Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
HP
HPE Aruba Certified
HPE6-A68
Aruba Certified ClearPass Professional (ACCP) 6.7 Questions and Answers

Pass the HPE Aruba Certified HPE6-A68 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam HPE6-A68 Premium Access

View all detail and faqs for the HPE6-A68 exam

Go to Exam

819 Students Passed

91% Average Score

94% Same Questions

Viewing page 3 out of 4 pages

Viewing questions 21-30 out of questions

Questions # 21:

A customer would like to deploy ClearPass with these requirements:

every day, 100 employees need to authenticate with their corporate laptops using EAP-TLS

every Friday, a meeting with business partners takes place and an additional 50 devices need to authenticate using Web Login Guest Authentication

What should the customer do regarding licenses? (Select two.)

Options:

When counting policy manager licenses, include the additional 50 business partner devices.

When counting policy manager licenses, exclude the additional 50 business partner devices.

Purchase Onboard licenses.

Purchase guest licenses.

Purchase Onguard licenses.

Answer

A, C

Questions # 22:

What are Operator Profiles used for?

Options:

to enforce role based access control for Aruba Controllers

to enforce role based access control for ClearPass Policy Manager admin users

to enforce role based access control for ClearPass Guest Admin users

to assign ClearPass roles to guest users

to map AD attributes to admin privilege levels in ClearPass Guest

Answer

Explanation

An operator profile determines what actions an operator is permitted to take when using ClearPass Guest.

References: http://www.arubanetworks.com/techdocs/ClearPass/CPGuest_UG_HTML_6.5/Content/OperatorLogins/OperatorProfiles.htm

Questions # 23:

A customer wants to implement Virtual IP redundancy, such that in case of a ClearPass server outage, 802.1x authentications will not be interrupted. The administrator has enabled a single Virtual IP address on two ClearPass servers.

Which statements accurately describe next steps? (Select two.)

Options:

The NAD should be configured with the primary node IP address for RADIUS authentication on the 802.1x network.

A new Virtual IP address should be created for each NAD.

Both the primary and secondary nodes will respond to authentication requests sent to the Virtual IP address when the primary node is active.

The primary node will respond to authentication requests sent to the Virtual IP address when the primary node is active.

The NAD should be configured with the Virtual IP address for RADIUS authentications on the 802.1x network.

Answer

D, E

Explanation

In an Aruba network, APs are controlled by a controller. The APs tunnel all data to the controller for processing, including encryption/decryption and bridging/forwarding data. Local controller redundancy provides APs with failover to a backup controller if a controller becomes unavailable. Local controller redundancy is provided by running VRRP between a pair of controllers. The APs are then configured to connect to the “virtual-IP” configured for the VRRP instance.

References: http://www.arubanetworks.com/techdocs/ArubaOS_64x_WebHelp/Content/ArubaFrameStyles/VRRP/Redundancy_Parameters.htm

Questions # 24:

ClearPass and a wired switch are configured for 802.1x authentication with RADIUS CoA (RFC 3576) on UDP port 3799. This port has been blocked by a firewall between the wired switch and ClearPass.

What will be the outcome of this state?

Options:

RADIUS Authentications will fail because the wired switch will not be able to reach the ClearPass server.

During RADIUS Authentication, certificate exchange between the wired switch and ClearPass will fail.

RADIUS Authentications will timeout because the wired switch will not be able to reach the ClearPass server.

RADIUS Authentication will succeed, but Post-Authentication Disconnect-Requests from ClearPass to the wired switch will not be delivered.

RADIUS Authentication will succeed, but RADIUS Access-Accept messages from ClearPass to the wired switch for Change of Role will not be delivered.

Answer

Questions # 25:

Which collectors can be used for device profiling? (Select two.)

Options:

Username and Password

ActiveSync Plugin

Client’s role on the controller

Onguard agent

Active Directory Attributes

Answer

B, D

Questions # 26:

Refer to the exhibit.

Question # 26

Based on the Enforcement Policy configuration shown, when a user with Role Engineer connects to the network and the posture token assigned is Unknown, which Enforcement Profile will be applied?

Options:

EMPLOYEE_VLAN

RestrictedACL

Deny Access Profile

HR VLAN

Remote Employee ACL

Answer

Questions # 27:

What must be configured to enable RADIUS authentication with ClearPass on a network access device (NAD)? (Select two.)

Options:

the ClearPass server must have the network device added as a valid NAD

the ClearPass server certificate must be installed on the NAD

a matching shared secret must be configured on both the ClearPass server and NAD

an NTP server needs to be set up on the NAD

a bind username and bind password must be provided

Answer

A, C

Questions # 28:

Refer to the exhibit.

Question # 28

Based on the Enforcement Profile configuration shown, which statement accurately describes what is sent?

Options:

A limited access VLAN value is sent to the Network Access Device.

An unhealthy role value is sent to the Network Access Device.

A message is sent to the Onguard Agent on the client device.

A RADIUS CoA message is sent to bounce the client.

A RADIUS access-accept message is sent to the Controller

Answer

Explanation

The OnGuard Agent enforcement policy retrieves the posture token. If the token is HEALTHY it returns a healthy message to the agent and bounces the session. If the token is UNHEALTHY it returns an unhealthy message to the agent and bounces the session.

References: CLEARPASS ONGUARD CONFIGURATION GUIDE (July 2015), page 27

Questions # 29:

Which checks are made with Onguard posture evaluation in ClearPass? (Select three.)

Options:

Registry keys

EAP TLS certificate validity

Client role check

Peer-to-peer application checks

Operating System version

Answer

A, D, E

Questions # 30:

What is the certificate format PKCS #7, or .p7b, used for?

Options:

Certificate Signing Request

Binary encoded X.509 certificate

Binary encoded X.509 certificate with public key

Certificate with an encrypted private key

Certificate chain

Answer

Explanation

The PKCS#7 or P7B format is usually stored in Base64 ASCII format and has a file extension of .p7b or .p7c. P7B certificates contain "-----BEGIN PKCS7-----" and "-----END PKCS7-----" statements. A P7B file only contains certificates and chain certificates, not the private key. Several platforms support P7B files including Microsoft Windows and Java Tomcat.

References: https://community.arubanetworks.com/t5/Controller-Based-WLANs/Various-Certificate-Formats/ta-p/176548

Viewing page 3 out of 4 pages

Viewing questions 21-30 out of questions