HP HP Certifications HPE6-A81 Questions & Answers

• Question 41:

  You are deploying ClearPass Policy Manager with Guest functionality for a customer with multiple Aruba Networks Mobility Controllers The customer wants to avoid SSL errors during guest access but due to company security policy cannot use a wildcard certificate on ClearPass or the Controllers. What is the most efficient way to configure the customers guest solution? (Select two.)

  A. Build multiple Web Login pages with vendor settings configured for each controller

  B. Install the same public certificate on all Controllers with the common name "controller {company domain}"

  C. Build one Web Login page with vendor settings for controller {company domain)

  D. Install multiple public certificates with a different Common Name on each controller

  Correct Answer: AB

• Question 42:

  A customer is complaining that some of the devices, in their manufacturing network, are not getting profiled while other loT devices from the same subnet have been correctly profiled. The network switches have been configured for DHCP IP helpers and IF-MAP has been configured on the Aruba Controllers. What can the customer do to discover those devices as well? (Select two.)

  A. Update the Fingerprints Dictionary to the latest in case new devices have been added.

  B. Open a TAC case to help you troubleshoot the DHCP device profile functionality.

  C. Add the ClearPass Server IP as an IP helper address on the default gateway as well.

  D. Allow time for IF-MAP service on the controller to discover the new devices as well.

  E. Manually create a new device fingerprint for the devices that are not being profiled.

  Correct Answer: DE

• Question 43:

  Refer to the exhibit:

  

  The customer complains that the user shown cannot log into the ClearPass Server as an administrator using the [Policy Manager Admin Network Login Service]. What could be the reason for this?

  A. The user might be used for a TACACS authentication

  B. The account created does not fit this purpose.

  C. The mapping on the role should be changed to [RADIUS Super Admin]

  D. The local user authentication might be disabled

  Correct Answer: B

• Question 44:

  A customer is planning to implement machine and user authentication on infrastructure with one Aruba

  Controller and a single ClearPass Server.

  What should the customer consider while designing this solution? (Select three.)

  A. The Windows User must log off, restart or disconnect their machine to initiate a machine authentication before the cache expires.

  B. The machine authentication status is written in the Multi-master cache on the ClearPass Server for 24 hrs.

  C. Onboard must be used to install the Certificates on the personal devices to do the user and machine authentication.

  D. The Customer should enable Multi-Master Cache Survivability as the Aruba Controller will not cache the machine state.

  E. Machine Authentication only uses EAP TLS, as such a PKI infrastructure should be in place for machine authentication.

  F. The customer does not need to worry about Multi-Master Cache Survivability because the Controller will also cache the machine state.

  Correct Answer: BCE

• Question 45:

  Which statements are true about Aruba downloadable user roles? (Select three.)

  A. Can be applied only on ports or WLAN users authenticated by ClearPass.

  B. Aruba downloadable user role are universally available across the environment

  C. Aruba downloadable user role is a built in enforcement template in ClearPass

  D. Downloadable role names must be defined in Aruba switch or controller

  E. Can use these roles for other authentication methods not involving ClearPass

  F. Administering downloadable user roles can be difficult for a large enterprise

  Correct Answer: ADE

• Question 46:

  How does the RadSec improve the RADIUS message exchange? (Select two.)

  A. It can be used on an unsecured network or the Internet.

  B. It builds a TTLS tunnel between the NAD and ClearPass.

  C. Only the NAD needs to trust the ClearPass Certificate.

  D. It encrypts the entire RADIUS message.

  E. It uses UDP to exchange the radius packets.

  Correct Answer: DE

• Question 47:

  A customer has created a Guest Sett-Registration page that they would like to use it as `template' for all the new pages that are going to be created from now on. Their goal is to ensure that the header and footer on every page are the same, and any edits made to them are automatically reflected on every Self-Registration Page. What should be configured in order to accomplish this request?

  A. Save the "template" page as Master Self-Registration page

  B. Create child pages when creating new Self-Registration pages and select the "template" as Parent

  C. Save this "template" page as a new Skin to be used on other Self-Registration pages

  D. Copy the "template" page and edit it each time a new Self-Registration Page is needed

  Correct Answer: C

• Question 48:

  When is it recommended to use a certificate with multiple entries on the Subject Alternative Name?

  A. The ClearPass servers are placed in different OnGuard zones to allow the client agent to send SHV updates.

  B. Using the same certificate to Onboard clients and the Guest Captive Portal on a single ClearPass server.

  C. The primary authentication server Is not available to authenticate the users.

  D. The ClearPass server will be hosting captive portal pages for multiple FQDN entries

  Correct Answer: A

• Question 49:

  Refer to the Exhibit:

  

  

  A customer wants to integrate posture validation into an Aruba Wireless 802.1X authentication service

  During testing, the client connects to the Aruba Employee Secure SSID and is redirected to the Captive Portal page where the user can download the OnGuard Agent After the Agent is installed, the client receives the Healthy token the client remains connected to the Captive Portal page ClearPass is assigning the endpoint the following roles: T2-Staff-User. (Machine Authenticated! and T2-SOL-Device. What could cause this behavior?

  A. The Enforcement Policy conditions for rule 1 are not configured correctly.

  B. Used Cached Results: has not been enabled In the Aruba 802.1X Wireless Service

  C. RFC-3576 Is not configured correctly on the Aruba Controller and does not update the role.

  D. The Enforcement Profile should bounce the connection instead of a Terminate session

  Correct Answer: B

• Question 50:

  Refer to the exhibit: You have configured Onboard but me customer could not onboard one of his devices and has sent you the above screenshots. How could you resolve the issue?

  

  A. Instruct the user to delete the profile on one of their other BYOD devices.

  B. Instruct the user to run the Quick connect application in Sponsor Mode.

  C. Increase the maximum number of devices allowed by the individual user account.

  D. Increase the maximum number of devices that all users can provision to 3.

  Correct Answer: D