HP HPE6-A15 Online Practice Questions and Exam Preparation

HP HPE6-A15 Online Questions & Answers

• Question 81:

  DRAG DROP

  Use the arrows to soft the steps to request a Policy on the left into the order they are performed on the right.

  Select and Place:

  

  

• Question 82:

  Refer to the exhibit.

  

  Based on the configuration of a Windows 802.1X supplicant shown, what will be the outcome of selecting `Validate server certificate'?

  A. The server and client will perform an HTTPS SSL certificate exchange.
  B. The client will verify the server certificate against a trusted CA.
  C. The client will send its private key to the server for verification.
  D. The server will send its private key to the client for verification.
  E. The client will send its certificate to the server for verification.
  B. The client will verify the server certificate against a trusted CA.

• Question 83:

  An Android device goes through the single-SSID Onboarding process and successfully connects using EAP-TLS to the secure network. What is the order in which services are triggered?

  A. Onboard Authorization, Onboard Provisioning, Onboard Authorization
  B. Onboard Provisioning, Onboard Pre-Auth, Onboard Authorization, Onboard Provisioning
  C. Onboard Provisioning, Onboard Authorization, Onboard Pre-Auth
  D. Onboard Provisioning, Onboard Authorization, Onboard Provisioning
  E. Onboard Provisioning, Onboard Pre-Auth, Onboard Authorization
  D. Onboard Provisioning, Onboard Authorization, Onboard Provisioning

• Question 84:

  Why can the Onguard posture check not be performed during 802.1x authentication?

  A. Health Checks cannot be used with 802.1x.
  B. Onguard uses RADIUS, so an additional service must be created.
  C. Onguard uses HTTPS, so an additional service must be created.
  D. Onguard uses TACACS, so an additional service must be created.
  E. 802.1x is already secure, so Onguard is not needed.
  C. Onguard uses HTTPS, so an additional service must be created.

  ---

  OnGuard uses HTTPS to send posture information to the ClearPass appliance. For OnGuard to use HTTPS, it must have access to the network. If a customer requires 802.1x authentication on the wired switch, a separate 802.1x authentication must be used prior to the OnGuard posture check. In this example, an 802.1x PEAP-EAP-MSCHAPv2 authentication is completed first. A separate WebAuth service must be setup with posture checks to use the OnGuard agent.

  References: MAC Authentication and OnGuard Posture Enforcement using Dell WSeries ClearPass and Dell Networking Switches (August 2013), page 21

• Question 85:

  A client's authentication is failing and there are no entries in the ClearPass Access tracker. What is a possible reason for the authentication failure?

  A. The user account has expired.
  B. The client used a wrong password.
  C. The shared secret between the NAD and ClearPass does not match.
  D. The user's certificate is invalid.
  E. The user is not found in the database.
  C. The shared secret between the NAD and ClearPass does not match.

• Question 86:

  Which types of files are stored in the Local Shared Folders database in ClearPass? (Select two.)

  A. Software image
  B. Backup files
  C. Log files
  D. Device fingerprint dictionaries
  E. Posture dictionaries
  B. Backup files
  C. Log files

• Question 87:

  Refer to the exhibit.

  

  Based on the Endpoint information shown, which collectors were used to profile the device as Apple iPad? (Select two.)

  A. HTTP User-Agent
  B. SNMP
  C. DHCP fingerprinting
  D. SmartDevice
  E. Onguard Agent
  A. HTTP User-Agent
  C. DHCP fingerprinting

  ---

  HTTP User-Agent

  In some cases, DHCP fingerprints alone cannot fully classify a device. A common example is the Apple family of smart devices; DHCP fingerprints cannot distinguish between an Apple iPad and an iPhone. In these scenarios, User-Agent

  strings sent by browsers in the HTTP protocol are useful to further refine classification results.

  User-Agent strings are collected from:

  *

  ClearPass Guest

  *

  ClearPass Onboard

  *

  Aruba controller through IF-MAP interface

  Note: Collectors are network elements that provide data to profile endpoints. The following collectors send endpoint attributes to Profile:

  *

  DHCP DHCP snooping Span ports

  *

  ClearPass Onboard

  *

  HTTP User-Agent

  *MAC OUI ?Acquired via various auth mechanisms such as 802.1X, MAC auth, etc.

  *

  ActiveSync plugin

  *

  CPPM OnGuard

  *SNMP

  *

  Subnet Scanner

  *

  IF-MAP

  *

  Cisco Device Sensor (Radius Accounting)

  *

  MDM

  References: Tech Note: ClearPass Profiling (2014), page 11 https://community.arubanetworks.com/aruba/attachments/aruba/ForoenEspanol/653/1/ClearPass%20Profiling%20TechNote.pdf

• Question 88:

  What is the purpose of the Audit Viewer in the Monitoring section of ClearPass Policy Manager?

  A. to audit client authentications
  B. to display changes made to the ClearPass configuration
  C. to display the entire configuration of the ClearPass Policy Manager
  D. to audit the network for PCI compliance
  E. to display system events like high CPU usage.
  B. to display changes made to the ClearPass configuration

• Question 89:

  What is the certificate format PKCS #7, or .p7b, used for?

  A. Certificate Signing Request
  B. Binary encoded X.509 certificate
  C. Binary encoded X.509 certificate with public key
  D. Certificate with an encrypted private key
  E. Certificate chain
  E. Certificate chain

  ---

  The PKCS#7 or P7B format is usually stored in Base64 ASCII format and has a file extension of .p7b or .p7c. P7B certificates contain "-----BEGIN PKCS7-----" and "-----END PKCS7-----" statements. A P7B file only contains certificates and chain certificates, not the private key. Several platforms support P7B files including Microsoft Windows and Java Tomcat.

  References: https://community.arubanetworks.com/t5/Controller-Based-WLANs/Various-Certificate-Formats/ta-p/176548

• Question 90:

  Refer to the exhibit.

  

  Based on the Enforcement Profile configuration shown, which statement accurately describes what is sent?

  A. A limited access VLAN value is sent to the Network Access Device.
  B. An unhealthy role value is sent to the Network Access Device.
  C. A message is sent to the Onguard Agent on the client device.
  D. A RADIUS CoA message is sent to bounce the client.
  E. A RADIUS access-accept message is sent to the Controller
  C. A message is sent to the Onguard Agent on the client device.

  ---

  The OnGuard Agent enforcement policy retrieves the posture token. If the token is HEALTHY it returns a healthy message to the agent and bounces the session. If the token is UNHEALTHY it returns an unhealthy message to the agent and bounces the session.

  References: CLEARPASS ONGUARD CONFIGURATION GUIDE (July 2015), page 27