HP HP Certifications HPE6-A07 Questions & Answers

• Question 51:

  Which statement most accurately describes how users with Active Directory credentials authenticate with ClearPass when Active Directory is used as an authentication source for an 802.1x service in ClearPass?

  A. A Kerberos request is sent from the Network Access Device to ClearPass which initiates a RADUIS request to the AD server.

  B. A RADIUS request is sent from the Network Access Device to the AD server which communicates with ClearPass.

  C. An LDAP request is sent from the Network Access Device to the AD server which communicates with ClearPass.

  D. An LDAP request is sent from the Network Access Device to ClearPass which initiates a RADIUS request to the AD server.

  E. A RADIUS request is sent from the Network Access Device to the ClearPass which communicates with the AD server.

  Correct Answer: C

  Reference http://www.arubanetworks.com/techdocs/ClearPass/Aruba_DeployGd_HTML/Content/3% 20Active%20Directory/AD_auth_source_adding.htm

• Question 52:

  What is Radius CoA used for?

  A. to validate a host MAC against a white and a black list

  B. to force the client to re-authenticate upon roaming to a new controller

  C. to authenticate users or devices before granting them access to a network

  D. to transmit messages to the NAD/NAS to modify a user's session status

  E. to apply firewall policies based on authentication credentials

  Correct Answer: D

• Question 53:

  

  Refer to the exhibit. A user connects to an Aruba Access Point wireless SSID named "secure-corporate" and performs an 802.1X authentication with ClearPass as the authentication server.

  Based on this service configuration, which service will be triggered?

  A. pod8-mac auth

  B. No service will be triggered

  C. pod8wireless

  D. [Policy Manager Admin Network Service]

  E. pod8wired

  Correct Answer: A

• Question 54:

  A ClearPass deployment needs to be designed to determine whether a user authenticating is an HR department employee in the Active Directory Server and whether the user's device is healthy.

  Which policy service components will the network administrator need to use?

  A. Posture, Authentication and Authorization

  B. Posture and Firewall Roles

  C. Posture and Onboard

  D. Authentication and Authorization

  E. Posture, Authentication and Onboarding

  Correct Answer: A

  Reference http://www.arubanetworks.com/techdocs/ClearPass/Aruba_CPPMOnlineHelp/Content/ CPPM_UserGuide/About%20ClearPass/About_ClearPass.htm

• Question 55:

  When enforcement action is used in ClearPass to bounce a client?

  A. Webpage redirect

  B. ACL

  C. VLAN attribute

  D. RADIUS VSA

  E. RADIUS CoA

  Correct Answer: E

  In the Profiler tab, change the RADIUS CoA Action to "[Cisco - Bounce-Host-Port]". Make sure your switch is configured for this.

  Reference http://community.arubanetworks.com/t5/Security/MAC-Auth-Service-for-AP-s-Printers-Etc/tdp/243252

• Question 56:

  

  Refer to the exhibit. A user has enabled `department' and `memberOf' as roles.

  What is the direct effect of the user's action?

  A. The user's authentication will be rejected if the user does not have an admin user group membership in AD.

  B. The user's memberOf attribute is sent back to the controller as a firewall role.

  C. The user's department and group membership will be seen in the Access tracker roles section.

  D. The user's authentication will be rejected if the user does not have a department attribute in AD.

  E. The user's department is sent back to the controller as a firewall role.

  Correct Answer: A

• Question 57:

  When Active Directory is added as an authentication source, what should the format be for the Active Directory bin DN?

  A. admin.domain.com

  B. domain.com\admin

  C. domain.com

  D. [email protected]

  E. admin\domain.com

  Correct Answer: D

  For Active Directory, the bind DN can also be in the administrator@domain format (for example, [email protected]).

  Reference http://www.arubanetworks.com/techdocs/ClearPass/Aruba_CPPMOnlineHelp/Content/ CPPM_UserGuide/Auth/AuthSource_GenericLDAP.htm

• Question 58:

  What happens when a client successfully authenticates but does not match any Enforcement Policy rules?

  A. no role is applied to the device

  B. logon profile is applied to the device

  C. default Enforcement profile is applied

  D. guest rule is applied to the device

  E. default rule is applied to the device

  Correct Answer: C

  The first time a device connects, it's allowed on in a limited state (session timeout is a low value and DHCP is allowed) because it doesn't match any Enforcement policy rules based on Endpoint Category. The default enforcement profile is used.

  Reference: http://community.arubanetworks.com/t5/Security/MAC-Auth-Service-for-AP-s-Printers-Etc/tdp/243252

• Question 59:

  Which licenses are included in the built-in starter kit for ClearPass?

  A. 10 ClearPass Guest licenses, 10 ClearPass OnGuard licenses and 10 ClearPass Onboard licenses

  B. 10 ClearPass Enterprise licenses

  C. 25 ClearPass Policy Manager licenses

  D. 25 ClearPass Profiler licenses

  E. 25 ClearPass Enterprise licenses

  Correct Answer: E