HPE6-A68 Aruba Certified ClearPass Professional (ACCP) 6.7 Questions and Answers

The test verifies that a client with username test1 can authenticate using EAP-PEAP.

Role mapping simulation verifies if the remote lab AD has the ClearPass server certificate.

Role mapping simulation verifies that the client certificate is valid during EAP-TLS authentication.

The simulation test result shows the firewall roles assigned to the client by the Aruba Controller.

The roles assigned in the results tab are based on rules matched in the AD Role Mapping Policy.

CP-HW-5k, 2500 ClearPass Enterprise

CP-HW-25k, 4500 ClearPass Enterprise

CP-HW-500, 2500 ClearPass Enterprise

CP-HW-25k, 4000 ClearPass Enterprise

CP-HW-5k, 4500 ClearPass Enterprise

EAP-TLS Authentication will be unaffected

The user can Onboard their device again

A new device certificate will be automatically pushed out to the device

The user cannot Onboard their device again

EAP-TLS Authentication will fail

ClearPass will count down 600 seconds and send a RADIUS CoA message to the user to end the user’s session after this time is up.

ClearPass will send the Session-Timeout attribute in the RADIUS Access-Accept packet to the NAD and the NAD will end the user’s session after 600 seconds.

ClearPass will count down 600 seconds and send a RADIUS CoA message to the NAD to end the user’s session after this time is up.

ClearPass will send the Session-Timeout attribute in the RADIUS Access-Request packet to the NAD and the NAD will end the user’s session after 600 seconds.

ClearPass will send the Session-Timeout attribute in the RADIUS Access-Accept packet to the User and the user’s session will be terminated after 600 seconds.

Endpoints Repository

Client Repository

Local Users Repository

Onboard Devices Repository

Guest User Repository

Guest User Repository and Active Directory server both as authentication sources

Active Directory server as the authentication source, and Guest User Repository as the authorization source

Guest User Repository as the authentication source, and Guest User Repository and Active Directory server as authorization sources

Either the Guest User Repository or Active Directory server should be the single authentication source

Guest User Repository as the authentication source and the Active Directory server as the authorization source

It will send the Session-Timeout attribute in the RADIUS Access-Request packet to the NAD and the NAD will end the user’s session after 600 seconds.

It will send the Session-Timeout attribute in the RADIUS Access-Accept packet to the User and the user’s session will be terminated after 600 seconds.

It will count down 600 seconds and send a RADUIS CoA message to the NAD to end the user’s session after this time is up.

It will count down 600 seconds and send a RADUIUS CoA message to the user to end the user’s session after this time is up.

It will send the session –Timeout attribute in the RADIUS Access-Accept packet to the NAD and the NAD will end the user’s session after 600 seconds.

This Posture Policy can only be applied to an 802.1x wired service not 802.1x wireless.

This Posture Policy checks the health status of devices running Windows, Linux and Mac OS X.

This Posture Policy can use either the persistent or dissolvable Onguard agent to obtain the statement of health.

This Posture Policy checks for presence of a firewall application in Windows devices.

This Posture Policy checks with a Windows NPS server for posture tokens.

The Aruba-Admin-Role on the controller is applies to users using TACACS+ to login to the Policy Manager

To assign different privileges to clients during 802.1X authentication

To assign different privileges to administrators logging into an Aruba NAD

It is used by ClearPass to assign TIPS roles to clients during 802.1X authentication

To assign different privileges to administrators logging into ClearPass

They will connect to Employee_Secure SSID after provisioning.

They will connect to Employee_Secure SSID for provisioning their devices.

They will use WPA2-PSK with AES when connecting to the SSID.

They will connect to secure_emp SSID after provisioning.

They will perform 802.1X authentication when connecting to the SSID.

Static IP addresses are only allowed on the management port.

Configuration of the data port is mandatory.

Configuration on the management port is mandatory.

Configuration of the data port if optional.

Configuration of the management port is optional.

The client is compliant. However, there is an update available to remediate the client to HEALTHY state.

The posture of the client is unknown.

The client is infected and is a threat to other systems in the network.

The client is out of compliance, but has HEALTHY state.

The client is out of compliance.

radius01 was deleted from the list of authentication sources.

The policy service was moved to position number 4.

radius01 was moved to position number 4.

The policy service was moved to position number 3.

raduis01 was added as an authentication source.

all RADIUS authentications from the 10.8.10.100 NAD to ClearPass

all failed RADIUS authentications through ClearPass

only Windows devices that have authenticated through the 10.8.10.100 NAD

all successful RADIUS authentications through ClearPass

all successful RADIUS authentications from the 10.8.10.100 NAD to ClearPass