HP HP Certifications HPE6-A68 Questions & Answers

• Question 91:

  Refer to the exhibit.

  

  Based on the Enforcement Policy configuration shown, when a user with Role Remote Worker connects to the network and the posture token assigned is quarantine, which Enforcement Profile will be applied?

  A. RestrictedACL

  B. Remote Employee ACL

  C. [Deny Access Profile]

  D. EMPLOYEE_VLAN

  E. HR VLAN

  Correct Answer: B

  The first rule will match, and the Remote Employee ACL will be used.

• Question 92:

  A customer with an Aruba Controller wants it to work with ClearPass Guest. How should the customer configure ClearPass as an authentication server in the controller so that guests are able to authenticate successfully?

  A. Add ClearPass as a RADIUS CoA server.

  B. Add ClearPass as a RADIUS authentication server.

  C. Add ClearPass as a TACACS+ authentication server.

  D. Add ClearPass as an HTTPS authentication server.

  Correct Answer: B

  5. Configuring the Aruba Controller

  5.1 Add Clearpass as RADIUS Server

  Navigate to Configuration > SECURITY > Authentication > Servers Click on RADIUS Server and enter the Name of your Clearpass Server: myClearpass Click Add Click on myClearpass in the Server List Etc.

  References: https://community.arubanetworks.com/t5/Security/Step-by-Step-Controller-CPPM-6-5-Captive-Portal-authentication/td-p/229740

• Question 93:

  Refer to the exhibit.

  

  Based on the information shown, what is the purpose of using [Time Source] for authorization?

  A. to check how long it has been since the last login authentication

  B. to check whether the guest account expired

  C. to check whether the MAC address is in the MAC Caching repository

  D. to check whether the MAC address status is known in the endpoints table

  E. to check whether the MAC address status is unknown in the endpoints table

  Correct Answer: D

• Question 94:

  Refer to the exhibit.

  

  An Enforcement Profile has been created in the Policy Manager as shown. Which action will ClearPass take based on this Enforcement Profile?

  A. ClearPass will count down 600 seconds and send a RADIUS CoA message to the user to end the user's session after this time is up.

  B. ClearPass will send the Session-Timeout attribute in the RADIUS Access-Accept packet to the NAD and the NAD will end the user's session after 600 seconds.

  C. ClearPass will count down 600 seconds and send a RADIUS CoA message to the NAD to end the user's session after this time is up.

  D. ClearPass will send the Session-Timeout attribute in the RADIUS Access-Request packet to the NAD and the NAD will end the user's session after 600 seconds.

  E. ClearPass will send the Session-Timeout attribute in the RADIUS Access-Accept packet to the User and the user's session will be terminated after 600 seconds.

  Correct Answer: E

  Session Timeout (in seconds) - Configure the agent session timeout interval to re-evaluate the system health again. OnGuard triggers auto-remediation using this value to enable or disable AV-RTP status check on endpoint. Agent re-

  authentication is determined based on session-time out value. You can specify the session timeout interval from 60 ?600 seconds. Setting the lower value for session timeout interval results numerous authentication requests in Access

  Tracker page. The default value is 0.

  References:

  http://www.arubanetworks.com/techdocs/ClearPass/Aruba_CPPMOnlineHelp/Content/CPPM_User Guide/Enforce/EPAgent_Enforcement.htm

• Question 95:

  A hotel chain deployed ClearPass Guest. When hotel guests connect to the Guest SSID, launch a web browser and enter the address www.google.com, they are unable to immediately see the web login page. What are the likely causes of this? (Select two.)

  A. The ClearPass server has a trusted server certificate issued by Verisign.

  B. The ClearPass server has an untrusted server certificate issued by the internal Microsoft Certificate server.

  C. The ClearPass server does not recognize the client's certificate.

  D. The DNS server is not replying with an IP address for www.google.com.

  Correct Answer: BD

  You would need a publicly signed certificate.

  References: http://community.arubanetworks.com/t5/Security/Clearpass-Guest-certificate-error-for-guest-visitors/td-p/221992

• Question 96:

  Refer to the exhibit.

  

  Based on the information shown, which field in the Captive Portal Authentication profile should be changed so that guest users are redirected to a page on ClearPass when they connect to the Guest SSID?

  A. both Login and Welcome Page

  B. Default Role

  C. Welcome Page

  D. Default Guest Role

  E. Login Page

  Correct Answer: E

  The Login page is the URL of the page that appears for the user logon. This can be set to any URL. The Welcome page is the URL of the page that appears after logon and before redirection to the web URL. This can be set to any URL.

  References:

  http://www.arubanetworks.com/techdocs/ArubaOS_63_Web_Help/Content/ArubaFrameStyles/Cap tive_Portal/Captive_Portal_Authentic.htm

• Question 97:

  Refer to the exhibit.

  

  Based on the configuration of the create_user form shown, which statement accurately describes the status?

  A. The email field will be visible to guest users when they access the web login page.

  B. The visitor_company field will be visible to operators creating the account.

  C. The visitor_company field will be visible to the guest users when they access the web login page.

  D. The visitor_phone field will be visible to the guest users in the web login page.

  E. The visitor_phone field will be visible to operators creating the account.

  Correct Answer: A

  References: https://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/expire-timezone-field-is-not-showing-up-on-the-create-user-form/ta-p/250230

• Question 98:

  Refer to the exhibit.

  

  A user logged in to the Self-Service Portal as shown. What do the traffic received and sent statistics present?

  A. These show the total amount of traffic the guest transmitted, as seen through RADIUS CoA packets from the NAD to ClearPass.

  B. These show the total amount of traffic the NAD transmitted to ClearPass, as seen through RADIUS accounting messages from the NAD to ClearPass.

  C. These show the total amount of traffic the guest transmitted after account expiration, as seen through RADIUS accounting messages sent from the NAD to ClearPass.

  D. These show the total amount of traffic the guest transmitted, as seen through RADIUS CoA packets from the client to ClearPass.

  E. These show the total amount of traffic the guest transmitted, as seen through RADIUS accounting messages sent from the NAD to ClearPass.

  Correct Answer: E

• Question 99:

  Refer to the exhibit.

  

  Based on the guest Self-Registration with Sponsor Approval workflow shown, at which stage is an email request sent to the sponsor?

  A. after `Guest Role (7)'

  B. after `Login Message page (5)'

  C. after `Submit form (3)'

  D. after `Automated NAS login (6)'

  E. after `Redirects (1)'

  Correct Answer: C

  There's the Self Service part of provisioning one's information. Then the sponsor/operator part to confirm that guest is valid. Then the enablement via the sponsor/operator clicking 'confirm'.

  

  References: https://community.arubanetworks.com/t5/Security/Guest-Captive-Portal-sponsor-approval-architecture/td-p/267625

• Question 100:

  An administrator enabled the Pre-auth check for their guest self-registration. At what stage in the registration process in this check performed?

  A. after the user clicks the login button and after the NAD sends an authentication request

  B. after the user self-registers but before the user logs in

  C. after the user clicks the login button but before the NAD sends an authentication request

  D. when a user is re-authenticating to the network

  E. before the user self-registers

  Correct Answer: C

  The Onboard template is designed for configuration that allows to perform checks before allowing Onboard provisioning for Bring Your Own Device (BYOD) use-cases. This service creates an Onboard Pre-Auth service to check the user's credentials before starting the device provisioning process. This also creates an authorization service that checks whether a user's device can be provisioned using Onboard.