Valid HPE6-A78 Exam Dumps Ensure you a HIGH SCORE (2025) [Q27-Q45]

Valid HPE6-A78 Exam Dumps Ensure you a HIGH SCORE (2025)

Pass HPE6-A78 Exam with Latest Questions

HPE6-A78 exam is ideal for network administrators, security professionals, and IT professionals who work with Aruba products. HPE6-A78 exam covers a range of topics including network security fundamentals, Aruba ClearPass policy manager, Aruba wireless intrusion prevention system, Aruba secure core, and access control. HPE6-A78 exam is designed to ensure that candidates have a thorough understanding of Aruba's network security solutions and can apply their knowledge to real-world scenarios.

 

NEW QUESTION # 27
A client has accessed an HTTPS server at myhost1.example.com using Chrome. The server sends a certificate that includes these properties:
Subject name: myhost.example.com
SAN: DNS: myhost.example.com; DNS: myhost1.example.com
Extended Key Usage (EKU): Server authentication
Issuer: MyCA_Signing
The server also sends an intermediate CA certificate for MyCA_Signing, which is signed by MyCA. The client's Trusted CA Certificate list does not include the MyCA or MyCA_Signing certificates.
Which factor or factors prevent the client from trusting the certificate?

• A. The client does not have the correct trusted CA certificates.
• B. The certificate lacks the correct EKU.
• C. The certificate lacks a valid SAN.
• D. The certificate lacks a valid SAN, and the client does not have the correct trusted CA certificates.

Answer: A

Explanation:
When a client (e.g., a Chrome browser) accesses an HTTPS server, the server presents a certificate to establish a secure connection. The client must validate the certificate to trust the server. The certificate in this scenario has the following properties:
Subject name: myhost.example.com
SAN (Subject Alternative Name): DNS: myhost.example.com; DNS: myhost1.example.com Extended Key Usage (EKU): Server authentication Issuer: MyCA_Signing (an intermediate CA) The server also sends an intermediate CA certificate for MyCA_Signing, signed by MyCA (the root CA).
The client's Trusted CA Certificate list does not include MyCA or MyCA_Signing.
Certificate Validation Process:
Name Validation: The client checks if the server's hostname (myhost1.example.com) matches the Subject name or a SAN in the certificate. Here, the SAN includes "myhost1.example.com," so the name validation passes.
EKU Validation: The client verifies that the certificate's EKU includes "Server authentication," which is required for HTTPS. The EKU is correctly set to "Server authentication," so this validation passes.
Chain of Trust Validation: The client builds a certificate chain from the server's certificate to a trusted root CA in its Trusted CA Certificate list. The chain is:
Server certificate (issued by MyCA_Signing)
Intermediate CA certificate (MyCA_Signing, issued by MyCA)
Root CA certificate (MyCA, which should be in the client's trust store) The client's Trusted CA Certificate list does not include MyCA or MyCA_Signing, meaning the client cannot build a chain to a trusted root CA. This causes the validation to fail.
Option A, "The client does not have the correct trusted CA certificates," is correct. The client's trust store must include the root CA (MyCA) to trust the certificate chain. Since MyCA is not in the client's Trusted CA Certificate list, the client cannot validate the chain, and the certificate is not trusted.
Option B, "The certificate lacks a valid SAN," is incorrect. The SAN includes "myhost1.example.com," which matches the server's hostname, so the SAN is valid.
Option C, "The certificate lacks the correct EKU," is incorrect. The EKU is set to "Server authentication," which is appropriate for HTTPS.
Option D, "The certificate lacks a valid SAN, and the client does not have the correct trusted CA certificates," is incorrect because the SAN is valid, as explained above. The only issue is the missing trusted CA certificates.
The HPE Aruba Networking AOS-CX 10.12 Security Guide states:
"For a client to trust a server's certificate during HTTPS communication, the client must validate the certificate chain to a trusted root CA in its trust store. If the root CA (e.g., MyCA) or intermediate CA (e.g., MyCA_Signing) is not in the client's Trusted CA Certificate list, the chain of trust cannot be established, and the client will reject the certificate. The Subject Alternative Name (SAN) must include the server's hostname, and the Extended Key Usage (EKU) must include 'Server authentication' for HTTPS." (Page 205, Certificate Validation Section) Additionally, the HPE Aruba Networking Security Fundamentals Guide notes:
"A common reason for certificate validation failure is the absence of the root CA certificate in the client's trust store. For example, if a server's certificate is issued by an intermediate CA (e.g., MyCA_Signing) that chains to a root CA (e.g., MyCA), the client must have the root CA certificate in its Trusted CA Certificate list to trust the chain." (Page 45, Certificate Trust Issues Section)
:
HPE Aruba Networking AOS-CX 10.12 Security Guide, Certificate Validation Section, Page 205.
HPE Aruba Networking Security Fundamentals Guide, Certificate Trust Issues Section, Page 45.

