not been altered during transmission. HPE Aruba specifically documents SNMPv3 authentication protocols and recommends SNMPv3 because it provides authentication and strong privacy mechanisms that are absent from SNMPv2c. Aruba Networking

SNMPv2c relies on community strings , which are transmitted without the stronger user-based authentication and privacy protections available in SNMPv3. Aruba notes that SNMPv1 and SNMPv2c community names can be transmitted in clear text, whereas SNMPv3 supports authenticated users and encrypted management traffic. Aruba Networking

Options A and B are not unique SNMPv3 advantages. 64-bit counters were introduced with SNMPv2, particularly through Counter64 objects, and GetBulk was also introduced with SNMPv2 to improve retrieval efficiency. Option C is actually characteristic of SNMPv1/v2c rather than an SNMPv3 improvement.

Consequently, the distinguishing SNMPv3 feature among the available answers is message integrity .

Study Guide Topics: SNMPv3, SNMPv2c, User-Based Security Model, Authentication, Message Integrity, Privacy/Encryption, AOS-CX Network Management.

On an AOS-CX switch , REST API authentication uses the HTTP POST method against the login resource. Aruba specifies that a REST API session is initiated by sending the username and password through a POST request. After successful authentication, the switch returns session information that is used for subsequent API requests. Aruba Networking

For changing the administrator password, Aruba documents the use of PUT against the user resource, for example PUT /rest/v10.xx/system/users/admin, with the new password included in the request data. Therefore, D correctly associates POST with login and PUT with changing the management password . Aruba Networking

Option A is incorrect because AOS-CX does not provide comprehensive semantic validation for REST writes. Aruba explicitly warns that configuration errors written directly to the database can destabilize the switch. Aruba Networking

Option B is also incorrect. Read-only mode blocks writes to most resources, but exceptions exist. POST is still permitted for functions such as login , and certain PUT/POST operations remain available. Aruba Networking Option C simply reverses the correct HTTP methods.

Study Guide Topics: AOS-CX REST API, REST Authentication, HTTP POST/PUT Methods, API Access Modes, Read-Write versus Read-Only Access.

CoA (Change of Authorization) is a feature that allows ClearPass to dynamically change the authorization and access privileges of a device after it has been authenticated 1 .  CoA uses RADIUS messages to communicate with the network device and instruct it to perform an action, such as reauthenticating the device, applying a new VLAN or user role, or disconnecting the device 2 .

To enable CoA on a CX switch, the network engineer needs to configure dynamic authorization on the switch, which is a global command that allows the switch to accept RADIUS messages from ClearPass and execute the requested actions 3 .  The network engineer also needs to specify the IP address and shared secret of ClearPass as a dynamic authorization client on the switch 3 .

To trigger CoA for a specific wired device, the network engineer needs to bounce the switchport, which is an action that temporarily disables and re-enables the port where the device is connected. This forces the device to reauthenticate and receive the new policy from ClearPass. Bouncing the switchport can be done manually by using the interface shutdown and no shutdown commands, or automatically by using ClearPass as a CoA server and sending a RADIUS message with the Port-Bounce-Host AVP (Attribute-Value Pair).

Active gateway is a first hop redundancy protocol that eliminates a single point of failure. The active gateway feature is used to increase the availability of the default gateway servicing hosts on the same subnet. An active gateway improves the reliability and performance of the host network by enabling a virtual router to act as the default gateway for that network.  If you have enabled active gateway, VRRP is not required 3 . Active gateway is similar to VRRP in that routed traffic from the VSX node is sourced from the switch interface MAC and not the virtual MAC address (VMAC). Each active gateway sends a periodic broadcast hello packet to avoid VMAC aging on the access switches.  The switch views the active gateway IP as a self IP address 3 .  Active gateway is preferable over VRRP because with VRRP traffic is still pushed over the ISL link, resulting in latency in the network 3 . Therefore, VRRP and active gateway are mutually exclusive on a VLAN, and answer A is correct.

