HP HPE6-A81 Online Practice Questions and Exam Preparation

HP HPE6-A81 Online Questions & Answers

• Question 1:

  When is it recommended to use a certificate with multiple entries on the Subject Alternative Name?

  A. The ClearPass servers are placed in different OnGuard zones to allow the client agent to send SHV updates.
  B. Using the same certificate to Onboard clients and the Guest Captive Portal on a single ClearPass server.
  C. The primary authentication server Is not available to authenticate the users.
  D. The ClearPass server will be hosting captive portal pages for multiple FQDN entries
  A. The ClearPass servers are placed in different OnGuard zones to allow the client agent to send SHV updates.

• Question 2:

  Refer to the exhibit:

  

  Your customer configured a ClearPass server to process the Guest and Secure SSIDs broadcasting from both Aruba and Cisco WLAN controllers When an Employee connects to Aruba or Cisco secure SSID, the authentication hits the guest

  service causing the client to fail the connection to the network.

  What change can be implemented to make both the secure and guest services created for Aruba and Cisco devices to work correctly?

  A. Move the HS-Guest User Authentication with MAC Caching service to the first position.
  B. Modify the service rule matching algorithm to ALL in HS-Guest User Authentication service.
  C. Disable HS-Guest User Authentication service and move HS-Guest MAC Authentication to seventh position.
  D. Move the HS_Building Aruba 802.1x service to the second position in the service order.
  A. Move the HS-Guest User Authentication with MAC Caching service to the first position.

• Question 3:

  You have integrated ClearPass Onboard with Active Directory Certificate Services (ADCS) web enrollment to sign the final device TLS certificates. The customer would also like to use ADCS for centralized management of TLS certificates

  including expiration, revocation, and deletion through ADCS.

  What steps will you follow to complete the requirement?

  A. Remove the EAP-TLS authentication method and add "EAP-TLS with OCSP Enabled' authentication method in the OnBoard Provisioning service. No other configuration changes are required.
  B. Copy the [EAP-TLS with OSCP Enabled) authentication method and set the correct ADCS server OCSP URL, remove EAP-TLS and map the custom created method to the Onboard Provisioning Service.
  C. Copy the default [EAP-TLS with OSCP Enabled] authentication method and update the correct ADCS server OCSP URL. remove EAP-TLS and map the custom created method to the OnBoard Authorization Service.
  D. Edit the [EAP-TLS with OSCP Enabled) authentication method and set the correct ADCS server OCSP URL. remove EAP-TLS and map the [EAP-TLS with OSCP Enabled) method to the Onboard Provisioning Service.
  A. Remove the EAP-TLS authentication method and add "EAP-TLS with OCSP Enabled' authentication method in the OnBoard Provisioning service. No other configuration changes are required.

• Question 4:

  You are deploying ClearPass Policy Manager with Guest functionality for a customer with multiple Aruba Networks Mobility Controllers The customer wants to avoid SSL errors during guest access but due to company security policy cannot use a wildcard certificate on ClearPass or the Controllers. What is the most efficient way to configure the customers guest solution? (Select two.)

  A. Build multiple Web Login pages with vendor settings configured for each controller
  B. Install the same public certificate on all Controllers with the common name "controller {company domain}"
  C. Build one Web Login page with vendor settings for controller {company domain)
  D. Install multiple public certificates with a different Common Name on each controller
  A. Build multiple Web Login pages with vendor settings configured for each controller
  B. Install the same public certificate on all Controllers with the common name "controller {company domain}"

• Question 5:

  A customer would like to allow only the AD users with the "Manager" title from the "HQ" location to Onboard their personal devices. Any other AD users should not be authorized to pass beyond the initial device provisioning page. Which Onboard service will you use to implement this requirement?

  A. Onboard CP login service
  B. Onboard Authorization service
  C. Onboard Provisioning service
  D. Onboard Pre-Auth service
  A. Onboard CP login service

• Question 6:

  Where is the following information stored in ClearPass?

