HPE6-A68 Aruba Certified ClearPass Professional (ACCP) V6.7 Questions and Answers

Deny Access Profile

Onboard Device Repository

Cannot be determined

Onboard Post-Provisioning – Aruba

Onboard Pre-Provisioning – Aruba

DHCP server IP

Active Directory IP

Switch IP

Microsoft NPS server IP

ClearPass server IP

when a VLAN must be assigned to a wired user on an Aruba Mobility Controller

when a VLAN must be assigned to a wireless user on an Aruba Mobility Controller

when a VLAN must be assigned to a wired user on a third party wired switch that does not support RADIUS return attributes

when a VLAN must be assigned to a wired user on an Aruba Mobility Access Switch

when a VLAN must be assigned to a wired user on a third party wired switch that does not support RADIUS accounting

to check how long it has been since the last login authentication

to check whether the guest account expired

to check whether the MAC address is in the MAC Caching repository

to check whether the MAC address status is known in the endpoints table

to check whether the MAC address status is unknown in the endpoints table

Endpoints Repository

Client Repository

Local Users Repository

Onboard Devices Repository

Guest User Repository

to provide MAC authentication for devices that don’t support 802.1x

to run health checks on end user devices

to provision personal devices to securely connect to the network

to configure self-registration pages for guest users

to provide guest access for visitors to connect to the network

From the attributes configured in Active Directory

From the server derivation rule in the Aruba Controller server group for the client

From the Aruba Network Access Device

From the attributes configured in a Network Access Device

Through a role mapping policy

The ClearPass server has a trusted server certificate issued by Verisign.

The ClearPass server has an untrusted server certificate issued by the internal Microsoft Certificate server.

The ClearPass server does not recognize the client’s certificate.

The DNS server is not replying with an IP address for www.google.com.

Generic LDAP Browser can be used to search the Base DN.

An administrator can customize the selection of attributes fetched from an LDAP server.

The bind DN can be in the administrator@domain format.

A maximum of one generic LDAP server can be configured in ClearPass.

A LDAP Browser can be used to search the Base DN.

HR Local

Remote Employee

[Guest]

Executive

IOS Device

To authenticate users after the NAD sends an authentication request to ClerPass

To authenticate users before the client sends the credentials to the NAD

To authenticate users when they are roaming from one NAD to another

To authenticate users before they launch the Web Login Page

To replace the need for the NAD to send an authentication request to ClearPass

The NAD should be configured with the primary node IP address for RADIUS authentication on the 802.1x network.

A new Virtual IP address should be created for each NAD.

Both the primary and secondary nodes will respond to authentication requests sent to the Virtual IP address when the primary node is active.

The primary node will respond to authentication requests sent to the Virtual IP address when the primary node is active.

The NAD should be configured with the Virtual IP address for RADIUS authentications on the 802.1x network.

The user account has expired.

The client used a wrong password.

The shared secret between the NAD and ClearPass does not match.

The user’s certificate is invalid.

The user is not found in the database.

RestrictedACL

Remote Employee ACL

[Deny Access Profile]

EMPLOYEE_VLAN

HR VLAN