Function

Correct Role

Is the Authentication Source

Backend Services

Is responsible for granting or denying access

Authentication Server

Software that enables use of 802.1X network authentication protocol

Supplicant

The device that controls initial network access

Authenticator

IEEE 802.1X separates network-access authentication into distinct functional roles. The supplicant is the client-side software participating in 802.1X authentication. It runs on the endpoint and exchanges EAPOL messages with the network authenticator when requesting access.

The authenticator is the network-access device controlling the port or wireless connection. In an Aruba deployment, this can be an Aruba switch, AP, or gateway/controller. It operates as the gatekeeper and controls the client ' s initial access while relaying authentication information between the supplicant and authentication server. Aruba explicitly describes the authenticator as the component that permits or denies network access at the enforcement point. Aruba Networking

The Authentication Server , typically HPE Aruba Networking ClearPass Policy Manager , processes authentication requests and ultimately returns an accept or reject decision to the authenticator. Aruba Networking

Finally, Backend Services supply the authentication source . Examples include Microsoft Active Directory, LDAP, SQL databases, or other identity repositories. Aruba defines an authentication source as the identity store against which users or devices are authenticated. Aruba Networking

Study Guide Topics: 802.1X Architecture, Supplicant, Authenticator, Authentication Server, ClearPass Policy Manager, Authentication Sources, EAP/EAPOL, RADIUS.

MPSK Local is a feature that can be used to set up 15 headless IoT devices that do not support 802.1X authentication. MPSK Local allows the switch to automatically generate and assign unique pre-shared keys for devices based on their MAC addresses, without requiring any configuration on the devices or an external authentication server. The other options are incorrect because they either require 802.1X authentication, which is not supported by the IoT devices, or WPA3 encryption, which is not supported by Aruba CX switches. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch05.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch06.html

The correct answer is A. SNMPv3.

SNMPv3 is a protocol that is used to retrieve data stored in a Management Information Base (MIB), which is a database of managed objects in a network. SNMPv3 provides security and access control features that are not available in earlier versions of SNMP. SNMPv3 can also use encryption to protect the data from unauthorized access or modification.

According to the Aruba Certified Professional – Campus Access document 1 , one of the skills that this certification validates is:

Implement and Analyze the output from common network monitoring tools

Configure Port Mirroring to collect PCAPs

Configure NAE agents 9.4

Configure UXI sensors for internal and external tests

Describe how API scan be used to configure, manage, monitor, and troubleshoot your network

The document also mentions that the candidate should have a distinguished understanding of different protocols across vendors, which implies that they should be familiar with SNMPv3 and how it can be used to access MIB data.

VSX clustering is a feature that allows two Aruba CX switches to operate as a single logical device, providing high availability, scalability, and simplified management. VSX clustering has several benefits over spanning tree configuration, such as:

Dual control plane provides better resiliency. Unlike stacking, where switches share a single control plane, VSX switches have independent control planes that synchronize their states over an inter-switch link (ISL). This means that if one switch fails or reboots, the other switch can continue to operate without affecting traffic flows or network services.

Active-active forwarding provides better performance. Unlike spanning tree, where some links are blocked to prevent loops, VSX switches use all available links for forwarding traffic, providing load balancing and increased bandwidth utilization.

Multichassis LAG provides better redundancy. Unlike single-chassis LAG, where all member ports belong to one switch, VSX switches can form multichassis LAGs with downstream or upstream devices, where member ports are distributed across both switches. This provides link redundancy and seamless failover in case of switch or port failure.

Aruba CX 6300 switches support various features to control the port access for different types of devices, such as client mode, device mode, and multidomain mode. These features can help limit the number of clients that can connect to a port and prevent unauthorized devices from accessing the network.

