HP HPE6-A84 Online Practice Questions and Exam Preparation

HP HPE6-A84 Online Questions & Answers

• Question 1:

  Refer to the scenario.

  A customer has an Aruba ClearPass cluster. The customer has AOS-CX switches that implement 802.1X authentication to ClearPass Policy Manager (CPPM).

  Switches are using local port-access policies.

  The customer wants to start tunneling wired clients that pass user authentication only to an Aruba gateway cluster. The gateway cluster should assign these clients to the "eth- internet" role. The gateway should also handle assigning clients

  to their VLAN, which is VLAN 20.

  The plan for the enforcement policy and profiles is shown below:

  

  The gateway cluster has two gateways with these IP addresses:

  Gateway 1

  1.

  VLAN 4085 (system IP) = 10.20.4.21

  2.

  VLAN 20 (users) = 10.20.20.1

  3.

  VLAN 4094 (WAN) = 198.51.100.14

  Gateway 2

  1.

  VLAN 4085 (system IP) = 10.20.4.22

  2.

  VLAN 20 (users) = 10.20.20.2

  3.

  VLAN 4094 (WAN) = 198.51.100.12

  VRRP on VLAN 20 = 10.20.20.254

  The customer requires high availability for the tunnels between the switches and the gateway cluster. If one gateway falls, the other gateway should take over its tunnels. Also, the switch should be able to discover the gateway cluster regardless of whether one of the gateways is in the cluster.

  What is one change that you should make to the solution?

  A. Change the ubt-client-vlan to VLAN 13.
  B. Configure edge ports in VLAN trunk mode.
  C. Remove VLAN assignments from role configurations on the gateways.
  D. Configure the UBT solution to use VLAN extend mode.
  C. Remove VLAN assignments from role configurations on the gateways.

  ---

  Explanation/Reference:

  The UBT solution requires that the VLAN assignments for the wired clients are done by the gateway, not by the switch. Therefore, the role configurations on the gateways should not have any VLAN assignments, as they would override the VLAN 20 that is specified in the enforcement profile. Instead, the role configurations should only have policies that define the access rights for the clients in the "eth-internet" role. This way, the gateway can assign the clients to VLAN 20 and apply the appropriate policies based on their role

• Question 2:

  You are configuring gateway IDS/IPS settings in Aruba Central.

  For which reason would you set the Fail Strategy to Bypass?

  A. To permit traffic if the IPS engine falls to inspect It
  B. To enable the gateway to honor the allowlist settings configured in IDS/IPS policies
  C. To tell gateways to stop enforcing IDS/IPS policies if they lose connectivity to the Internet
  D. To avoid wasting IPS engine resources on filtering traffic for unauthenticated clients
  A. To permit traffic if the IPS engine falls to inspect It

  ---

  Explanation/Reference:

  The Fail Strategy is a configuration option for the IPS mode of inspection on Aruba gateways. It defines the action to be taken when the IPS engine crashes and cannot inspect the traffic. There are two possible options for the Fail Strategy: Bypass and Block1 If you set the Fail Strategy to Bypass, you are telling the gateway to allow the traffic to flow without inspection when the IPS engine fails. This option ensures that there is no disruption in the network connectivity, but it also exposes the network to potential threats that are not detected or prevented by the IPS engine1 If you set the Fail Strategy to Block, you are telling the gateway to stop the traffic flow until the IPS engine resumes inspection. This option ensures that there is no compromise in the network security, but it also causes a loss of network connectivity for the duration of the IPS engine failure1

• Question 3:

  You are working with a developer to design a custom NAE script for a customer. The NAE agent should trigger an alert when ARP inspection drops packets on a VLAN. The customer wants the admins to be able to select the correct VLAN ID for the agent to monitor when they create the agent.

  What should you tell the developer to do?

  A. Use this variable, %{vlan-id} when defining the monitor URI in the NAE agent script.
  B. Define a VLAN ID parameter; reference that parameter when defining the monitor URI.
  C. Create multiple monitors within the script from which admins can select when they create the agent.
  D. Use a callback action to collect the ID of the VLAN on which admins have enabled NAE monitoring.
  B. Define a VLAN ID parameter; reference that parameter when defining the monitor URI.

  ---

  Explanation/Reference:

  A custom NAE script is a Python script that defines the monitors, the alert-trigger logic, and the remedial actions for an NAE agent. A monitor is a URI that specifies the data source and the data type that the NAE agent should collect and analyze. For example, to monitor the ARP inspection statistics on a VLAN, the monitor URI would be something like this:

  

  where is the ID of the VLAN to be monitored.

