2022 HPE6-A77 Dumps PDF - HPE6-A77 Real Exam Questions Answers
Valid HPE6-A77 Test Answers & HP HPE6-A77 Exam PDF
HP HPE6-A77 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
NEW QUESTION 21
You are deploying ClearPass Policy Manager with Guest functionality for a customer withmultiple Aruba Networks Mobility Controllers The customer wants to avoid SSL errors during guest access but due to company security policy cannot use a wildcard certificate on ClearPass or the Controllers.
What is the most efficient way to configure the customers guest solution? (Select two.)
- A. Install the same public certificate on all Controllers with the common name "controller {company domain}"
- B. Build one Web Login page with vendor settings for controller {company domain)
- C. Install multiple public certificates with a different Common Name on each controller
- D. Build multiple Web Login pages with vendor settings configured for each controller
Answer: A,D
NEW QUESTION 22
Refer to the exhibit:
A customer is deploying Guest Self-Registration with Sponsor Approval but does not like the format of the sponsor email. Where can you change the sponsor email?
- A. in me Configuration - Receipts - Email Receipts
- B. in the Sponsor Confirmation section
- C. in the Receipt Page - Actions
- D. in the Configuration - Receipts - Templates
Answer: B
NEW QUESTION 23
You have recently implemented a serf-registration portal in ClearPass Guest to be used on a Guest SSID broadcast from an Aruba controller. Your customer has started complaining that the users are not able to reliably access the internet after clicking the login button on the receipt page. They tell you that the users willclick the login button multiple times and alter about a minute they gain access.
What could be causing this issue?
- A. The guest users are assigned a firewall user role that has a rate limit.
- B. The enforcement profile on ClearPass is set up with an lETF:session delay.
- C. The self-registration page is configured with a 1 minute login delay.
- D. The guest client is delayed getting an IP address from the DHCP server.
Answer: C
NEW QUESTION 24
You have configured a Guest SSID with Captive-portal Web Authentication and MAC authentication The MAC caching expiry time set to 12 hours and the Guest Account expiration time is set to 8 hours. What will happen if the guest were to disconnect from the SSID and re-connect 9 hours later?
- A. The client will successfully pass the mac authentication until the mac caching time expires.
- B. The client will fail the MAC authentication and will be redirected to the Captive-portal login page.
- C. The client will successfully pass the MAC authentication but still be redirected to captive portal page.
- D. The client will tail the MAC authentication and be denied access to the Guest SSID.
Answer: C
NEW QUESTION 25
Refer to the exhibit:
A customer has configured onboard in a cluster with two nodes All devices were onboarded in the network through node1but those clients tail to authenticate through node2 with the error shown. What steps would you suggest to make provisioning and authentication work across the entire cluster? (Select three.)
- A. Have all of the BYOD clients re-run the Onboard process
- B. Make sure that the EAP certificates on both nodes are issued by one common root Certificate Authority (CA).
- C. Configure the Network Settings in Onboard to trust the Policy Manager EAP certificate
- D. Configure the Onboard Root CA to trust the Policy Manager EAP certificate root.
- E. Have all of the BYOD clients disconnect and reconnect to me network
- F. Make sure that the HTTPS certificate on both nodes is issued as a Code Signing certificate
Answer: B,C,D
NEW QUESTION 26
What type of EAP certificate are you able to use on ClearPass? (Select two.)
- A. Self signed, when all the clients are part of the organization domain.
- B. Private signed, when the clients are onboarded or are part of the organization domain.
- C. Public signed, when not all of the clients are part of the organization domain.
- D. Private signed, when some clients are onboarded and some are not part of the organization.
- E. Self signed, when all the clients are Onboarded with the same Root CA as the Self signed certificate.
Answer: C,D
NEW QUESTION 27
Refer to the exhibit:
The customer complains that the user shown cannot log into the ClearPass Server as an administrator using the
[Policy Manager Admin Network Login Service]. What could be the reason for this?
- A. The account created does not fit this purpose.
- B. The user might be used for a TACACS authentication
- C. The mapping on the role should be changed to [RADIUS Super Admin]
- D. The local user authentication might be disabled
Answer: A
NEW QUESTION 28
Refer to the exhibit:
A year ago, your customer deployed an Aruba ClearPass Policy Manager Server for a Guest SSIC hosted in an IAP Cluster.The customer just created a new Web Login Page forthe Guest SSID. Even though the previous Web Login page worked test with the new Web Login Page are falling and the customer has forwarded you the above screenshots What recommendation would you give the customer to tix the issue?
- A. The customer should reset the password tor the username accx@exam com using Guest Manage Accounts
- B. The service type configured is not correct. The Guest authentication should De an Application authentication type of service.
- C. The WebLogin Pre-Auth Check is set to Aruba Application Authentication which requires a separate application service on the policy manager
- D. The Address filed under the WebLogin Vendor settings is not configured correctly, it should be set to instantarubanetworks.com
Answer: B
NEW QUESTION 29
Refer to the exhibit:
A customer has configured a Guest Self registration page for their Cisco Wireless network with the settings shown. What should be changed in order to successfully authenticate guests users?