This is because option C shows how to configure the client limit and the auth-mode for a specific port using the interface command and the aaa authentication port-access command. The client limit specifies the maximum number of clients that can connect to a port. The auth-mode specifies the authentication mode for the port.  In this case, option C sets both parameters to multi-domain mode, which allows only one voice device and one data device to be authenticated on a port

https://www.arubanetworks.com/techdocs/AOS-CX/10.10/HTML/monitoring_6300-6400/Content/Chp_LEDs/fro-pan-led-630.htm  2 : https://www.arubanetworks.com/products/switches/6300-series/  3 : https://www.arubanetworks.com/techdocs/AOS-CX/10.11/HTML/security_6200-6300-6400/Content/Chp_Port_acc/Port_acc_gen_cmds/aaa-aut-por-acc-aut-mod-fl-109.htm

An OSPF transit network is a network that has at least two routers that are connected by a multi-access link and can forward traffic for other networks 1 . A transit network is different from a stub network, which has only one router connected to it and does not forward traffic for other networks 2 . A transit network is also different from a virtual link, which is a logical connection between two areas that are not physically adjacent 2 . A transit network is not necessarily connected to a different routing protocol, although it can be if the router performs redistribution 2 . Therefore, the correct answer is C. A network on which a router discovers at least one neighbor.

The other options either use more commands or do not create the VRF or the VLAN.

Option C uses the following commands:

vrf eng: This command creates a VRF named eng and enters the VRF configuration mode 1 .

vlan 25: This command creates a VLAN with ID 25 and enters the VLAN configuration mode 2 .

interface vlan 25: This command creates an SVI on VLAN 25 and enters the interface configuration mode 3 .

ip address 10.105.43.1/24 ipv6 address fd00:5780::102d:4df6/64 vrf attach eng: This command assigns an IPv4 address of 10.105.43.1 with a subnet mask of 255.255.255.0 and an IPv6 address of fd00:5780::102d:4df6 with a prefix length of 64 to the SVI, and attaches it to the VRF eng.

Wi-Fi 6 is an industry certification for products that support the new wireless standard 802.11ax, also known as “high-efficiency wireless”. Wi-Fi 6 offers increased capacities, improved resource utilization and higher throughput speeds than previous standards.

Option B: ClientMatch

This is because option B shows how to use ClientMatch to optimize the wireless performance of Wi-Fi 6 clients on a UniFi network.  ClientMatch is a feature that uses machine learning to analyze the traffic patterns of each client and assign them to the best available AP based on their location, device type, and network conditions 2 .

Therefore, option B is the best technology to implement for your customer’s issue.

1 : https://help.ui.com/hc/en-us/articles/221029967-UniFi-Network-Optimizing-Wireless-Connectivity  2 : https://help.ui.com/hc/en-us/articles/360012947634-UniFi-Network-Optimizing-Wireless-Speeds

The built-in auditors role is specifically designed for restricted access to AOS-CX auditing and logging functions. HPE Aruba Networking documents that users assigned to the auditors group have Web UI access only to the System > Log page . For REST API access, auditors are authorized to use GET only against the audit log (/logs/audit) and event log (/logs/event) resources , apart from the POST operations required for login and logout. Aruba Networking

This matches the scenario directly. The requested administrator must be able to inspect event-log information without receiving broader switch management or configuration privileges. The auditors role is therefore an application of least privilege : it provides precisely the logging visibility needed without exposing configuration-changing capabilities.

AOS-CX assigns the auditors role privilege level 19 and restricts CLI access to the auditor context. By comparison, administrators receive privilege level 15 and broad read/write access to switch resources, which would exceed this requirement substantially. Aruba Networking

The AOS-CX REST API documentation also confirms that a GET request against /logs/event retrieves event-log entries, exactly matching the resource specified in the question. Aruba Networking

Therefore, D. auditors is the appropriate default AOS-CX management role.

Study Guide Topics: AOS-CX RBAC, Built-In User Groups, Auditors Role, Web UI Permissions, REST API Authorization, Event and Audit Logs.