  To allow the admins to select the correct VLAN ID for the agent to monitor when they create the agent, you need to define a VLAN ID parameter in the NAE script. A parameter is a variable that can be set by the user when creating or modifying an agent. A parameter can be referenced in other parts of the script by using the syntax ${parameter-name}. For example, to define a VLAN ID parameter and reference it in the monitor URI, you would write something like this: This way, when the admins create or modify the agent, they can enter the VLAN ID that they want to monitor, and the NAE script will use that value in the monitor URI. You can find more information about how to write custom NAE scripts and use parameters in the NAE Scripting Guide

  

• Question 4:

  Refer to the scenario.

  # Introduction to the customer

  You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

  The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is

  shown here.

  

  

  The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.

  # Requirements for issuing certificates to mobile clients

  The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be

  provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.

  The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.

  # Requirements for authenticating clients

  The customer requires all types of clients to connect and authenticate on the same corporate SSID.

  The company wants CPPM to use these authentication methods:

  1.

  EAP-TLS to authenticate users on mobile clients registered in Intune

  2.

  TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:

  1.

  Their certificate is valid and is not revoked, as validated by OCSP

  2.

  The client's username matches an account in AD # Requirements for assigning clients to roles After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:

  1.

  Clients with certificates issued by Onboard are assigned the "mobile-onboarded" role

  2.

  Clients that have passed TEAP Method 1 are assigned the "domain-computer" role

  3.

  Clients in the AD group "Medical" are assigned the "medical-staff" role

  4.

  Clients in the AD group "Reception" are assigned to the "reception-staff" role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:

  1.

  Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall role

  2.

  Assign other mobile-onboarded clients to the "mobile-other" firewall role

  3.

  Assign medical staff on domain computers to the "medical-domain" firewall role

  4.

  All reception staff on domain computers to the "reception-domain" firewall role

  5.

  All domain computers with no valid user logged in to the "computer-only" firewall role

  6.

  Deny other clients access # Other requirements Communications between ClearPass servers and on-prem AD domain controllers must be encrypted. # Network topology For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not

  managed by Central at this point.

  

  # ClearPass cluster IP addressing and hostnames

  A customer's ClearPass cluster has these IP addresses:

  1.

  Publisher = 10.47.47.5

  2.

  Subscriber 1 = 10.47.47.6

  3.

  Subscriber 2 = 10.47.47.7

  4.

  Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8

  The customer's DNS server has these entries

  1.

  cp.acnsxtest.com = 10.47.47.5

  2.

  cps1.acnsxtest.com = 10.47.47.6

  3.

  cps2.acnsxtest.com = 10.47.47.7

  4.

  radius.acnsxtest.com = 10.47.47.8

  5.

  onboard.acnsxtest.com = 10.47.47.8

  On CPPM, you are creating the authentication method shown in the exhibit below:

  

  You will use the method for standalone EAP-TLS and for inner methods in TEAP. What should you do?

  A. Configure OCSP override and set the OCSP URL to localhost/onboard/mdps ocspphp/2
  B. Enable certificate comparison.
  C. Enable authorization.
  D. Configure OCSP override and leave the OCSP URL blank.
  A. Configure OCSP override and set the OCSP URL to localhost/onboard/mdps ocspphp/2

  ---

  Explanation/Reference:

• Question 5:

  Refer to the scenario.

  # Introduction to the customer

  You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

  The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.

  

  

  The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.

  # Requirements for issuing certificates to mobile clients

  The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be

  provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.

  The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.

  # Requirements for authenticating clients

  The customer requires all types of clients to connect and authenticate on the same corporate SSID.

  The company wants CPPM to use these authentication methods:

  1.

  EAP-TLS to authenticate users on mobile clients registered in Intune

  2.

  TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:

  1.

  Their certificate is valid and is not revoked, as validated by OCSP

  2.

  The client's username matches an account in AD # Requirements for assigning clients to roles After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:

  1.

  Clients with certificates issued by Onboard are assigned the "mobile-onboarded" role

  2.

  Clients that have passed TEAP Method 1 are assigned the "domain-computer" role

  3.

  Clients in the AD group "Medical" are assigned the "medical-staff" role

  4.

  Clients in the AD group "Reception" are assigned to the "reception-staff" role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:

  1.

  Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall role

  2.

  Assign other mobile-onboarded clients to the "mobile-other" firewall role

  3.

  Assign medical staff on domain computers to the "medical-domain" firewall role

  4.

  All reception staff on domain computers to the "reception-domain" firewall role

  5.

  All domain computers with no valid user logged in to the "computer-only" firewall role

  6.

  Deny other clients access # Other requirements Communications between ClearPass servers and on-prem AD domain controllers must be encrypted. # Network topology For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not

  managed by Central at this point.