NEW QUESTION # 28
You have deployed a new Aruba Mobility Controller (MC) and campus APs (CAPs). One of the WLANs enforces 802.IX authentication lo Aruba ClearPass Policy Manager {CPPM) When you test connecting the client to the WLAN. the test falls You check Aruba ClearPass Access Tracker and cannot find a record of the authentication attempt You ping from the MC to CPPM. and the ping is successful.
What is a good next step for troubleshooting?

• A. Reset the user credentials
• B. Check CPPM Event viewer.
• C. Renew CPPM's RADIUS/EAP certificate
• D. Check connectivity between CPPM and a backend directory server

Answer: B

Explanation:
When dealing with a failed 802.1X authentication attempt to a WLAN enforced by Aruba ClearPass Policy Manager (CPPM) where no record of the attempt is seen in ClearPass Access Tracker, a good next troubleshooting step is to check the CPPM Event Viewer. Since you are able to successfully ping from the Mobility Controller to CPPM, this indicates that there is network connectivity between these two devices. The lack of a record in Access Tracker suggests that the issue may not be with the RADIUS/EAP certificate or user credentials, but possibly with the ClearPass service itself or its reception of authentication requests. The Event Viewer can provide detailed logs that might reveal internal errors or misconfigurations within CPPM that could prevent it from processing authentication attempts properly.

NEW QUESTION # 29
Which is a correct description of a stage in the Lockheed Martin kill chain?

• A. In the reconnaissance stage, the hacker assesses the impact of the attack and how much information was exfilltrated.
• B. In the exploitation and installation phases, malware creates a backdoor into the infected system for the hacker.
• C. In the weaponization stage, which occurs after malware has been delivered to a system, the malware executes Its function.
• D. In the delivery stage, malware collects valuable data and delivers or exfilltrated it to the hacker.

Answer: B

Explanation:
The Lockheed Martin Cyber Kill Chain model describes the stages of a cyber attack. In the exploitation phase, the attacker uses vulnerabilities to gain access to the system. Following this, in the installation phase, the attacker installs a backdoor or other malicious software to ensure persistent access to the compromised system. This backdoor can then be used to control the system, steal data, or execute additional attacks.
References:
Lockheed Martin Cyber Kill Chain framework.

NEW QUESTION # 30
You have a network with ArubaOS-Switches for which Aruba ClearPass Policy Manager (CPPM) is acting as a TACACS+ server to authenticate managers. CPPM assigns the admins a TACACS+ privilege level, either manager or operator. You are now adding ArubaOS-CX switches to the network. ClearPass admins want to use the same CPPM service and policies to authenticate managers on the new switches.
What should you explain?

• A. This approach will work, but will need to be adjusted later if you want to assign managers to the default auditors group.
• B. This approach cannot work because the ArubaOS-CX switches do not accept standard TACACS+ privilege levels.
• C. This approach cannot work because the ArubaOS-CX switches do not support TACACS+.
• D. This approach will work to assign admins to the default "administrators" group, but not to the default "operators" group.

Answer: D

Explanation:
With ArubaOS-CX switches, the use of ClearPass Policy Manager (CPPM) as a TACACS+ server for authentication is supported. The privilege levels assigned by CPPM will translate onto the switches, where the "manager" privilege level typically maps to administrative capabilities and the "operator" privilege level maps to more limited capabilities. ArubaOS-CX does support standard TACACS+ privilege levels, so administrators can be assigned appropriately. If the ClearPass policies are correctly configured, they will work for both ArubaOS-Switches and ArubaOS-CX switches. The distinction between the "administrators" and "operators" groups is inherent in the ArubaOS-CX role-based access control, and these default groups need to be appropriately mapped to the TACACS+ privilege levels assigned by CPPM.

