[Oct-2022] Pass HP HPE6-A81 Tests Engine pdf - All Free Dumps
Aruba Certified ClearPass Expert Written Exam Practice Tests 2022 | Pass HPE6-A81 with confidence!
NEW QUESTION 23
Refer to the exhibit.
You have set up a home lab for ACCX exam preparation with Aruba Clear Pass integrated with Aruba Controller and Instant Access Point Guest Mac Caching functionality is configured only for Aruba Controller's guest SSID and a common Web Login page is configured for both NAD devices You tested and verified the mac caching functionality for a client by connecting it to the Aruba Controller's guest SSID.
What will happen when you disconnect the client from Aruba Controller's guest SSID and connect it to Instant APs guest SSID?
- A. The client does not have to complete any authentication as the re-connection was immediate.
- B. The client will bypass the captive portal authentication by completing the MAC authentication.
- C. The client will be redirected to the captive portal page to complete the web authentication.
- D. The client will fail the mac authentication and will be redirected to the captive portal page.
Answer: B
NEW QUESTION 24
Refer to the exhibit.
The customer configured a guest operator access by creating a custom operator profile and the built-in universal ClearPass profile mapping translation rule. When he tests the setup, he gets authentication failed. Using the streenshots sent by the customer as a reference, what would suggest to the customer to fix the issue?
- A. To correct the case sensitive attribute name in the enforcement profile to admin_privileges
- B. To re-enter the correct username and password for the Active Directory user Mike07.
- C. To map the operator profile name HS_Receptionist in the translation rule value field
- D. To verify if the username Mike07 has the Active Directory Title attribute set as Reception.
Answer: C
NEW QUESTION 25
Refer to the exhibit.
The users connecting to a wireless SSIO "secure-HS-5007" were being processed by an incorrect 802.1 X service created for VIP access and the user gets deny access. The customer has sent you the screenshot to get your support to resolve the issue What changes will you suggest to fix it?
- A. In the HSBuilding 802. IXservice. change the Authentication method for AMCAuth for VIP access and leave it in same position
- B. Delete the HSBuilding 802 IX service, odd VIP access Aruba-Essid-Name as fourth condition to WSBuilding Aruba 802 1X service
- C. To the HS_Building 802.1 X service, add another service rule condition with VIP access Aruba-Essid-Name and leave it in same position
- D. In the HS_Building 802.1X service, remove the service rule condition with Aruba controller location name and leave it in same position
Answer: D
NEW QUESTION 26
Refer to the exhibit.
A customer has configured Onboard in a cluster. After the Primary server's failure, the BYOD devices fail to connect to the network. Which step below is the best starting point when troubleshooting'
- A. Verify the CPPM hostname in OSCP URL under TLS authentication method is updated to localhost instead of primary server's hostname.
- B. Check if a DNS entry is available for the ClearPass hostname in the certificate, resolvable from the DNS server assigned to the client.
- C. Reboot the active ClearPass server and reconnect the client to the SSID by selecting the correct certificate when prompted.
- D. Check EAP certificate on the secondary node is issued by the same common root Certificate Authority (CA).
Answer: A
NEW QUESTION 27
A customer is troubleshooting the OnGuard Client Activity and is looking into the Live Monitoring -> OnGuard Activity section. What is the Status field representing for this client ?
- A. the Client has been successfully profiled
- B. the Client is successful authenticated
- C. the Client is online and sends keep-alive messages
- D. the Client health status is HEALTHY
Answer: A
NEW QUESTION 28
Refer to the exhibit.
When creating a new report, there is in option to send report Notifications by Email Where is the email server configured?
- A. In the ClearPass Policy Manager Messaging Setup under Administration.
- B. In the Insight Reports Interface under Administration on the sidebar menu
- C. In the Insight report on the next screen of the report definition
- D. In the ClearPass Policy Manager Endpoint Context Servers under Administration.
