HPE6-A88 Sample Questions & Answers

Authentication Sources are used to connect ClearPass to external identity stores like Active Directory, LDAP, and generic SQL databases. Within the Authentication Source configuration for a SQL DB, an administrator defines the server connection details, database name, and the specific SQL queries to be used for authentication and fetching attributes.

The 'Self-Registration with sponsor confirmation' workflow is specifically designed for this scenario. A guest fills out the registration form, and an approval request is sent to a designated sponsor (the store manager). The guest account remains disabled until the sponsor approves the request via email or by logging into ClearPass.

This statement is true. The fundamental architecture of a ClearPass cluster is a single-master model where the Publisher holds the master configuration database. All administrative changes must be made on the Publisher, which then replicates those changes to all Subscriber nodes.

The 'Aruba-User-Role' is a specific Aruba Vendor-Specific Attribute (VSA) used for this purpose. When ClearPass sends a RADIUS Access-Accept message, it includes this attribute with the value set to the name of the role (e.g., 'Finance'). The Aruba switch or gateway receives this and applies its locally configured policy for that user role to the client's session.

For air-gapped systems, the correct procedure is to download the necessary update files from the Aruba support portal onto a machine with internet access. The files are then transferred to the ClearPass server and imported manually through the UI at Administration > Agents and Software Updates > Software Updates. This allows offline servers to stay current with posture and other subscription data.

The ClearPass REST API is the correct tool for programmatic interaction. The developer would create an API client in ClearPass, obtain an access token, and then use HTTP requests (e.g., a PATCH request to the Endpoint or GuestUser entity) to change an attribute that an enforcement policy can act upon to deny access. For active sessions, a RADIUS Change of Authorization (CoA) could also be triggered via the API.

An Enforcement Policy acts as a decision-making engine. It contains a set of rules that evaluate attributes from the authentication session (such as user role, device type, posture status). Based on which rule is matched, it selects the appropriate Enforcement Profile, which contains the specific access control actions (like assigning a VLAN or user role) to be sent back to the NAD.

Unlike iOS or Windows, Android requires a separate step to install the network profile after the certificate is provisioned. If the user only installs the certificate but fails to install the associated network (Wi-Fi) profile, the device will not know to use that certificate for the specific SSID. This is a common point of failure in the Android onboarding workflow.

Enforcement policies are evaluated from top to bottom. If the evaluation mode is NOT set to 'First match', ClearPass will evaluate all rules and apply the profiles from all matching rules. Since the user is authenticated, they match both Rule 1 and Rule 2. When multiple profiles are returned, the NAD's behavior can be unpredictable, but often the last or a combination of attributes is applied, leading to incorrect access. The fix is to reorder the rules (most specific first) or set the evaluation mode to 'First Match'.