NEW QUESTION # 31
What correctly describes the Pairwise Master Key (PMK) in thee specified wireless security protocol?

• A. In WPA3-Personal, the PMK is unique per session and derived using Simultaneous Authentication of Equals.
• B. In WPA3-Enterprise, the PMK is unique per session and derived using Simultaneous Authentication of Equals.
• C. In WPA3-Personal, the PMK is derived directly from the passphrase and is the same tor every session.
• D. In WPA3-Personal, the PMK is the same for each session and is communicated to clients that authenticate

Answer: B

NEW QUESTION # 32
Refer to the exhibit.

This Aruba Mobility Controller (MC) should authenticate managers who access the Web Ul to ClearPass Policy Manager (CPPM) ClearPass admins have asked you to use RADIUS and explained that the MC should accept managers' roles in Aruba-Admin-Role VSAs Which setting should you change to follow Aruba best security practices?

• A. Change the default role to "guest-provisioning"
• B. Clear the MSCHAP check box
• C. Disable local authentication
• D. Change the local user role to read-only

Answer: C

Explanation:
For following Aruba best security practices, the setting you should change is to disable local authentication.
When integrating with an external RADIUS server like ClearPass Policy Manager (CPPM) for authenticating administrative access to the Mobility Controller (MC), it is a best practice to rely on the external server rather than the local user database. This practice not only centralizes the management of user roles and access but also enhances security by leveraging CPPM's advanced authentication mechanisms.
References:
Aruba Networks official best practice documentation, which recommends centralized authentication for administrative access.
Security standards and guidelines that promote the use of external RADIUS servers for authentication purposes.

NEW QUESTION # 33
You have been asked to send RADIUS debug messages from an ArubaOS-CX switch to a central SIEM server at 10.5.15.6. The server is already defined on the switch with this command: logging 10.5.6.12 You enter this command: debug radius all What is the correct debug destination?

• A. console
• B. file
• C. buffer
• D. syslog

Answer: D

Explanation:
When configuring an ArubaOS-CX switch to send RADIUS debug messages to a central SIEM server, it is important to correctly direct these debug outputs. The command debug radius all activates debugging for all RADIUS processes, capturing detailed logs about RADIUS operations. If the SIEM server is already defined on the switch for logging purposes (as indicated by the command logging 10.5.6.12), the correct destination for these debug messages to be sent to the SIEM server would be through the syslog. This ensures that all generated logs are forwarded to the centralized server specified for logging, enabling consistent log management and analysis. Using syslog as the destination leverages the existing logging setup and integrates seamlessly with the network's centralized monitoring systems.

NEW QUESTION # 34
What is one difference between EAP-Tunneled Layer security (EAP-TLS) and Protected EAP (PEAP)?

• A. EAP-TLS creates a TLS tunnel for transmitting user credentials, while PEAP authenticates the server and supplicant during a TLS handshake.
• B. EAP-TLS creates a TLS tunnel for transmitting user credentials securely while PEAP protects user credentials with TKIP encryption.
• C. EAP-TLS begins with the establishment of a TLS tunnel, but PEAP does not use a TLS tunnel as part of Its process
• D. EAP-TLS requires the supplicant to authenticate with a certificate, hut PEAP allows the supplicant to use a username and password.

Answer: D

Explanation:
EAP-TLS and PEAP both provide secure authentication methods, but they differ in their requirements for client-side authentication. EAP-TLS requires both the client (supplicant) and the server to authenticate each other with certificates, thereby ensuring a very high level of security. On the other hand, PEAP requires a server-side certificate to create a secure tunnel and allows the client to authenticate using less stringent methods, such as a username and password, which are then protected by the tunnel. This makes PEAP more flexible in environments where client-side certificates are not feasible.References:
EAP-TLS and PEAP authentication protocols comparison.

NEW QUESTION # 35
Your ArubaoS solution has detected a rogue AP with Wireless intrusion Prevention (WIP). Which information about the detected radio can best help you to locate the rogue device?

• A. the confidence level
• B. the match method
• C. the detecting devices
• D. the match type

Answer: B

NEW QUESTION # 36
What is a guideline for creating certificate signing requests (CSRs) and deploying server Certificates on ArubaOS Mobility Controllers (MCs)?