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-7885/Content/Chp_Mng_Use/bui-in-use-gro-the-pri-10.htm

When a UXI sensor must be deployed into an environment protected by 802.1X but lacks cellular connectivity, the appropriate bootstrap mechanism is the UXI Onboarding application using Bluetooth . The sensor initially cannot authenticate to the protected network because it has not yet obtained the required 802.1X credentials, certificates, or other connectivity configuration. Bluetooth provides an out-of-band path for supplying that initial configuration.

HPE Aruba Networking ' s UXI onboarding documentation states that when Ethernet connectivity or cellular onboarding is unavailable, the UXI onboarding app can send the sensor ' s initial configuration over Bluetooth . The application supports configuring network parameters including 802.1X credentials and certificates . Cape Networks Help Center

HPE ' s UXI QuickSpecs likewise confirms that UXI sensors include a Bluetooth 5.0 radio specifically enabling setup through the UXI mobile application. Hewlett Packard Enterprise

Therefore, D is correct. Barcode scanning alone does not solve the sensor ' s protected-network connectivity requirement. Sensors are not onboarded by daisy-chaining configuration from another UXI, and UXI deployment is not based on serial-CLI provisioning.

Study Guide Topics: UXI Sensor Deployment, UXI Onboarding, Bluetooth Provisioning, 802.1X Authentication, Sensor Bootstrap Connectivity.

The best option to enhance security for the new IP cameras and scanners in this environment is C. MPSK provides for each device in the WLAN to have its own unique pre-shared key.

MPSK stands for Multi Pre-Shared Key, and it is a feature that allows different devices to connect to the same SSID with different pre-shared keys. This improves the security and scalability of the network, as each device can have its own key and role without requiring 802.1X authentication or an external policy engine. MPSK can be configured either locally on the AP or centrally on Aruba Central 1 2 .

The other options are incorrect because:

A. MPSK Local is a feature that allows the user to configure 24 PSKs per SSID locally on the device. These local PSKs would serve as an extension of the base MPSK functionality. However, MPSK Local is not suitable for this scenario, as it can only support up to 24 devices per SSID, while the client has 250 devices 1 .

B. Aruba ClearPass is a network access control solution that can perform 802.1X authentication and install certificates for devices. However, this option is not feasible for this scenario, as the new IP cameras and scanners do not support 802.1X authentication 3 .

D. MPSK Local will not allow the cameras to share a key and the scanners to share a different key. MPSK Local will assign a different key to each device, regardless of their type. Moreover, MPSK Local can only support up to 24 devices per SSID, while the client has 250 devices 1 .

This is the correct explanation of how roles can help keep consistent policy enforcement in a distributed overlay fabric. Roles are used to assign group based policy IDs (GBPs) to devices after they authenticate with ClearPass or a local database. GBPs are then used to tag the traffic from the devices and send them to the ingress VTEP, which applies the GBP on the VXLAN header. The egress VTEP then enforces the policy based on the GBP and the destination device. The other options are incorrect because they either do not describe the correct sequence of events or do not use the correct terms. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch03.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch05.html

OCSP is a protocol that allows clients to query the CA or a trusted responder for the status of a specific certificate.  OCSP requests and responses are smaller and faster than CRLs, and they can provide real-time information about the revocation status of a certificate 1 2 . CRLs are lists of all revoked certificates that are downloaded from the CA.  CRLs can present issues, as they can become outdated and have to be downloaded frequently 1 3 .  Therefore, OCSP reduces latency between the time a certificate is revoked and validation reflects this status. References:  1  https://sectigostore.com/blog/ocsp-vs-crl-whats-the-difference/  2  https://www.keyfactor.com/blog/what-is-a-certificate-revocation-list-crl-vs-ocsp/  3   https://www.fortinet.com/resources/cyberglossary/ocsp