  

  # ClearPass cluster IP addressing and hostnames A customer's ClearPass cluster has these IP addresses:

  1.

  Publisher = 10.47.47.5

  2.

  Subscriber 1 = 10.47.47.6

  3.

  Subscriber 2 = 10.47.47.7

  4.

  Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8 The customer's DNS server has these entries

  1.

  cp.acnsxtest.com = 10.47.47.5

  2.

  cps1.acnsxtest.com = 10.47.47.6

  3.

  cps2.acnsxtest.com = 10.47.47.7

  4.

  radius.acnsxtest.com = 10.47.47.8

  5.

  onboard.acnsxtest.com = 10.47.47.8 You cannot see flow attributes for wireless clients. What should you check?

  A. Deep packet inspection is enabled on the role to which the Aruba APs assign the wireless clients.
  B. Firewall application visibility is enabled on the Aruba gateways, and the gateways have been rebooted.
  C. Gateway IDS/IPS is enabled on the Aruba gateways, and the gateways have been rebooted.
  D. Deep packet inspection is enabled on the Aruba Aps, and the APs have been rebooted.
  A. Deep packet inspection is enabled on the role to which the Aruba APs assign the wireless clients.

  ---

  Explanation/Reference:

• Question 6:

  Refer to the scenario.

  A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).

  The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).

  The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.

  Assume that the Azure AD deployment has the proper prerequisites established.

  You are planning the CPPM authentication source that you will reference as the authentication source in 802.1X services.

  How should you set up this authentication source?

  A. As Kerberos type
  B. As Active Directory type
  C. As HTTP type, referencing the Intune extension
  D. AS HTTP type, referencing Azure AD's FODN
  D. AS HTTP type, referencing Azure AD's FODN

  ---

  Explanation/Reference:

  An authentication source is a configuration element in CPPM that defines how to connect to an external identity provider and retrieve user or device information . CPPM supports various types of authentication sources, such as Active

  Directory, LDAP, SQL, Kerberos, and HTTP .

  To authenticate wireless and wired clients to Azure AD, you need to set up an authentication source as HTTP type, referencing Azure AD's FQDN . This type of authentication source allows CPPM to use REST API calls to communicate with

  Azure AD and validate the user or device credentials . You also need to configure the OAuth 2.0 settings for the authentication source, such as the client ID, client secret, token URL, and resource URL .

  To use information collected by Intune to make access control decisions, you need to set up another authentication source as HTTP type, referencing the Intune extension . This type of authentication source allows CPPM to use REST API

  calls to communicate with Intune and retrieve the device compliance status . You also need to configure the OAuth 2.0 settings for the authentication source, such as the client ID, client secret, token URL, and resource URL .

• Question 7:

  Refer to the scenario.

  A customer is migrating from on-prem AD to Azure AD as its sole domain solution. The customer also manages both wired and wireless devices with Microsoft Endpoint Manager (Intune).

  The customer wants to improve security for the network edge. You are helping the customer design a ClearPass deployment for this purpose. Aruba network devices will authenticate wireless and wired clients to an Aruba ClearPass Policy Manager (CPPM) cluster (which uses version 6.10).

  The customer has several requirements for authentication. The clients should only pass EAP-TLS authentication if a query to Azure AD shows that they have accounts in Azure AD. To further refine the clients' privileges, ClearPass also should use information collected by Intune to make access control decisions.

  You are planning to use Azure AD as the authentication source in 802.1X services.

  What should you make sure that the customer understands is required?

  A. An app registration on Azure AD that references the CPPM's FQDN
  B. Windows 365 subscriptions
  C. CPPM's RADIUS certificate was imported as trusted in the Azure AD directory
  D. Azure AD Domain Services
  A. An app registration on Azure AD that references the CPPM's FQDN

  ---

  Explanation/Reference:

  To use Azure AD as the authentication source in 802.1X services, you need to configure CPPM as a SAML service provider and Azure AD as a SAML identity provider. This allows CPPM to use Azure AD for user authentication and role mapping. To do this, you need to create an app registration on Azure AD that references the CPPM's FQDN as the reply URL and the entity ID. You also need to grant the app registration the required permissions to access user information from Azure AD1

• Question 8:

  Refer to the scenario.

  A customer has asked you to review their AOS-CX switches for potential vulnerabilities. The configuration for these switches is shown below:

  

  What is one recommendation to make?

  A. Let the RADIUS server confiqure VLANs on LAG 1 dynamically.
  B. Use MDS instead of SHA1 for the NTP authentication key.
  C. Encrypt the certificate in the TA-profile.
  D. Create a control plane ACL to limit the sources that can access the switch with SSH.
  D. Create a control plane ACL to limit the sources that can access the switch with SSH.

