HP HPE6-A68 Online Practice Questions and Exam Preparation

HP HPE6-A68 Online Questions & Answers

• Question 1:

  What is a benefit of ClearPass Onguard?

  A. It enables organizations to run advanced endpoint posture assessments.
  B. It allows a receptionist in a hotel to create accounts for guest users.
  C. It allows employees to self-provision their personal devices on the corporate network.
  D. It offers an easy way for users to self-configure their devices to support 802.1X authentication on wired and wireless networks.
  E. It allows employees to create temporary accounts for Wi-Fi access.
  A. It enables organizations to run advanced endpoint posture assessments.

• Question 2:

  What is the purpose of RADIUS CoA (RFC 3576)?

  A. to force the client to re-authenticate upon roaming to a new Controller
  B. to apply firewall policies based on authentication credentials
  C. to validate a host MAC address against a whitelist or a blacklist
  D. to authenticate users or devices before granting them access to a network
  E. to transmit messages to the NAD/NAS to modify a user's session status
  E. to transmit messages to the NAD/NAS to modify a user's session status

  ---

  CoA messages modify session authorization attributes such as data filters. References: https://tools.ietf.org/html/rfc3576

• Question 3:

  Refer to the exhibit.

  

  An Enforcement Profile has been created in the Policy Manager as shown. Which action will ClearPass take based on the Enforcement Profile?

  A. It will send the Session-Timeout attribute in the RADIUS Access-Request packet to the NAD and the NAD will end the user's session after 600 seconds.
  B. It will send the Session-Timeout attribute in the RADIUS Access-Accept packet to the User and the user's session will be terminated after 600 seconds.
  C. It will count down 600 seconds and send a RADUIS CoA message to the NAD to end the user's session after this time is up.
  D. It will count down 600 seconds and send a RADUIUS CoA message to the user to end the user's session after this time is up.
  E. It will send the session -Timeout attribute in the RADIUS Access-Accept packet to the NAD and the NAD will end the user's session after 600 seconds.
  E. It will send the session -Timeout attribute in the RADIUS Access-Accept packet to the NAD and the NAD will end the user's session after 600 seconds.

• Question 4:

  A customer would like to deploy ClearPass with these requirements:

  between 2000 to 3000 corporate users need to authenticate daily using EAP-TLS should allow for up to 1000 employee devices to be should allow up to 100 guest users each day to authenticate using the web login feature What is the license mix that customer will need to purchase?

  A. CP-HW-2k, 1000 Onboard, 100 Guest
  B. CP-HW-500, 1000 Onboard, 100 Guest
  C. CP-HW-5k, 2500 Enterprise
  D. CP-HW-5k, 1000 Enterprise
  E. CP-HW-5k, 100 Onboard, 100 Guest
  C. CP-HW-5k, 2500 Enterprise

• Question 5:

  An employee provisions a personal smart phone using the Onboard process. In addition, the employee has a corporate laptop provided by IT that connects to the secure network. How many licenses does the employee consume?

  A. 1 Policy Manager license, 2 Guest Licenses
  B. 2 Policy Manager licenses, 1 Onboard License
  C. 1 Policy Manager license, 1 Onboard License
  D. 1 Policy Manager license, 1 Guest License
  E. 2 Policy Manager licenses, 2 Onboard Licenses
  B. 2 Policy Manager licenses, 1 Onboard License

• Question 6:

  Why can the Onguard posture check not be performed during 802.1x authentication?

  A. Health Checks cannot be used with 802.1x.
  B. Onguard uses RADIUS, so an additional service must be created.
  C. Onguard uses HTTPS, so an additional service must be created.
  D. Onguard uses TACACS, so an additional service must be created.
  E. 802.1x is already secure, so Onguard is not needed.
  C. Onguard uses HTTPS, so an additional service must be created.

  ---

  OnGuard uses HTTPS to send posture information to the ClearPass appliance. For OnGuard to use HTTPS, it must have access to the network. If a customer requires 802.1x authentication on the wired switch, a separate 802.1x authentication must be used prior to the OnGuard posture check. In this example, an 802.1x PEAP-EAP-MSCHAPv2 authentication is completed first. A separate WebAuth service must be setup with posture checks to use the OnGuard agent.

  References: MAC Authentication and OnGuard Posture Enforcement using Dell WSeries ClearPass and Dell Networking Switches (August 2013), page 21

• Question 7:

  Refer to the exhibit.

  

  Based on the configuration of the create_user form shown, which statement accurately describes the status?

  A. The email field will be visible to guest users when they access the web login page.
  B. The visitor_company field will be visible to operators creating the account.
  C. The visitor_company field will be visible to the guest users when they access the web login page.
  D. The visitor_phone field will be visible to the guest users in the web login page.
  E. The visitor_phone field will be visible to operators creating the account.
  A. The email field will be visible to guest users when they access the web login page.

  ---

  References: https://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/expire-timezone-field-is-not-showing-up-on-the-create-user-form/ta-p/250230

• Question 8:

  Refer to the exhibit.

  

  Based on the Access Tracker output for the user shown, which statement describes the status?

  A. The Aruba Terminate Session enforcement profile as applied because the posture check failed.
  B. A Healthy Posture Token was sent to the Policy Manager.
  C. A RADIUS-Access-Accept message is sent back to the Network Access Device.
  D. The authentication method used is EAP-PEAP.
  E. A NAP agent was used to obtain the posture token for the user.
  B. A Healthy Posture Token was sent to the Policy Manager.

  ---

  We see System Posture Status: HEALTHY(0)

  End systems that pass all SHV tests receive a Healthy Posture Token, if they fail a single test they receive a Quarantine Posture Token.

  References: CLEARPASS ONGUARD CONFIGURATION GUIDE (July 2015), page 13

  https://community.arubanetworks.com/aruba/attachments/aruba/aaa-nac-guest-access-byod/21122/1/OnGuard%20config%20Tech%20Note%20v1.pdf

• Question 9:

  Refer to the exhibit.

  

  What is the purpose of the `Clock Skew Allowance' setting? (Select two.)

  A. to ensure server certificate validation does not fail due to client clock sync issues
  B. to set start time in client certificate to a few minutes before current time
  C. to adjust clock time on client device to a few minutes before current time
  D. to ensure client certificate validation does not fail due to client clock sync issues
  E. to set expiry time in client certificate to a few minutes longer than the default setting
  D. to ensure client certificate validation does not fail due to client clock sync issues

  ---

  Clock Skew Allowance adds a small amount of time to the start and end of the client certificate's, not the server certificate's, validity period. This permits a newly issued certificate to be recognized as valid in a network where not all devices are

  perfectly synchronized.

  References:

  http://www.arubanetworks.com/techdocs/ClearPass/6.6/Guest/Content/Onboard/EditingCASettings.htm

• Question 10:

  What is the purpose of the Audit Viewer in the Monitoring section of ClearPass Policy Manager?

  A. to audit client authentications
  B. to display changes made to the ClearPass configuration
  C. to display the entire configuration of the ClearPass Policy Manager
  D. to audit the network for PCI compliance
  E. to display system events like high CPU usage.
  B. to display changes made to the ClearPass configuration