- A. Secure Login should use HTTP
- B. Login Method should be Controller-initiated - using HTTPs form submit
- C. Change \he IP Address to the Cisco Controller DNS name
- D. Change the Vendor Settings to Airespace Networks
Answer: C
NEW QUESTION 30
A customer has a ClearPass cluster deployment with four servers, two servers at the data center and two servers at a large remote site connected over an SD-WAN solution The customer would like to implement OnGuard, Guest Self-Registration, and 802.1x authentication across their entire environment. During testing the customer is complaining that users connecting to an Instant Cluster Employee SSID at the remote site, with the OnGuard Persistent Agent installed are randomly getting their health check missed.
What could be a possible cause of this behavior?
- A. The ClearPass Policy Manager zones have been defined but the local IP sub-nets have not been property mapped to the zones and the OnGuard Agent might connect to any of the servers in the cluster.
- B. The traffic on the TCP port 6658 is congested due to the fact that this port is also used by the IPsec keep-alive packets of the SD-WAN solution.
- C. The OnGuard Clients are automatically mapped to the Policy Manager Zone based on their IP range but an ACL on the switch could be blocking access.
- D. The Aruba-user-role received by the IAP is filtering the TCP port 6658 to the ClearPass servers and after 10 seconds the SSL fallback gets activated and randomly generates the issue.
Answer: D
NEW QUESTION 31
What is used to validate the EAP Certificate? (Select three.)
- A. Date
- B. SAN entries
- C. Server Identity
- D. Trust chain
- E. Key usage
- F. Common Name
Answer: D,E,F
NEW QUESTION 32
Refer to the exhibit:
You have been asked to help a Customer troubleshoot an issue. They have configured an Aruba OS switch (Aruba 2930 with 16.09) to do MAC authentication with profiling using ClearPass as the authentication source. They cannot get it working.
Using the screenshots as a reference, how will you fix the issue?
- A. User-roles are case sensitive, update the correct role with correct case in the enforcement profile
- B. Use a CoA to bounce the switch port to force the port to change tothe correct Aruba user role
- C. Delete the initial role in the Aruba OS switch to force the device to get the server derived user roles
- D. Change the Vendor settings for the Aruba OS switch to "Aruba" so that the enforcement will use the correct VSAs
- E. Modifythe enforcement profile conditions with Aruba Vendor specific attributes and Aruba-user-roles
Answer: E
NEW QUESTION 33
A customer is complaining that some ofthe devices, in their manufacturing network, are not getting profiled while other loT devices from the same subnet have been correctly profiled. The network switches have been configured for DHCP IP helpers and IF-MAP has been configured on the Aruba Controllers. What can the customer do to discover those devices as well? (Select two.)
- A. Allow time for IF-MAP service on the controller to discover the new devices as well.
- B. Add the ClearPass Server IP as an IP helper address on the default gateway as well.
- C. Open a TAC case to help you troubleshoot the DHCP device profile functionality.
- D. Manually create a new device fingerprint for the devices that are not being profiled.
- E. Update the Fingerprints Dictionary to the latest in case new devices have been added.
Answer: A,D
NEW QUESTION 34
A corporate ClearPass Cluster with two servers located at a single site, has both Management and Data port IP addresses configured. The Management port IPs are in the DataCenter networks subnet, while the Data port IPs are in the DMZ. What is the difference between using one Virtual IP for the AAA traffic versus sending AAA requests to the physical IPs for each server? (Select two.)
- A. The failover can be accomplished only by using Virtual IP.
- B. The Individual IPs can provide failover and load balancing.
- C. By using the Virtual IP, the failover convergence is faster than using individual server IPs.
- D. One Virtual IP can be used together with the individual server IPs for load balancing.
- E. Using the one Virtual IP can provide failover and load balancing.
Answer: B,E
NEW QUESTION 35
You are integrating a Postgres SQL server with the ClearPass Policy Manager What steps will you follow to complete the integration process? (Select three)
- A. Create a new Endpoint context server andadd the SQL server IP, credentilas and the database name.
- B. Click on the default filter name with pre-defined filter queries and check box to enable as role.
- C. Attribute Name under filter configuration must match one of the columns being requested from the database table.
- D. Alias Name under filter configuration must match one of the columns being requested from the database table.
- E. Create a new authentication source and add the SQL server IP, credentials and the database name.
- F. Specify a new filter with filter queries to fetch authentication and authorization attributes.
Answer: A,E,F
NEW QUESTION 36
Refer to the exhibit:
What could be causing the error message received on the OnGuard client?
