Which checks are made with Onguard posture evaluation in ClearPass? (Select three.)

Peer-to-peer application checks

Why is a terminate session enforcement profile used during posture checks with 802.1x authentication?

To send a RADIUS CoA message from the ClearPass server to the client

To disconnect the user for 30 seconds when they are in an unhealthy posture state

To blacklist the user when they are in an unhealthy posture state

To force the user to re-authenticate and run through the service flow again

To remediate the client applications and firewall do that updates can be installed

A client's authentication is failing and there are no entries in the ClearPass Access tracker.What is a possible reason for the authentication failure?

The shared secret between the NAD and ClearPass does not match.

The client used a wrong password.

The shared secret between the NAD and ClearPass does not match.

The user's certificate is invalid.

The user is not found in the database.

Refer to the exhibit. Based on the information shown on a client's laptop, what will happen next?

the NAD will send an authentication request to ClearPass.

The web login page will be displayed.

The client will send a NAS authentication request to ClearPass.

ClearPass will send a NAS authentication request to the NAD.

the NAD will send an authentication request to ClearPass.

The user will be presented with a self-registration receipt.

Refer to the exhibit. What can be concluded from the Access Tracker output shown?

ClearPass does not have a service enabled for MAC authentication.

The client used incorrect credentials to authenticate to the network.

ClearPass does not have a service enabled for MAC authentication.

The client MAC address is not present in the Endpoints table in the CrearPass database.

The RADIUS client on the Windows server failed to categorize the service correctly.

The client wireless profile is incorrectly setup.

If the "Alerts" tab in an access tracker entry shows the following error message: "Access denied by policy", what could be a possible cause for authentication failure?

Configuration of the Enforcement Policy.

An error in the role mapping policy.

Failure to select an appropriate authentication method for the authentication request.

Implementation of a firewall policy on ClearPass.

Failure to find an appropriate service to process the authentication request.

When is the RADIUS server certificate used? (Select two.)

During post-Onboard EAP-TLS authentication, when the client verifies the server certificate

During Onboard Web Login Pre-Auth, when the client loads the Onboarding web page

During dual SSID onboarding, when the client connects to the Guest network

During EAP-PEAP authentication in single SSID onboarding

During post-Onboard EAP-TLS authentication, when the client verifies the server certificate

During Onboard Web Login Pre-Auth, when the client loads the Onboarding web page

During post-Onboard EAP-TLS authentication, when the server verifies the client certificate

Refer to the exhibit. Based on the configuration of the Enforcement Profiles in the Onboard Authorization service shown, which Onboarding action will occur?

The device will be disconnected from and reconnected to the network after Onboarding is completed.

The device will be disconnected from the network after Onboarding so that an EAP-TLS authentication is not performed.

The device will be disconnected from and reconnected to the network after Onboarding is completed.

The device's onboard authorization request will be denied.

The device will be disconnected after post-Onboarding EAP-TLS authentication, so a second EAPTLS authentication is performed.

After logging in on the Onboard web login page, the device will be disconnected form and reconnected to the network before Onboard begins.

An organization implements dual SSID Onboarding. The administrator used the Onboard service template to create services for dual SSID Onboarding.Which statement accurately describes the outcome?

The Onboard Authorization service is triggered during the Onboarding process.

The Onboard Provisioning service is triggered when the user connects to the provisioning SSID to Onboard their device.

The Onboard Authorization service is triggered when the user connects to the secure SSID.

The Onboard Authorization service is triggered during the Onboarding process.

The device connects to the secure SSID for provisioning.

The Onboard Authorization service is never triggered.

Refer to the exhibit. Which statements accurately describe the status of the Onboarded devices in the configuration for the network settings shown? (Select two.)

They will connect to secure_emp SSID after provisioning.

They will perform 802.1X authentication when connecting to the SSID.

They will connect to Employee_Secure SSID after provisioning.

They will connect to Employee_Secure SSID for provisioning their devices.

They will use WPA2-PSK with AES when connecting to the SSID.

They will connect to secure_emp SSID after provisioning.

They will perform 802.1X authentication when connecting to the SSID.

Which use cases will require a ClearPass Guest application license? (Select two.)

Sponsor based guest user access

Guest user self-registration for access

Guest endpoint health assessment

Sponsor based guest user access

Guest user self-registration for access

Guest personal device onboarding

A customer would like to deploy ClearPass with these requirements:-2000 devices need to be Onboarded-2000 corporate devices need to run posture checks daily-500 guest users need to authenticate each day using the web login feature What is the license mix that customer will need to purchase?

