HPE6-A68 Sample Questions Answers

Deny Access Profile

Onboard Device Repository

Cannot be determined

Onboard Post-Provisioning – Aruba

Onboard Pre-Provisioning – Aruba

Profiling policy

Certificate validation policy

Role Mapping policy

Enforcement policy

Posture policy

These show the total amount of traffic the guest transmitted, as seen through RADIUS CoA packets from the NAD to ClearPass.

These show the total amount of traffic the NAD transmitted to ClearPass, as seen through RADIUS accounting messages from the NAD to ClearPass.

These show the total amount of traffic the guest transmitted after account expiration, as seen through RADIUS accounting messages sent from the NAD to ClearPass.

These show the total amount of traffic the guest transmitted, as seen through RADIUS CoA packets from the client to ClearPass.

These show the total amount of traffic the guest transmitted, as seen through RADIUS accounting messages sent from the NAD to ClearPass.

After the RADIUS Access-Request

After the NAS login, but before the RADIUS Access-Request

Before the user can submit the registration form

After the RADIUS Access-Response

After the receipt page is displayed, before the NAS login

Guest device fingerprinting

Guest endpoint health assessment

Sponsor based guest user access

Guest user self-registration for access

Guest personal device onboarding

1

2

3

4

8

Mobile device Management is the result of Onboarding.

Third party Mobile Device Management solutions can be integrated with ClearPass.

Mobile Device Management is the authentication that happens before Onboarding.

Mobile Device Management is an application container that is used to provision work applications.

Mobile Device Management is used to control device functions post-Onboarding.

The client is compliant. However, there is an update available to remediate the client to HEALTHY state.

The posture of the client is unknown.

The client is infected and is a threat to other systems in the network.

The client is out of compliance, but has HEALTHY state.

The client is out of compliance.

Guest User Repository and Active Directory server both as authentication sources

Active Directory server as the authentication source, and Guest User Repository as the authorization source

Guest User Repository as the authentication source, and Guest User Repository and Active Directory server as authorization sources

Either the Guest User Repository or Active Directory server should be the single authentication source

Guest User Repository as the authentication source and the Active Directory server as the authorization source

Username and Password

ActiveSync Plugin

Client’s role on the controller

Onguard agent

Active Directory Attributes

The web login page will be displayed.

The client will send a NAS authentication request to ClearPass.

ClearPass will send a NAS authentication request to the NAD.

the NAD will send an authentication request to ClearPass.

The user will be presented with a self-registration receipt.

Enforcement Policy

Posture token derivation

Role Mapping

Endpoint Profiler

Chained simulation

The Aruba-Admin-Role on the controller is applies to users using TACACS+ to login to the Policy Manager

To assign different privileges to clients during 802.1X authentication

To assign different privileges to administrators logging into an Aruba NAD

It is used by ClearPass to assign TIPS roles to clients during 802.1X authentication

To assign different privileges to administrators logging into ClearPass

EAP-TLS Authentication will be unaffected

The user can Onboard their device again

A new device certificate will be automatically pushed out to the device

The user cannot Onboard their device again

EAP-TLS Authentication will fail

Configuration of the management port is optional.

Configuration of the management port is mandatory.

Configuration of the data port is mandatory.

Configuration of the data port is optional.

Static IP addresses are only allowed on the management port, not the data port.

Enable sponsor approval confirmation in Receipt actions.

Configure SMTP messaging in the Policy Manager.

Configure a MAC caching service in the Policy Manager.

Configure a MAC auth service in the Policy Manager.

Enable sponsor approval in the captive portal authentication profile on the NAD.

During dual SSID onboarding, when the client connects to the Guest network

During EAP-PEAP authentication in single SSID onboarding

During post-Onboard EAP-TLS authentication, when the client verifies the server certificate

During Onboard Web Login Pre-Auth, when the client loads the Onboarding web page

During post-Onboard EAP-TLS authentication, when the server verifies the client certificate

Onboard Authorization, Onboard Provisioning, Onboard Authorization

Onboard Provisioning, Onboard Pre-Auth, Onboard Authorization, Onboard Provisioning

Onboard Provisioning, Onboard Authorization, Onboard Pre-Auth

Onboard Provisioning, Onboard Authorization, Onboard Provisioning

Onboard Provisioning, Onboard Pre-Auth, Onboard Authorization

NAD sends TACACS+ request to ClearPass.

ClearPass sends TACACS+ request to NAD.

Client device sends RADIUS request to NAD.

NAD sends RADIUS request to ClearPass.

ClearPass sends RADIUS request to NAD.

HR Local

Remote Employee

[Guest]

Executive

IOS Device

Deny Access

Employee VLAN

Internet VLAN

Full Access VLAN

EMPLOYEE_VLAN

RestrictedACL

Deny Access Profile

HR VLAN

Remote Employee ACL

Linux laptop

Mac OS X device

Apple iOS device

Windows laptop

Android device

The client used incorrect credentials to authenticate to the network.

ClearPass does not have a service enabled for MAC authentication.

The client MAC address is not present in the Endpoints table in the CrearPass database.

The RADIUS client on the Windows server failed to categorize the service correctly.

The client wireless profile is incorrectly setup.

when a VLAN must be assigned to a wired user on an Aruba Mobility Controller

when a VLAN must be assigned to a wireless user on an Aruba Mobility Controller

when a VLAN must be assigned to a wired user on a third party wired switch that does not support RADIUS return attributes

when a VLAN must be assigned to a wired user on an Aruba Mobility Access Switch

when a VLAN must be assigned to a wired user on a third party wired switch that does not support RADIUS accounting

Generic LDAP Browser can be used to search the Base DN.

An administrator can customize the selection of attributes fetched from an LDAP server.

The bind DN can be in the administrator@domain format.

A maximum of one generic LDAP server can be configured in ClearPass.

A LDAP Browser can be used to search the Base DN.

Software image

Backup files

Log files

Device fingerprint dictionaries

Posture dictionaries

for forming the Web Login Page URL

for Administrators to access the PHP page, but not guests

for Administrators to reference the page only

for forming the Web Login Page URL where Administrators add guest users

for informing the Web Login Page URL and the page name that guests must configure on their laptop wireless supplicant.

HTTP User-Agent

SNMP

DHCP fingerprinting

SmartDevice

Onguard Agent

The test verifies that a client with username test1 can authenticate using EAP-PEAP.

Role mapping simulation verifies if the remote lab AD has the ClearPass server certificate.

Role mapping simulation verifies that the client certificate is valid during EAP-TLS authentication.

The simulation test result shows the firewall roles assigned to the client by the Aruba Controller.

The roles assigned in the results tab are based on rules matched in the AD Role Mapping Policy.

The NAD should be configured with the primary node IP address for RADIUS authentication on the 802.1x network.

A new Virtual IP address should be created for each NAD.

Both the primary and secondary nodes will respond to authentication requests sent to the Virtual IP address when the primary node is active.

The primary node will respond to authentication requests sent to the Virtual IP address when the primary node is active.

The NAD should be configured with the Virtual IP address for RADIUS authentications on the 802.1x network.