Answer: D
NEW QUESTION 29
A customer has two different geographical sites deployed with two ClearPass servers in each site. Site A has the Publisher (CPPM1) and a subscriber (CPPM2) and Site B has two subscribers (CPPM3 S CPPM4) All wired and wireless authentication requests from the respective sites are handled by respective CPPMs deployed in the sites When both the CPPM servers in Site B are lost, the authentications from Site B is handled by Site A subscriber (CPPM2). To control the Multi-Master Cache flush and reduce the amount of inter-site traffic, the customer also created a new Policy Manager Zone (Zone1) The Site B CPPM3 & CPPM4 are part of Zone! and Site A CPPM2 is also mapped to Zone1 as it will act as the backup RADIUS server for Site B The corporate laptops are installed with Persistent agent to run the OnGuard check and the OnGuard settings are also mapped to the Zones The Site A corporate user subnets are mapped to default zone and the Site 6 corporate user subnets are mapped to Zone1. The customer has the following issue in the setup: The corporate clients from Site A authenticating against the CPPM2 as their Primary RADIUS server assigns Quarantine enforcement profile even though the user s health status is Healthy.
What is the cause of this issue?
- A. Multi-master cache also contains the roles and posture of the associated and unassociated clients and is shared with all members part of that Policy Manager Zone. CPPM2 belongs to Zone1 and the OnGuard setting for Site A is part of the default zone and the system health validation information is sent to one of the nodes that are part of its home zone As Posture cache for Site A hi not available with CPPMZ. it fails to apply the enforcement profile based on correct health status.
- B. Multi-master cache also contains the roles and posture of the connected clients and is shared only with the members part of that Policy Manager Zone. CPPM2 belongs to Zone1 and the OnGuard setting for Site A is part of the default zone and the OnGuard system health validation information is sent to one of the nodes that are part of its home zone only. As Posture cache for Site A is not available with CPPM2. it fails to apply the enforcement profile based on correct health status.
- C. Multi-master cache also contains the roles and posture of the connected clients and is shared across all members part of the cluster. The OnGuard setting for Site A is part of only the default zone and the OnGuard system health validation information is sent to one of the nodes that is part of its home zone only. As the CPPM2 is also not mapped to the default zone as well as Zone1, CPPM2 fails to apply the enforcement profile based on correct health status.
- D. Multi-master cache also contains the roles and posture of the connected clients and is shared across all members part of the cluster. The OnGuard setting for Site A is part of only the default zone and the system health validation information is sent to one of the nodes that are part of its home zone only As the OnGuard setting of the Site A corporate user subset is not mapped with default as well as Zone1. CPPM2 fails to apply the enforcement profile based on correct health status.
Answer: D
NEW QUESTION 30
Refer to the exhibit.
What enforcement prof lit will be assigned to the Windows 10 MDH enabled devices if it completes user authentication and is already profiled by ClearPess?
- A. Cisco Full Access VLAN
- B. Cisco Redirect URL - Service Unavailable
- C. Cisco Redirect ACL for profiling
- D. Default - Deny Access Profile
Answer: D
NEW QUESTION 31
You have configured a Guest SSIO with Captive-portaI Web Authentication and MAC authentication. The MAC caching expiry time set to 12 hours and the Guest Account expiration time is set to 8 hours. What will happen if the guest were to disconnect from the SSID and re-connect 9 hours later?
- A. The client will successfully pass the mac authentication until the mac caching time expires.
- B. The client will successfully pass the MAC authentication but still be redirected to captive portal page.
- C. The client will fail to get the MAC Caching role and will be redirected to the captive portal login page
- D. The client will fail the MAC authentication and be denied access to the Guest SSIO.
Answer: B
NEW QUESTION 32
A customer has multiple Aruba Controllers integrated with ClearPass for guest access using a controller-initialed login method. The customer is aware that a public CA-signed captive portal certificate is required in Aruba controllers for controller-initiated workflows. The customer has purchased unique public CA-signed server certificates for each controller.
What configuration steps would you suggest to the customer to complete the deployment? (Select three.)
- A. From the Aruba controller, enable the option "Add switch IP address in the redirection URL" under the respective L3 Authentication profile mapped in the initial role
- B. Edit the HTML header in the weblogin/ self-registration register page with a script to match the controllers IP and captive portal certificate CN names respectively.
- C. From the weblogin/ self-registration page Login form settings, enable the check box for "The controller will send the IP to submit credentials" under Dynamic address.
- D. From the Aruba controller, enable the option 'Add switch ip address in the redirection URL' under the respective guest AAA profile mapped in the VAP profile.
- E. From the weblogin/ self-registration page NAS Vendor settings, enable the check box for "The controller will send the IP to submit credentials" under Dynamic address.
- F. Add all the controller IP address and its certificate common names in the DNS server's Forward Lookup Zones and Reverse Lookup Zones to resolve queries from client.