CP-HW-25k, 4500 ClearPass Enterprise

CP-HW-5k, 2500 ClearPass Enterprise

CP-HW-25k, 4500 ClearPass Enterprise

CP-HW-500, 2500 ClearPass Enterprise

CP-HW-25k, 4000 ClearPass Enterprise

CP-HW-5k, 4500 ClearPass Enterprise

Refer to the exhibit. Based on the Translation Rule configuration shown, what will be the outcome?

An AD user from group Administrators will be assigned the operator profile of IT Administrators.

All ClearPass Policy Manager admin users who are members of the Administrators AD group will be assigned the TACACS profile of IT Administrators.

All active directory users will be assigned the operator profile of IT Administrators.

A user from AD group MatchAdmin will be assigned the operator profile of IT Administrators.

Refer to the exhibit. Based on the Aruba TACACS+ dictionary shown, how is the Aruba-Role attribute used?

To assign different privileges to administrators logging into an Aruba NAD

The Aruba-Admin-Role on the controller is applies to users using TACACS+ to login to the Policy Manager

To assign different privileges to clients during 802.1X authentication

To assign different privileges to administrators logging into an Aruba NAD

It is used by ClearPass to assign TIPS roles to clients during 802.1X authentication

To assign different privileges to administrators logging into ClearPass

In which ways can ClearPass derive client roles during policy service processing? (Select two.)

From the attributes configured in Active Directory

From the server derivation rule in the Aruba Controller server group for the client

From the Aruba Network Access Device

From the attributes configured in a Network Access Device

Refer to the exhibit. An administrator logs in to the Guest module in ClearPass and 'Manage Accounts' displays as shown.When a user with username donald@disney.com attempts to access the Web Login page, what will be the outcome?

The user will not be able to log in and authenticate.

The user will be able to log in and authenticate successfully but will then be immediate disconnected.

The user will be able to log in for the next 4.9. days, but then will no longer be able to log in.

The user will not be able to log in and authenticate.

The user will be able to log in and authenticate successfully, but will then get a quarantine role.

The user will not be able to access the Web Login page.

Refer to the exhibit. An Enforcement Profile has been created in the Policy Manager as shown.Which action will ClearPass take based on the Enforcement Profile?

It will send the session –Timeout attribute in the RADIUS Access-Accept packet to the NAD and the NAD will end the user's session after 600 seconds.

It will send the Session-Timeout attribute in the RADIUS Access-Request packet to the NAD and the NAD will end the user's session after 600 seconds.

It will send the Session-Timeout attribute in the RADIUS Access-Accept packet to the User and the user's session will be terminated after 600 seconds.

It will count down 600 seconds and send a RADUIS CoA message to the NAD to end the user's session after this time is up.

It will count down 600 seconds and send a RADUIUS CoA message to the user to end the user's session after this time is up.

It will send the session –Timeout attribute in the RADIUS Access-Accept packet to the NAD and the NAD will end the user's session after 600 seconds.

Use this form to make changes to the RADIUS Web Login Guest Network. A Web Login page is configured in Clear Pass Guest as shown.What is the purpose of the Pre-Auth Check?

To authenticate users before the client sends the credentials to the NAD

To authenticate users after the NAD sends an authentication request to ClerPass

To authenticate users before the client sends the credentials to the NAD

To authenticate users when they are roaming from one NAD to another

To authenticate users before they launch the Web Login Page

To replace the need for the NAD to send an authentication request to ClearPass

Refer to the exhibit. Based on the guest Self-Registration with Sponsor Approval workflow shown, at which stage does the sponsor approve the user's request?

After the receipt page is displayed, before the NAS login

After the RADIUS Access-Request

After the NAS login, but before the RADIUS Access-Request

Before the user can submit the registration form

After the RADIUS Access-Response

After the receipt page is displayed, before the NAS login

What is the purpose of ClearPass Onboard?

to provision personal devices to securely connect to the network

to provide MAC authentication for devices that don't support 802.1x

to run health checks on end user devices

to provision personal devices to securely connect to the network

to configure self-registration pages for guest users

to provide guest access for visitors to connect to the network

Refer to the exhibit. Based on the configuration of a Windows 802.1X supplicant shown, what will be the outcome when 'Automatically use my Windows logon name and password' are selected?

The client's Windows login username and password will be sent to the Authentication server.

The client will use machine authentication.

The client's Windows login username and password will be sent inside a certificate to the Active Directory server.