  ---

  Explanation/Reference:

  According to the AOS-CX Switches Multiple Vulnerabilities1, one of the vulnerabilities (CVE-2021-41000) affects the SSH service on AOS-CX switches. This vulnerability allows an unauthenticated remote attacker to cause a denial-of-service condition on the switch by sending specially crafted SSH packets. The impact of this vulnerability is high, as it could result in a loss of management access and network disruption. Therefore, one recommendation to make is to create a control plane ACL to limit the sources that can access the switch with SSH. This way, the switch can filter out unwanted or malicious SSH traffic and reduce the risk of exploitation.

• Question 9:

  Refer to the scenario.

  # Introduction to the customer

  You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

  The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.

  

  

  The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.

  # Requirements for issuing certificates to mobile clients

  The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be

  provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.

  The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.

  # Requirements for authenticating clients

  The customer requires all types of clients to connect and authenticate on the same corporate SSID.

  The company wants CPPM to use these authentication methods:

  1.

  EAP-TLS to authenticate users on mobile clients registered in Intune

  2.

  TEAR, with EAP-TLS as the inner method to authenticate Windows domain computers and the users on them To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:

  1.

  Their certificate is valid and is not revoked, as validated by OCSP

  2.

  The client's username matches an account in AD # Requirements for assigning clients to roles After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:

  1.

  Clients with certificates issued by Onboard are assigned the "mobile-onboarded" role

  2.

  Clients that have passed TEAP Method 1 are assigned the "domain-computer" role

  3.

  Clients in the AD group "Medical" are assigned the "medical-staff" role

  4.

  Clients in the AD group "Reception" are assigned to the "reception-staff" role The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:

  1.

  Assign medical staff on mobile-onboarded clients to the "medical-mobile" firewall role

  2.

  Assign other mobile-onboarded clients to the "mobile-other" firewall role

  3.

  Assign medical staff on domain computers to the "medical-domain" firewall role

  4.

  All reception staff on domain computers to the "reception-domain" firewall role

  5.

  All domain computers with no valid user logged in to the "computer-only" firewall role

  6.

  Deny other clients' access # Other requirements Communications between ClearPass servers and on-prem AD domain controllers must be encrypted. # Network topology For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not

  managed by Central at this point.

  

  # ClearPass cluster IP addressing and hostnames A customer's ClearPass cluster has these IP addresses:

  1.

  Publisher = 10.47.47.5

  2.

  Subscriber 1 = 10.47.47.6

  3.

  Subscriber 2 = 10.47.47.7

  4.

  Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8

  The customer's DNS server has these entries

  1.

  cp.acnsxtest.com = 10.47.47.5

  2.

  cps1.acnsxtest.com = 10.47.47.6

  3.

  cps2.acnsxtest.com = 10.47.47.7

  4.

  radius.acnsxtest.com = 10.47.47.8

  5.

  onboard.acnsxtest.com = 10.47.47.8

  You have created a role mapping policy as shown in the exhibits below.

  

  What is one change that you need to make to this policy?

  A. In rule 1 change Subject-CN to Issuer-CN.
  B. Move rules 2 and 3 to the top of the list.
  C. Change the rules evaluation mechanism to first applicable.
  D. Change the default role to 'mobile-onboarded*
  A. In rule 1 change Subject-CN to Issuer-CN.

  ---

  Explanation/Reference:

• Question 10:

  You are setting up Aruba ClearPass Policy Manager (CPPM) to enforce EAP-TLS authentication with Active Directory as the authentication source. The company wants to prevent users with disabled accounts from connecting even if those users still have valid certificates.

  As the first part of meeting these criteria, what should you do to enable CPPM to determine where accounts are enabled in AD or not?

  A. Add an Endpoint Context Server to the domain controller with actions for querying the domain controller for account status.
  B. Enable OCSP in the EAP-TLS authentication method settings and configure an OCSP override to the domain controller FQDN.
  C. Add a custom attribute for userAccountControl to the filters in the AD authentication source.
  D. Install a Microsoft Active Directory extension in Aruba ClearPass Guest and set up an HTTP authentication source that points to that extension.
  C. Add a custom attribute for userAccountControl to the filters in the AD authentication source.

  ---

  Explanation/Reference:

  According to the ClearPass Policy Manager User Guide1, userAccountControl is a custom attribute in Active Directory that contains a set of flags that define the properties and behavior of user accounts. One of these flags is ACCOUNTDISABLE, which indicates whether the account is disabled or not. By adding this attribute to the filters in the AD authentication source, CPPM can retrieve this attribute for each user and use it as a condition in the enforcement policies to prevent users with disabled accounts from connecting even if they have valid certificates. Therefore, option C is the correct answer.