HPE6-A68 Real Exam Questions and Verified Answers

Question 1 Multiple choice

Which checks are made with Onguard posture evaluation in ClearPass? (Select three.)

A
Registry keys
B
EAP TLS certificate validity
C
Client role check
D
Peer-to-peer application checks
E
Operating System version

Show answer and explanation

Correct answers: A, D, E

Question 2 Single choice

What is the purpose of RADIUS CoA (RFC 3576)?

A
to force the client to re-authenticate upon roaming to a new Controller
B
to apply firewall policies based on authentication credentials
C
to validate a host MAC address against a whitelist or a blacklist
D
to authenticate users or devices before granting them access to a network
E
to transmit messages to the NAD/NAS to modify a user's session status

Show answer and explanation

Correct answer: E

Explanation

CoA messages modify session authorization attributes such as data filters.
References:
https://tools.ietf.org/html/rfc3576

Question 3 Single choice

ClearPass and a wired switch are configured for 802.1x authentication with RADIUS CoA (RFC 3576) on UDP port 3799. This port has been blocked by a firewall between the wired switch and ClearPass.

What will be the outcome of this state?

A
RADIUS Authentications will fail because the wired switch will not be able to reach the ClearPass server.
B
During RADIUS Authentication, certificate exchange between the wired switch and ClearPass will fail.
C
RADIUS Authentications will timeout because the wired switch will not be able to reach the ClearPass server.
D
RADIUS Authentication will succeed, but Post-Authentication Disconnect-Requests from ClearPass to the wired switch will not be delivered.
E
RADIUS Authentication will succeed, but RADIUS Access-Accept messages from ClearPass to the wired switch for Change of Role will not be delivered.

Show answer and explanation

Correct answer: D

Question 4 Multiple choice

A customer wants to implement Virtual IP redundancy, such that in case of a ClearPass server outage, 802.1x authentications will not be interrupted. The administrator has enabled a single Virtual IP address on two ClearPass servers.

Which statements accurately describe next steps? (Select two.)

A
The NAD should be configured with the primary node IP address for RADIUS authentication on the
802.1x network.
B
A new Virtual IP address should be created for each NAD.
C
Both the primary and secondary nodes will respond to authentication requests sent to the Virtual IP address when the primary node is active.
D
The primary node will respond to authentication requests sent to the Virtual IP address when the primary node is active.
E
The NAD should be configured with the Virtual IP address for RADIUS authentications on the 802.1x network.

Show answer and explanation

Correct answers: D, E

Explanation

In an Aruba network, APs are controlled by a controller. The APs tunnel all data to the controller for processing, including encryption/decryption and bridging/forwarding data. Local controller redundancy provides APs with failover to a backup controller if a controller becomes unavailable. Local controller redundancy is provided by running VRRP between a pair of controllers. The APs are then configured to connect to the "virtual-IP" configured for the VRRP instance.
References:
http://www.arubanetworks.com/techdocs/ArubaOS_64x_WebHelp/Content/ArubaFrameStyles/VRRP/
Redundancy_Parameters.htm

Question 5 Single choice

Refer to the exhibit.

Based on the network topology diagram shown, how many clusters are needed for this deployment?

A
1
B
2
C
3
D
4
E
8

Show answer and explanation

Correct answer: D

Explanation

References:
http://www.arubanetworks.com/techdocs/ClearPass/Aruba_DeployGd_HTML/Content/5%20Cluster%20Deployment/Design_guidelines.htm

Question 6 Multiple choice

Refer to the exhibit.

Based on the ClearPass and Aruba Controller configuration settings for Onboarding shown, which statement accurately describes an employee's new personal device connecting to the Onboarding network? (Select two.)

A
Post-Onboarding, the device will be assigned the BYOD-Provision firewall role in the Aruba Controller.
B
Pre-Onboarding, the device will be redirected to the `Onboarding Page' Captive Portal.
C
The BYOD-Provision role is a ClearPass internal role and exists in ClearPass.
D
The device will not be redirected to any Onboarding page.
E
Pre-Onboarding, the device will be assigned the BYOD-Provision firewall role in the Aruba Controller.

Show answer and explanation

Correct answers: B, E

Explanation

You can pre-provision with the Aruba controller firewall role of BYOD-Provision. From the Firewall policies part of the exhibit, we see that the onboarding page is set to captive portal.
References:
https://community.arubanetworks.com/t5/Security/CP-OnBoard-not-redirecting-to-portal-on-single-SSID/td-p/284506

Question 7 Multiple choice

What must be configured to enable RADIUS authentication with ClearPass on a network access device (NAD)? (Select two.)

A
the ClearPass server must have the network device added as a valid NAD
B
the ClearPass server certificate must be installed on the NAD
C
a matching shared secret must be configured on both the ClearPass server and NAD
D
an NTP server needs to be set up on the NAD
E
a bind username and bind password must be provided

Show answer and explanation

Correct answers: A, C

Question 8 Single choice

Refer to the exhibit.

An AD user's department attribute value is configured as "Product Management". The user connects on Monday to a NAD that belongs to the Device Group HQ.

Which role is assigned to the user in ClearPass?

A
HR Local
B
[Guest]
C
[Employee]
D
Linux User
E
Executive

Show answer and explanation

Correct answer: E

Explanation

The conditions of the Executive Role is met.

Question 9 Single choice

What does a Windows client need for it to perform EAS-PEAP successfully when `Validate server Certificate' is not enabled?

A
Pre-shared key
B
Client Certificate
C
WPA2-PSK
D
Username and Password
E
Server Certificate

Show answer and explanation

Correct answer: D

Question 10 Single choice

Refer to the exhibit.

An administrator logs in to the Guest module in ClearPass and `Manage Accounts' displays as shown.

When a user with username [email protected] attempts to access the Web Login page, what will be the outcome?

A
The user will be able to log in and authenticate successfully but will then be immediate disconnected.
B
The user will be able to log in for the next 4.9. days, but then will no longer be able to log in.
C
The user will not be able to log in and authenticate.
D
The user will be able to log in and authenticate successfully, but will then get a quarantine role.
E
The user will not be able to access the Web Login page.

Show answer and explanation

Correct answer: C