Answer: C,D,E
NEW QUESTION 33
You have configured a factory default Aruba controller with Clear Pass for guest access and the NAS vendor settings - Address field in the guest weblogin page is configured with Aruba controller's default self-signed certificate common name "securelogin.arubanetworks.com" that the client will use to submit the authentication request.
What happens when the client sends a DNS request to securelogin aruba networks com?
- A. The controller will intercept the ONS request sent to its HTTPS certificate common name and return its own IP address.
- B. Address field in the web login vendor settings should be set to IP address of the controller instead of certificate CN name.
- C. The controller will pass the request to the DNS server and server returns the IP of the controller from the DNS records.
- D. Client does not send the DNS request, the ClearPass resolves the hostname in the NAS vendor settings Address field.
Answer: B
NEW QUESTION 34
Refer to the exhibit.
A customer has configured Onboard in his lab ClearPass server and Windows devices work as expected but cannot get the Apple iOS devices to Onboard successfully Where would you look to troubleshoot the issue? {Select two)
- A. Check if the ClearPass HTTPS server certificate installed in the server is issued by a trusted commercial certificate authority.
- B. Check if a DNS entry is available for the ClearPass hostname in the certificate, resolvable from the DNS server assigned to the client.
- C. Check if the customer has installed the same internal PKI signed RADIUS server certificate as the HTTPS server certificate.
- D. Check if the customer installed the internal PKI Root certificate presented by the ClearPass during the provisioning process.
- E. Check if the customer has installed a custom HTTPS certificate for iOS and another internal PKI HTTPS certificate for other devices.
Answer: A,B
NEW QUESTION 35
What is used to validate the EAP Certificate? (Select two.)
- A. SAN entries
- B. Server Identity
- C. Date
- D. Key usage
- E. Common Name
Answer: A,D
NEW QUESTION 36
A customer is troubleshooting a user that has complained about randomly having issues connecting the network with EAP PEAP using the Corporate Laptop. The initial checks are showing a number of authentication failures but no sign of issues with the ClearPass server or AD.
What can the Customer do to monitor this user Authentication trend closely over the next few days?
- A. configure a Report using Radius Failed Authentication template and schedule it to run every 5 mins
- B. add to ClearPass Insight Dashboard the Authentication Status widget for this specific user
- C. add the user name in the Insight/Alert/Watchlitst and get the authentication failures notifications within 30 seconds
- D. configure an Alert using Failed Authentication template with Threshold 1. Interval 5 mins
Answer: C
NEW QUESTION 37
Refer to the exhibit.
You configured the Wired MAC - Auth service enforcement conditions with the Endpoint profiling data When mac-auth based clients connect to the network, ClearPass assigns Deny access profile. The customer has sent you the above screenshots How would you resolve the issue?
- A. Create a new condition in last position with Type and operator as Tips:Role EQUALS [User Authenticated] with action as Allow access profile permitting any services and any ports to do profiling.
- B. Change the Rules evaluation algorithm in the Enforcement policy of HPE ArubaOS Mac auth policy as "select all matches" and add the CoA action as HPE Bounce switch port in the profiler tab.
- C. Create a new condition in first position with Type and operator as Authorization (Endpoint Repository]:Category NOT_EXISTS with action as Limited access profile allowing only DHCP service.
- D. Create a new condition in the first position with Type and operator as Authorization [Endpoint Repository] Category NOT_EXISTS with action as Limited access profile and ArubaOS wireless terminate session
Answer: B
NEW QUESTION 38
Refer to the exhibit.
You configured a new Wireless 802.1 X service for a Cisco WLC broadcasting the secure-AOM-5007 SSID. The client fails to connect to the SSIO. Using the screenshots as a reference, how would you fix this issue?
- A. Make sure that the Network Devices entry for the Cisco WLC has a vendor setting of "Airespace"
- B. Remove the service condition Radius:IETF Service-Type BEL0NGS_T0 Login-User (1), 2.8
- C. Change the service condition to Radius:lETF Calling-Station-Id EQUALS Secure-ADM-5007
- D. Update the service condition Radws:IETF Called-Stat ion-Id CONTAINS secure-AOM-5007
Answer: D
NEW QUESTION 39
Refer to the exhibit.
A customer has just configured a Posture Policy and the T 2 -Health check Service. Next they installed the OnGuard Agent on a test client connected to the Secure_Employee SSID. When they check Access Tracker they see many WEBAUTH requests are being triggered What could be the reason'
- A. OnGuard Web-Based Health Check interval has been configured to three minutes.