• A. Create the CSR and public/private keypair offline If you want to install the same certificate on multiple MCs.
• B. if you create the CSR and public/private Keypair offline, create a matching private key online on the MC.
• C. Generate the private key online, but the public key and CSR offline, to install the same certificate on multiple MCs.
• D. Create the CSR online using the MC Web Ul if your company requires you to archive the private key.

Answer: D

NEW QUESTION # 37
What is an example or phishing?

• A. An attacker sends TCP messages to many different ports to discover which ports are open.
• B. An attacker sends emails posing as a service team member to get users to disclose their passwords.
• C. An attacker checks a user's password by using trying millions of potential passwords.
• D. An attacker lures clients to connect to a software-based AP that is using a legitimate SSID.

Answer: B

Explanation:
Phishing is a type of social engineering attack where an attacker impersonates a trusted entity to deceive people into providing sensitive information, such as passwords or credit card numbers. An example of phishing is when an attacker sends emails posing as a service team member or a legitimate organization with the intention of getting users to disclose their passwords or other confidential information. These emails often contain links to fake websites that look remarkably similar to legitimate ones, tricking users into entering their details.
:
Cybersecurity guidelines on identifying and preventing phishing attacks.

NEW QUESTION # 38
Refer to the exhibits.
A company has added a new user group. Users in the group try to connect to the WLAN and receive errors that the connection has no Internet access. The users cannot reach any resources. The first exhibit shows the record for one of the users who cannot connect. The second exhibit shows the role to which the AOS device assigned the user's client.
What is a likely problem?

• A. The clients rejected the server authentication on their side because they do not have the root CA for CPPM's RADIUS/EAP certificate.
• B. The AOS device does not have the correct RADIUS dictionaries installed on it to understand the Aruba-User-Role VSA.
• C. The role name that CPPM is sending does not match the role name configured on the AOS device.
• D. The AOS device has a server derivation rule configured on it that has overridden the role sent by CPPM.

Answer: C

Explanation:
The scenario involves an AOS-8 Mobility Controller (MC) with a WLAN where a new user group has been added. Users in this group cannot connect to the WLAN, receiving errors indicating no Internet access and inability to reach resources. Exhibit 1 shows the ClearPass Policy Manager (CPPM) Access Tracker record for one user:
CPPM sends an Access-Accept with the VSA Radius:Aruba:Aruba-User-Role user_group4.
The endpoint is classified as "Known," but the user cannot access resources. Exhibit 2 (not provided but described) shows that the AOS device (MC) assigned the user's client to the "denyall" role, which likely denies all access, explaining the lack of Internet and resource access.
Analysis:
CPPM sends the Aruba-User-Role VSA with the value "user_group4," indicating that the user should be assigned to the "user_group4" role on the MC.
However, the MC assigns the client to the "denyall" role, which typically denies all traffic, resulting in no Internet or resource access.
The issue lies in why the MC did not apply the "user_group4" role sent by CPPM.
Option A, "The AOS device does not have the correct RADIUS dictionaries installed on it to understand the Aruba-User-Role VSA," is incorrect. If the MC did not have the correct RADIUS dictionaries to understand the Aruba-User-Role VSA, it would not process the VSA at all, and the issue would likely affect all users, not just the new user group. Additionally, Aruba-User-Role is a standard VSA in AOS-8, and the dictionaries are built into the system.
Option B, "The AOS device has a server derivation rule configured on it that has overridden the role sent by CPPM," is incorrect. Server derivation rules on the MC can override roles sent by the RADIUS server (e.g., based on attributes like username or NAS-IP), but there is no indication in the scenario that such a rule is configured. If a derivation rule were overriding the role, it would likely affect more users, and the issue would not be specific to the new user group.
Option C, "The clients rejected the server authentication on their side because they do not have the root CA for CPPM's RADIUS/EAP certificate," is incorrect. If the clients rejected the server authentication (e.g., due to a missing root CA for CPPM's certificate), the authentication would fail entirely, and CPPM would not send an Access-Accept with the Aruba-User-Role VSA. The scenario confirms that authentication succeeded (Access-Accept was sent), so this is not the issue.
Option D, "The role name that CPPM is sending does not match the role name configured on the AOS device," is correct. CPPM sends the role "user_group4" in the Aruba-User-Role VSA, but the MC assigns the client to the "denyall" role. This suggests that the role "user_group4" does not exist on the MC, or there is a mismatch in the role name (e.g., due to case sensitivity, typos, or underscores vs. hyphens). In AOS-8, if the role specified in the Aruba-User-Role VSA does not exist on the MC, the MC falls back to a default role, which in this case appears to be "denyall," denying all access. The likely problem is that the role name "user_group4" sent by CPPM does not match the role name configured on the MC (e.g., it might be "user-group4" or a different name).
The HPE Aruba Networking AOS-8 8.11 User Guide states:
"When the Mobility Controller receives an Aruba-User-Role VSA in a RADIUS Access-Accept message, it attempts to assign the specified role to the client. If the role name sent by the RADIUS server (e.g., 'user_group4') does not match a role configured on the controller, the controller will fall back to a default role, such as 'denyall,' which may deny all access. To resolve this, ensure that the role name sent by the RADIUS server matches the role name configured on the controller, accounting for case sensitivity and naming conventions (e.g., underscores vs. hyphens)." (Page 306, Role Assignment Troubleshooting Section) Additionally, the HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide notes:
"A common issue when assigning roles via the Aruba-User-Role VSA is a mismatch between the role name sent by ClearPass and the role name configured on the Aruba device. If the role name does not match (e.g., 'user_group4' vs. 'user-group4'), the device will not apply the intended role, and the client may be assigned a default role like 'denyall,' resulting in access issues. Verify that the role names match exactly in both ClearPass and the device configuration." (Page 290, RADIUS Role Assignment Issues Section)
:
HPE Aruba Networking AOS-8 8.11 User Guide, Role Assignment Troubleshooting Section, Page 306.
HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide, RADIUS Role Assignment Issues Section, Page 290.