The client's Windows login username and password will be sent to the Authentication server.

The client will need to re-authenticate every time they connect to the network.

The client will prompt the user to enter the logon username and password.

A bank would like to deploy ClearPass Guest with web login authentication so that their customers can selfregister on the network to get network access when they have meetings with bank employees. However, they're concerned about security.What is true? (Choose three.)

During web login authentication, if HTTPS is used for the web login page, guest credentials will beencrypted.

After authentication, an IPSEC VPN on the guest's client be used to encrypt Internet traffic.

If HTTPS is used for the web login page, after authentication is completed some guest Internettraffic may be unencrypted.

If HTTPS is used for the web login page, after authentication is completed guest Internet traffic willall be encrypted as well.

During web login authentication, if HTTPS is used for the web login page, guest credentials will beencrypted.

After authentication, an IPSEC VPN on the guest's client be used to encrypt Internet traffic.

HTTPS should never be used for Web Login Page authentication.

If HTTPS is used for the web login page, after authentication is completed some guest Internettraffic may be unencrypted.

Which statement is true about the databases in ClearPass?

Entries in the guest user database do not expire.

A Static host list can only contain a list of IP addresses.

Entries in the guest user database can be deleted.

Entries in the local user database cannot be modified.

The endpoints database can only be populated by manually adding MAC addresses to the table.

Which statement is true? (Choose two.)

Third party Mobile Device Management solutions can be integrated with ClearPass.

Mobile Device Management is used to control device functions post-Onboarding.

Mobile device Management is the result of Onboarding.

Third party Mobile Device Management solutions can be integrated with ClearPass.

Mobile Device Management is the authentication that happens before Onboarding.

Mobile Device Management is an application container that is used to provision work applications.

Mobile Device Management is used to control device functions post-Onboarding.

Refer to the exhibit. What does the Cache Timeout Value refer to?

The amount of time the Policy Manager caches the user attributes fetched from Active Directory.

The amount of time the Policy Manager caches the user credentials stored in the Active Directory.

The amount of time the Policy Manager waits for a response from the Active Directory before checking the backup authentication source.

The amount of time the Policy Manager caches the user attributes fetched from Active Directory.

The amount of time the Policy Manager waits for response from the Active Directory before sending a timeout message to the Network Access Device.

The amount of time the Policy Manager caches the user\s client certificate.

Refer to the exhibit. Based on the Local User repository in ClearPass shown, which Aruba firewall role will be assigned to "mike" when this user authenticates Aruba Controller?

We can't know this from the screenshot above.

Refer to the exhibit. Based on the Posture Policy configuration shown, above, which statement is true?

This Posture Policy can use either the persistent or dissolvable Onguard agent to obtain the statement of health.

This Posture Policy can only be applied to an 802.1x wired service not 802.1x wireless.

This Posture Policy checks the health status of devices running Windows, Linux and Mac OS X.

This Posture Policy can use either the persistent or dissolvable Onguard agent to obtain the statement of health.

This Posture Policy checks for presence of a firewall application in Windows devices.

This Posture Policy checks with a Windows NPS server for posture tokens.

Which statement is true about the configuration of a generic LDAP server as an External Authentication server in ClearPass? (Choose three.)

Generic LDAP Browser can be used to search the Base DN.

An administrator can customize the selection of attributes fetched from an LDAP server.

A LDAP Browser can be used to search the Base DN.

Generic LDAP Browser can be used to search the Base DN.

An administrator can customize the selection of attributes fetched from an LDAP server.

The bind DN can be in the administrator@domain format.

A maximum of one generic LDAP server can be configured in ClearPass.

A LDAP Browser can be used to search the Base DN.

During a web login authentication, what is expected to happen as part of the Automated NAS login?

NAD sends RADIUS request to ClearPass.

NAD sends TACACS+ request to ClearPass.

ClearPass sends TACACS+ request to NAD.

Client device sends RADIUS request to NAD.

NAD sends RADIUS request to ClearPass.

ClearPass sends RADIUS request to NAD.

What does the Posture Token QUARANTINE imply?

The client is out of compliance.

The client is compliant. However, there is an update available to remediate the client to HEALTHY state.

The posture of the client is unknown.

The client is infected and is a threat to other systems in the network.

The client is out of compliance, but has HEALTHY state.

The client is out of compliance.

HP HPE6-A68 Practice Test 3 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

HP HPE6-A68 Practice Test 3

Question

HP HPE6-A68 Practice Tests

Practice Tests