Free HPE6-A88 practice test: 30 questions with answers

A posture policy runs health checks such as host firewall and antivirus status and returns a posture result that enforcement rules can test. Device profiling only identifies what kind of device it is, guest self-registration is for visitor accounts, and role mapping converts directory group membership into roles rather than judging health.

EAP-TLS uses certificates on both the client and the server, which gives mutual authentication. EAP-MD5 provides no server certificate, PEAP with MSCHAPv2 relies on a password instead of a client certificate, and MAC authentication does not use a supplicant or certificates at all.

MAC authentication sends an address that anyone on the wire can read and copy, and the same value serves as both username and password, so it gives weak assurance. The endpoint repository does store MAC addresses, the switch does forward the printer's address, and a printer's hardware address does not change when it reboots.

802.1X uses EAP to verify credentials or certificates, and EAP-TLS verifies both sides of the exchange. 802.1X depends on a RADIUS authentication server and requires a supplicant on the client, while the MAC-address-as-password behaviour describes MAC authentication, which is the weaker method.

Services are evaluated in list order, and the first one whose rules match the request is used. Running several services and merging their results is not how selection works, the shared secret only protects messages between the device and the server, and the number of conditions does not decide the choice.

Enforcement profiles contain the RADIUS or TACACS+ attributes, such as VLAN IDs and roles, that ClearPass returns to the device. Authentication sources, posture tokens and local repositories have different jobs and do not send attributes to the network device.

An enforcement policy evaluates its rules in order and selects an enforcement profile for each matching rule, so one service can return different results for different users. Port numbers do not select roles, disabling accounting does not restrict access, and a single profile for everyone cannot tell the groups apart.

Rules combine their conditions with match all or match any logic and can test request attributes such as NAS port type or connection protocol. They are not limited to shared secrets or MAC vendor prefixes, and their order does affect which result is returned.

A role mapping policy takes attributes from the authentication source, such as Active Directory group membership, and maps them to ClearPass roles that enforcement can use. Posture, profiling and Onboard each serve a different purpose and do not map directory groups to roles.

Profiling identifies the printer category, and an enforcement rule can match that category and assign the right segment for any port it connects to. Fixed port VLANs are static, guest registration is meant for visitors, and posture agents cannot classify a device by its category.

A dynamic role is applied when the user authenticates, so the same policy follows the user across switches and access points. Roles still depend on RADIUS, they are assigned dynamically rather than bound to one port, and a role does not encrypt traffic by itself.

Enforcement profiles, role mapping policies and enforcement rules that test the profiled device category all let ClearPass assign roles or VLANs dynamically. A VLAN typed into the switch port is static switch configuration, and a visitor cannot choose a VLAN before authentication.

The publisher holds the master configuration and replicates it to the subscriber nodes, so changes are made there. Editing a subscriber directly, editing each node separately with later reconciliation, or using a server outside the cluster does not keep the cluster consistent.

A verified backup gives a restore point if the upgrade fails, so it should come before any change work. Deleting accounting data loses records without protecting configuration, turning off RADIUS stops network authentication, and moving users to guest access is not a standard upgrade step.

ClearPass licensing defines the capacity the platform is entitled to use, such as the number of endpoints or users it can authenticate. Profiling, failover and certificate chaining are separate concepts that do not set entitlement limits.

Certificates are valid only within their validity window, and accounting records need correct timestamps to be useful. Email dates, service selection and backup storage do not depend on clock synchronization in the way the wrong options suggest.

Insight is the ClearPass module used for reporting and analytics, including dashboards and historical trends from authentication data. Policy Manager makes access decisions, Guest handles visitor accounts, and Onboard provisions device certificates, so none of them is the reporting module.

Onboard provisions each personal device with its own certificate and network profile so it can authenticate with EAP-TLS. Guest serves visitors, Insight reports on activity, and Policy Manager makes the access decision, although it works alongside Onboard.

Policy Manager is the policy decision point: it evaluates the configured services in order and returns the enforcement profile for the request. Insight only reports on history, Onboard provisions devices, and Guest handles visitor accounts, so none of them makes the access decision for a RADIUS request.

ClearPass Guest is the module for visitor accounts, including accounts that staff create and then print or send to the visitor. Insight reports on data, Onboard provisions device certificates, and Policy Manager sets access policy, so none of them handles visitor account creation.

Accounting in AAA logs session events such as start, interim update and stop, together with usage counters. Authentication verifies identity, authorization decides what the user may do, and encryption protects data in transit rather than recording sessions.

Authorization decides what an already authenticated user may access, such as the VLAN or role returned in an enforcement profile. Authentication only confirmed identity, accounting only logs the session, and encryption protects data but does not assign access.

Checking a supplied credential against a directory is authentication, the first AAA step. Authorization follows and decides privileges, accounting logs the session, and failover is a high-availability feature that is not one of the three AAA functions.

TACACS+ separates the AAA functions, so command authorization controls which commands are allowed and command accounting logs what was entered. Accounting alone does not enforce the approved list, authentication alone checks identity only, and a local list would not be managed centrally by the AAA server.

Guest self-registration lets visitors create their own accounts, and a sponsor approval step keeps the account inactive until a staff member approves it. Onboard issues device certificates, a static host list is a manually maintained MAC list, and posture assessment checks health rather than approving visitors.

A captive portal intercepts web traffic from an unauthenticated client and redirects it to a login page, and full access follows only after the visitor logs in. Corporate role assignment, blocked DNS, and full access with accounting-only logs do not describe a captive portal flow.

Guest accounts can carry an expiration time, so access ends automatically when that time passes. MAC caching only remembers a device for convenience, DHCP lease time affects addressing rather than account validity, and removing the portal does not revoke an account that already has access.

ClearPass Onboard includes a built-in certificate authority, so it can issue and sign device certificates itself, and it can also be integrated with an external enterprise CA. The sponsor console manages visitor accounts, Insight only reports, and a RADIUS shared secret is not a certificate private key.

A quarantine posture result is usually tied to an enforcement profile that places the endpoint in a remediation role with limited access until its health improves. Deleting the endpoint, disabling the directory account or granting full access are not standard responses to a quarantine result.

Posture attributes hold the health results, such as Healthy or Quarantine, that enforcement rules can test in their conditions. Serial numbers, replication certificates and backup files are unrelated to evaluating endpoint health.