- B. TCP port 6658 is not allowed between the client and the ClearPass server.
- C. The OnGuard Agent trigger the events based on changing the Health Status.
- D. The OnGuard Agent is connecting to the Data Port interface on ClearPass.
Answer: A
NEW QUESTION 40
A corporate Clear Pass Cluster with two servers located at a single site, has both Management and Data port IP addresses configured. The Management port IPs art in the DataCenter networks subnet, while the Data port IPs are in the DMZ. What is the difference between using one Virtual IP for the AAA traffic versus sending AAA requests to the physical IPs for each server' (Select two.)
- A. The Individual IPs can provide failover and load balancing.
- B. One Virtual IP can be used together with the individual server IPs for load balancing.
- C. The failover can be accomplished only by using Virtual IP
- D. By using the Virtual IP, the failover wait time is faster than using individual server IPs.
- E. Using the one Virtual IP can provide failover.
Answer: D,E
NEW QUESTION 41
Refer to the exhibit.
A customer it troubleshooting a client not getting the SHV posture updated and the OnGuard agent shows the Health Status Not Known. What could the user do to update the health status?
- A. connect using an interface that is configured as Managed Interface
- B. modify the agent.conf file and add the WIRED interface to it
- C. change the Policy Manager Zone mapping and add the WIRED interface range
- D. reinstall the OnGuard agent from the Wired interface
Answer: B
NEW QUESTION 42
The customer has a 19.940 loT devices connected to the network and would like to use Allow All Mac Auth to authenticate the users and enforce the action based on the condition defined with the fingerprint details of the device. Which Authorization source would you use to decide the access of the devices?
- A. Local User Database
- B. Endpoint Database
- C. Clear Pass Profiler Database
- D. Guest Device Database
Answer: D
NEW QUESTION 43
What configuration steps should you follow to add terms and conditions page on Guest seIf-registration for CPPM? (Select two).
- A. Edit the accept_terms form field in receipt page and change HTML section by pointing the hyper link to the HTML file uploaded m Guest Manager
- B. Create an HTML page with custom terms and condition and upload it to public files under Clearpass Guest -> configuration -> content manager
- C. Edit the creetoraccepiterms form field in register page and change HTML section by pointing the hyperlink to the HTML file uploaded
- D. Edit the creatoracceprterms form field in receipt page and change HTML section by pointing the hyperlink to the HTML file uploaded
- E. Create an HTML page with custom terms and condition and upload it to private files under Clearpass Guest -> configuration -> content manager
Answer: B,D
NEW QUESTION 44
Refer to the exhibit.
What enforcement profile will be assigned to a client who has successfully completed the user and machine authentication with UNKNOWN posture token?
- A. Deny Access Profile
- B. Redirect to Aruba Quarantine Profile
- C. Redirect to Aruba Dissolvable_page Profile
- D. Redirect to Aruba OnBoard Portal
Answer: C
NEW QUESTION 45
Under OnBoard Management and Control, which option will deny the user from re-enrolling one of his devices with Onboard?
View by Certificate >> Click on the device >> Delete certificate
- A. Delete this client certificate View by Dev >> Click on the device
- B. Click on the device >> Revoke certificate >> Revoke this client certificate
- C. Manage Access >> Deny access to this device View by Certificate
- D. View by Username >> Click on the user >> Delete Actions >> Delete all devices
Answer: B
NEW QUESTION 46
Refer to the exhibit.
A year ago. your customer deployed an Aruba ClearPass Policy Manager Server for a Guest SSID hosted in an IAP Cluster The customer just created a new Web Login Page for the Guest SSiD Even though the previous Web Login page worked test with the new Web Login Page are failing and the customer has forwarded you the above screenshots.
What recommendation would you give the customer to fix the issue?
- A. The customer should reset the password for the username accxCdlexam.com using Guest Manage Accounts.
- B. The Address filed under the WebLogin Vendor settings is not configured correctly. It should be set to instant, Aruba networks com,
- C. The service type configured is not correct. The Guest authentication should be an Application authentication type of service.
- D. The WebLogin Pre-Auth Check is set to Aruba Application Authentication which requires a separate application service on the policy manager
Answer: B
NEW QUESTION 47
......
Online Exam Practice Tests with detailed explanations!: https://www.troytecdumps.com/HPE6-A81-troytec-exam-dumps.html