  1.

  Roles and Posture for Connected Clients

  2.

  System Health for OnGuard

  3.

  Machine authentication State

  4.

  CoA session info

  5.

  Mapping of connected clients to NAS/NAD

  A. Multi-Master cache
  B. Endpoint database
  C. insight database
  D. ClearPass system cache
  D. ClearPass system cache

• Question 7:

  Refer to the exhibit:

  

  A customer has configured Onboard and Windows devices work as expected but cannot get the Apple iOS devices to Onboard successfully. Where would you look to troubleshoot the Issued (Select two)

  A. Check if the ClearPass HTTPS server certificate installed in the server is issued by a trusted commercial certificate authority.
  B. Check if the customer installed the internal PKl Root certificate presented by the ClearPass during the provisioning process.
  C. Check if a DNS entry is available for the ClearPass hostname in the certificate, resolvable from the DNS server assigned to the client.
  D. Check if the customer has Instated a custom HTTPS certificate for IDS and another internal PKl HTTPS certificate for other devices.
  E. Check if the customer has installed the same internal PKl signed RADIUS server certificate as the HTTPS server certificate.
  A. Check if the ClearPass HTTPS server certificate installed in the server is issued by a trusted commercial certificate authority.
  C. Check if a DNS entry is available for the ClearPass hostname in the certificate, resolvable from the DNS server assigned to the client.

• Question 8:

  A customer has configured Onboard with Single SSID provision for Aruba IAP Windows devices work as expected but cannot get the Apple iOS devices to work. The Apple iOS devices automatically get redirected to a blank page and do not get the Onboard portal page. What would you check to fix the issue?

  A. Verify if the checkbox "Enable bypassing the Apple Captive Network Assistant" is checked.
  B. Verify if the Onboard URL is updated correctly in the external captive portal profile.
  C. Verify if Onboard Pre-Provisioning enforcement profile sends the correct Aruba user role.
  D. Verify if the external captive portal profile is enabled to use HTTPS with port 443.
  B. Verify if the Onboard URL is updated correctly in the external captive portal profile.

• Question 9:

  A customer is complaining that some of the devices, in their manufacturing network, are not getting profiled while other loT devices from the same subnet have been correctly profiled. The network switches have been configured for DHCP IP helpers and IF-MAP has been configured on the Aruba Controllers. What can the customer do to discover those devices as well? (Select two.)

  A. Update the Fingerprints Dictionary to the latest in case new devices have been added.
  B. Open a TAC case to help you troubleshoot the DHCP device profile functionality.
  C. Add the ClearPass Server IP as an IP helper address on the default gateway as well.
  D. Allow time for IF-MAP service on the controller to discover the new devices as well.
  E. Manually create a new device fingerprint for the devices that are not being profiled.
  D. Allow time for IF-MAP service on the controller to discover the new devices as well.
  E. Manually create a new device fingerprint for the devices that are not being profiled.

• Question 10:

  Refer to the Exhibit:

  

  A customer wants to integrate posture validation into an Aruba Wireless 802.1X authentication service During testing, the client connects to the Aruba Employee Secure SSID and is redirected to the Captive Portal page where the user can

  download the OnGuard Agent After the Agent is installed, the client receives the Healthy token the client remains connected to the Captive Portal page ClearPass is assigning the endpoint the following roles: T2-Staff-User. (Machine

  Authenticated! and T2-SOL-Device.

  What could cause this behavior?

  A. The Enforcement Policy conditions for rule 1 are not configured correctly.
  B. Used Cached Results: has not been enabled In the Aruba 802.1X Wireless Service
  C. RFC-3576 Is not configured correctly on the Aruba Controller and does not update the role.
  D. The Enforcement Profile should bounce the connection instead of a Terminate session
  B. Used Cached Results: has not been enabled In the Aruba 802.1X Wireless Service