Free Aruba Certified ClearPass Expert Written Exam HPE6-A81 Exam Practice Test

The customer has a 19.940 loT devices connected to the network and would like to use Allow All Mac Auth to authenticate the users and enforce the action based on the condition defined with the fingerprint details of the device. Which Authorization source would you use to decide the access of the devices?

• Clear Pass Profiler Database
  
• Endpoint Database
  
• Local User Database
  
• Guest Device Database
  

What is used to validate the EAP Certificate? (Select two.)

• Key usage
  
• Date
  
• Server Identity
  
• SAN entries
  
• Common Name
  

The customer would like to add a default common self-registration sponsor email under the initial value on all the ten self-registration pages created for different locations except for the guest registration page created for Sunnyvale location to use a different sponsor email in initial value. Under self-registration form fields, you have 'Edit' and 'Edit Base Field'Which edit options will you choose to make minimal configuration changes to implement the customer's requirement? (Select two)

• Update the common sponsor email by clicking the 'Edit' option of the sponsor email form field on the one of the self-registration register form page
  
• Update the sponsor email by clicking on both 'Edit' and 'Edit Base Field' options of the sponsor_email filed on the Sunnyvale register page
  
• Update the specific sponsor email by clicking on 'Edit Base Field' option of the sponsor_email form filed on the Sunnyvale location register form page
  
• Update the common sponsor email by clicking the 'Edit Base Field' option of the sponsor_email form field on the one of the self-registration form page
  
• Update the specific sponsor email by clicking on the 'Edit' option of the sponsor_email form filed on the Sunnyvale self-registration register form page
  

A customer has two different geographical sites deployed with two ClearPass servers in each site. Site A has the Publisher (CPPM1) and a subscriber (CPPM2) and Site B has two subscribers (CPPM3 S CPPM4) All wired and wireless authentication requests from the respective sites are handled by respective CPPMs deployed in the sites When both the CPPM servers in Site B are lost, the authentications from Site B is handled by Site A subscriber (CPPM2). To control the Multi-Master Cache flush and reduce the amount of inter-site traffic, the customer also created a new Policy Manager Zone (Zone1) The Site B CPPM3 & CPPM4 are part of Zone! and Site A CPPM2 is also mapped to Zone1 as it will act as the backup RADIUS server for Site B The corporate laptops are installed with Persistent agent to run the OnGuard check and the OnGuard settings are also mapped to the Zones The Site A corporate user subnets are mapped to default zone and the Site 6 corporate user subnets are mapped to Zone1. The customer has the following issue in the setup: The corporate clients from Site A authenticating against the CPPM2 as their Primary RADIUS server assigns Quarantine enforcement profile even though the user s health status is Healthy.What is the cause of this issue?

• Multi-master cache also contains the roles and posture of the associated and unassociated clients and is shared with all members part of that Policy Manager Zone. CPPM2 belongs to Zone1 and the OnGuard setting for Site A is part of the default zone and the system health validation information is sent to one of the nodes that are part of its home zone As Posture cache for Site A hi not available with CPPMZ. it fails to apply the enforcement profile based on correct health status.
  
• Multi-master cache also contains the roles and posture of the connected clients and is shared only with the members part of that Policy Manager Zone. CPPM2 belongs to Zone1 and the OnGuard setting for Site A is part of the default zone and the OnGuard system health validation information is sent to one of the nodes that are part of its home zone only. As Posture cache for Site A is not available with CPPM2. it fails to apply the enforcement profile based on correct health status.
  
• Multi-master cache also contains the roles and posture of the connected clients and is shared across all members part of the cluster. The OnGuard setting for Site A is part of only the default zone and the system health validation information is sent to one of the nodes that are part of its home zone only As the OnGuard setting of the Site A corporate user subset is not mapped with default as well as Zone1. CPPM2 fails to apply the enforcement profile based on correct health status.
  
• Multi-master cache also contains the roles and posture of the connected clients and is shared across all members part of the cluster. The OnGuard setting for Site A is part of only the default zone and the OnGuard system health validation information is sent to one of the nodes that is part of its home zone only. As the CPPM2 is also not mapped to the default zone as well as Zone1, CPPM2 fails to apply the enforcement profile based on correct health status.
  

A customer would like to allow only the AD users with the 'Manager' title from the 'HO' location to Onboard their personal devices. Any other AD users should not be authorized to pass beyond the initial device provisioning page. Which Onboard service will you use to implement this requirement?

• Onboard Authorization service
  
• Onboard Pre-Auth service
  
• Onboard Provisioning service
  
• Onboard CP login service
  

Your customer has read about a feature in OnGuard for OnGuard Persistent Agent and Agentless OnGuard that can display a new Posture Results web page to notify that and users with posture results for unhealthy clients after the health check is done. Where do you configure this option?

• Policy Manager > Configuration > Enforcement > Profiles > Add a new profiles with Agent Enforcement as the template, and on the Attributes tab add the new Show Posture Results in Guest Page attribute and set the value for the attribute to true.
  
• Policy Manager > Configuration > Enforcement > Profiles > Add new profile with Aruba Radius Enforcement as the template, and on the Attributes tab add the Aruba-User-Role configured with the captive portal profile mapped with default Posture Check web page URL.
  
• Policy Manager > Configuration > Services > Edit the Web-base Health Check Only service, and on the posture tab under Remediation URL add the default Quarantined Blocked web page URL and complete the service configuration by hitting save.
  
• Policy Manager > Configuration > Services > Edit the Web-base Health Check Only service, and on the posture tab enable the checkbox for the new option Show Posture Results in Guest Page and complete the service configuration by hitting save.
  

When building an SNMP-based enforcement profile what option can you assign to the user as actions? (Select three).

• Enforce a VLAN ID for the client
  
• Set a session timeout for the client
  
• Enforce Firewall policies
  
• Send captive portal web re-direct URL
  
• ClearPass Downloadable Role
  
• Reset the connection after the settings has been pushed
  

Which statements are true about that integration between ClearPass Policy Manager and ClearPass Device Insight? (Select two)

• Policy Manager stops using ClearPass Profiler for fingerprinting and uses Device Insight Analyzer instead for endpoint in-depth data analysis.
  
• ClearPass Device Insight updates ClearPass Policy Manager every 60 minutes if it detects a change in device classification like device spoofing.
  
• To provide enhanced profiling and reporting. additional configuration is required to transmit data in both directions between CPPM and Device Insight.
  
• When Device Insight integration mode is enabled. you can still use Update Fingerprint button to Update Endpoints at Configuration > Identity > Endpoints
  
• An attribute named Device Insight Tags art added to the Endpoints that art available to use in service, role-mapping, and enforcement policy Rules
  

You have configured a Guest SSIO with Captive-portaI Web Authentication and MAC authentication. The MAC caching expiry time set to 12 hours and the Guest Account expiration time is set to 8 hours. What will happen if the guest were to disconnect from the SSID and re-connect 9 hours later?

• The client will successfully pass the MAC authentication but still be redirected to captive portal page.
  
• The client will fail the MAC authentication and be denied access to the Guest SSIO.
  
• The client will successfully pass the mac authentication until the mac caching time expires.
  
• The client will fail to get the MAC Caching role and will be redirected to the captive portal login page
  

Under OnBoard Management and Control, which option will deny the user from re-enrolling one of his devices with Onboard?View by Certificate >> Click on the device >> Delete certificate

• Delete this client certificate View by Dev >> Click on the device
  
• Manage Access >> Deny access to this device View by Certificate
  
• Click on the device >> Revoke certificate >> Revoke this client certificate
  
• View by Username >> Click on the user >> Delete Actions >> Delete all devices