NEW QUESTION # 39
Refer to the exhibit.

This Aruba Mobility Controller (MC) should authenticate managers who access the Web Ul to ClearPass Policy Manager (CPPM) ClearPass admins have asked you to use RADIUS and explained that the MC should accept managers' roles in Aruba-Admin-Role VSAs Which setting should you change to follow Aruba best security practices?

• A. Change the default role to "guest-provisioning"
• B. Clear the MSCHAP check box
• C. Disable local authentication
• D. Change the local user role to read-only

Answer: C

Explanation:
For following Aruba best security practices, the setting you should change is to disable local authentication. When integrating with an external RADIUS server like ClearPass Policy Manager (CPPM) for authenticating administrative access to the Mobility Controller (MC), it is a best practice to rely on the external server rather than the local user database. This practice not only centralizes the management of user roles and access but also enhances security by leveraging CPPM's advanced authentication mechanisms.
:
Aruba Networks official best practice documentation, which recommends centralized authentication for administrative access.
Security standards and guidelines that promote the use of external RADIUS servers for authentication purposes.

NEW QUESTION # 40
Refer to the exhibit.

You are deploying a new ArubaOS Mobility Controller (MC), which is enforcing authentication to Aruba ClearPass Policy Manager (CPPM). The authentication is not working correctly, and you find the error shown In the exhibit in the CPPM Event Viewer.
What should you check?

• A. that the snared secret configured for the CPPM authentication server matches the one defined for the device on CPPM
• B. that the IP address that the MC is using to reach CPPM matches the one defined for the device on CPPM
• C. that the MC has been added as a domain machine on the Active Directory domain with which CPPM is synchronized
• D. that the MC has valid admin credentials configured on it for logging into the CPPM

Answer: B

Explanation:
Given the error message from the ClearPass Policy Manager (CPPM) Event Viewer, indicating a RADIUS authentication attempt from an unknown Network Access Device (NAD), you should check that the IP address the Mobility Controller (MC) is using to communicate with CPPM matches the IP address defined for the MC in the CPPM's device inventory. If there is a mismatch in IP addresses, CPPM will not recognize the MC as a known device and will not process the authentication request, leading to the error observed.
:
ClearPass Policy Manager documentation on device management.

NEW QUESTION # 41
What is a use case for Transport Layer Security (TLS)?

