HPE HPE6-A88: HPE Networking ClearPass Exam

Last checked November 10, 2026 against the official HPE exam page.

1. Question 1Identify Network Access Control and Security Features

   A security team wants a rule that treats a laptop as Healthy only when its host firewall is enabled and its antivirus definitions are current. Which ClearPass capability evaluates these endpoint health conditions?

   1. ADevice profiling, which classifies the laptop by its device type
   2. BGuest self-registration with a sponsor approval workflow for laptops
   3. CPosture policy that evaluates firewall and antivirus health checks
   4. DRole mapping that copies Active Directory group names into roles
   Show answer and explanationHide answer

   Correct answer: C

   A posture policy runs health checks such as host firewall and antivirus status and returns a posture result that enforcement rules can test. Device profiling only identifies what kind of device it is, guest self-registration is for visitor accounts, and role mapping converts directory group membership into roles rather than judging health.

2. Question 2Service Configuration and Selection

   A ClearPass server receives a RADIUS request, and several configured services could apply to it. How does ClearPass decide which service processes the request?

   1. AIt picks the service with the most conditions, ignoring the list order entirely
   2. BIt runs every matching service and merges their enforcement results
   3. CIt uses the RADIUS shared secret configured for the requesting device
   4. DThe first service in list order whose rule conditions match the request
   Show answer and explanationHide answer

   Correct answer: D

   Services are evaluated in list order, and the first one whose rules match the request is used. Running several services and merging their results is not how selection works, the shared secret only protects messages between the device and the server, and the number of conditions does not decide the choice.

3. Question 3Dynamic User Roles and Segmentation

   Employees and contractors authenticate against the same Active Directory. Contractors must receive a restricted role based on their group membership. Which ClearPass policy converts directory group membership into a role?

   1. APosture policy that evaluates the health of the endpoint
   2. BRole mapping policy that maps authentication attributes to roles
   3. CDevice profiling rule that classifies the endpoint by its device category
   4. DOnboard provisioning profile that issues device certificates
   Show answer and explanationHide answer

   Correct answer: B

   A role mapping policy takes attributes from the authentication source, such as Active Directory group membership, and maps them to ClearPass roles that enforcement can use. Posture, profiling and Onboard each serve a different purpose and do not map directory groups to roles.

4. Question 4ClearPass Server Management and Administration

   In a ClearPass cluster with one publisher and several subscribers, where should an administrator make configuration changes?

   1. AOn whichever subscriber node has the lowest CPU load at the moment
   2. BOn the publisher node, which replicates the changes to the subscribers
   3. COn each node separately, followed by a manual reconciliation step each week
   4. DOn a separate standalone server that is not part of the cluster at all
   Show answer and explanationHide answer

   Correct answer: B

   The publisher holds the master configuration and replicates it to the subscriber nodes, so changes are made there. Editing a subscriber directly, editing each node separately with later reconciliation, or using a server outside the cluster does not keep the cluster consistent.

5. Question 5Identify ClearPass Modules and System Components

   A network manager wants dashboards and historical reports that show how many authentications succeeded or failed each day. Which ClearPass module provides these reports?

   1. AInsight, which provides dashboards and reports on authentication history
   2. BGuest, which provides visitor self-registration and sponsor approval
   3. CPolicy Manager, which evaluates enforcement rules for each login request
   4. DOnboard, which provisions certificates for employee and personal devices
   Show answer and explanationHide answer

   Correct answer: A

   Insight is the ClearPass module used for reporting and analytics, including dashboards and historical trends from authentication data. Policy Manager makes access decisions, Guest handles visitor accounts, and Onboard provisions device certificates, so none of them is the reporting module.