• A. to establish a framework for devices to determine when to trust other devices' certificates
• B. to provide a secure alternative to certificate authentication that is easier to implement
• C. to enable a client and a server to establish secure communications for another protocol
• D. to enable two parties to asymmetrically encrypt and authenticate all data that passes be-tween them

Answer: C

Explanation:
The use case for Transport Layer Security (TLS) is to enable a client and a server to establish secure communications for another protocol. TLS is a cryptographic protocol designed to provide secure communication over a computer network. It is widely used for web browsers and other applications that require data to be securely exchanged over a network, such as file transfers, VPN connections, and voice-over-IP (VoIP). TLS operates between the transport layer and the application layer of the Internet Protocol Suite and is used to secure various other protocols like HTTP (resulting in HTTPS), SMTP, IMAP, and more. This protocol ensures privacy and data integrity between two communicating applications. Detailed information about TLS and its use cases can be found in IETF RFC 5246, which outlines the specifications for TLS 1.2, and in subsequent RFCs that define TLS 1.3.

NEW QUESTION # 42
What is a guideline for managing local certificates on an ArubaOS-Switch?

• A. Generate the certificate signing request (CSR) with a program offline, then, install both the certificate and the private key on the switch in a single file.
• B. Before installing the local certificate, create a trust anchor (TA) profile with the root CA certificate for the certificate that you will install
• C. Install an Online Certificate Status Protocol (OCSP) certificate to simplify the process of enrolling and re-enrolling for certificate
• D. Create a self-signed certificate online on the switch because ArubaOS-Switches do not support CA-signed certificates.

Answer: B

Explanation:
When managing local certificates on an ArubaOS-Switch, a recommended guideline is to create a trust anchor (TA) profile with the root CA certificate before installing the local certificate. This step ensures that the switch can verify the authenticity of the certificate chain during SSL/TLS communications. The trust anchor profile establishes a basis of trust by containing the root CA certificate, which helps validate the authenticity of any subordinate certificates, including the local certificate installed on the switch. This process is essential for enhancing security on the network, as it ensures that encrypted communications involving the switch are based on a verified certificate hierarchy.
:
ArubaOS-Switch security configuration guides that detail the process of certificate management, including the creation of trust anchor profiles.
Security best practices and SSL/TLS implementation guidelines that emphasize the importance of establishing trusted certificate chains for secure communications.

NEW QUESTION # 43
What is a use case for tunneling traffic between an Aruba switch and an AruDa Mobility Controller (MC)?

• A. enhancing the security of communications from the access layer to the core with data encryption
• B. simplifying network infrastructure management by using the MC to push configurations to the switches
• C. securing the network infrastructure control plane by creating a virtual out-of-band-management network
• D. applying firewall policies and deep packet inspection to wired clients

Answer: C

Explanation:
Tunneling traffic between an Aruba switch and an Aruba Mobility Controller (MC) allows for the centralized application of firewall policies and deep packet inspection to wired clients. By directing traffic through the MC, network administrators can implement a consistent set of security policies across both wired and wireless segments of the network, enhancing overall network security posture.

NEW QUESTION # 44
What is one way a noneypot can be used to launch a man-in-the-middle (MITM) attack to wireless clients?

• A. it uses a combination or software and hardware to jam the RF band and prevent the client from connecting to any wireless networks
• B. it examines wireless clients' probes and broadcasts the SSlDs in the probes, so that wireless clients will connect to it automatically.
• C. it uses ARP poisoning to disconnect wireless clients from the legitimate wireless network and force clients to connect to the hacker's wireless network instead.
• D. it runs an NMap scan on the wireless client to And the clients MAC and IP address. The hacker then connects to another network and spoofs those addresses.

Answer: B

Explanation:
A honeypot can be used to launch a Man-in-the-Middle (MITM) attack on wireless clients by examining wireless clients' probe requests and then broadcasting the SSIDs in those probes. Clients with those SSIDs in their preferred network list may then automatically connect to the honeypot, believing it to be a legitimate network. Once the client is connected to the attacker's honeypot, the attacker can intercept, monitor, or manipulate the client's traffic, effectively executing a MITM attack.

NEW QUESTION # 45
......

HPE6-A78 Exam Practice Questions prepared by HP Professionals: https://www.realvce.com/HPE6-A78_free-dumps.html

Use Valid New HPE6-A78 Questions - Top choice Help You Gain Success: https://drive.google.com/open?id=1rae4J04LkjDMXVoxxZeEOd-V0qMZ20lz