- A. The client'sOnGuardAgent has not been configured with the correct Policy Manager Zone
- B. The Service Selection Rules for the service are not configured correctly
- C. The Web-BasedHealth Check service needs to be configured to use the Posture Policy
- D. There is a firewall policy not allowing the OnGuard Agent to connect to ClearPass
Answer: A
NEW QUESTION 37
You have integrated ClearPass Onboard with Active Directory Certificate Services (ADCS) web enrollment to sign the final device TLS certificates. The customer wouldalso like to use ADCS for centralized management of TLS certificates including expiration, revocation, and deletion through ADCS.
What steps will you follow to complete the requirement?
- A. Edit the [EAP-TLS with OSCP Enabled) authentication method and set the correct ADCS server OCSP URL. remove EAP-TLS and map the [EAP-TLS with OSCP Enabled) method to the Onboard Provisioning Service.
- B. Copy the default [EAP-TLS with OSCP Enabled] authentication method and update the correct ADCS server OCSP URL. remove EAP-TLS and map the custom created method to the OnBoard Authorization Service.
- C. Copy the [EAP-TLS with OSCP Enabled) authentication method and set the correct ADCS server OCSP URL, remove EAP-TLS and map the custom created method to the Onboard Provisioning Service.
- D. Remove the EAP-TLS authentication method and add "EAP-TLS with OCSP Enabled' authentication method in the OnBoard Provisioning service. No other configuration changes are required.
Answer: D
NEW QUESTION 38
What is the Secure SSID {otherwise referred to as Single SSID) OnBoard deployment service workflow?
- A. OnBoard Provisioning RADIUS service, OnBoard Pre-Auth Application service. OnBoard Authorization Application service, OnBoard Provisioning RADIUS service
- B. OnBoard Provisioning RADIUS service, OnBoard Pre-Auth RADIUS service, OnBoard Authorization Application service. OnBoard Provisioning RADIUS service
- C. OnBoard Provisioning RADIUS service, OnBoard Authorization RADIUS service. OnBoard Pre-Auth Application service, OnBoard Provisioning RADIUS service
- D. OnBoard Provisioning RADIUS service, OnBoard Authorization Application service, OnBoard Pre-Auth Application service, OnBoard Provisioning RADIUS service
Answer: C
NEW QUESTION 39
Refer to the exhibit:
A customer has configured a service with the Onboard Devices Repository as an Authentication Source and an Active Directory Domain Server as an Authorization Source. What will happen if the client certificate is still valid and the user account associated with the certificate is disabled in Active Directory?
- A. Enforcement will apply the [Deny Access Profile]
- B. ClearPass will allow the device to access the network.
- C. ClearPass will redirect the client to Onboard again
- D. ClearPass will not process the request
- E. ClearPass will block network access to the device
Answer: E
NEW QUESTION 40
A customer would like to allow only the AD users with the "Manager" title from the "HQ" location to Onboard their personal devices. Any other AD users should not be authorized to pass beyond the initial device provisioning page. Which Onboard service will you use to implement this requirement?
- A. Onboard Authorization service
- B. Onboard Pre-Auth service
- C. Onboard CP login service
- D. Onboard Provisioning service
Answer: C
NEW QUESTION 41
Refer to the exhibit:
A customer with multiple Aruba Controllers has just installed a new certificate for "*.customerdomain com" on all Aruba Controllers. While testing the existing guest Self-Registration page the customer noticed that the logins are failing. While troubleshooting they are finding no entries in the Event Viewer or Access Tracker for the tests. Suspecting that the Aruba Controllers may not be properly posting the credentials from the guest browser, they open the NAS Vendor Settings for the Guest Self-Registration Page. From the screen shown, how can you fix the errors?
- A. Change the "IP Address: field to" securelogin.customerdomain.com.
- B. Change the "IP Address field to "captiveportal-login.customerdomain.com".
- C. Add PTR records on the DNS server for "securelogin.arubanetworks.com".
- D. Change the "Secure Login:" field to "Use Vendor Default".
Answer: D
NEW QUESTION 42
Refer to the exhibit:
You configuring an 802 1x service endpoint profiling. When the client connects to the network, ClearPass successfully profiles the client and sends Radius Change of Authorization (RCoA) but Radius Change of Authorization {RCoA) fails for the client You manually clicked on the Change Status button in the access tracker to force an RCoA but that failed too.
What must you check to ensure that the RCoA will work? (Select two.)
- A. RFC 3576 server should be mapped in the server group on the Aruba Controller
- B. RFC 3576 server IPs and the Authentication server IPs should be same in the AAA profile
- C. RFC 3576 option is enabled for Aruba Controller under Network devicein ClearPass.
- D. The RFC 3576 shared secret on ClearPass should match the Authentication Server shared secret
Answer: C,D
NEW QUESTION 43
You have Integrated ClearPass Onboard with Active Directory Certificate Services (ADCS) web enrollment to sign the Anal device TLS certificates The Onboard provisioning process completes successfully but when the user finally clicks connect, the user falls to connect to the network with an unknown_ca certificate error.
What steps will you follow to complete the requirement?
- A. Make sure both the ClearPass servers have different certificates used for both SSL and RADIUS server identity.
- B. Make sure that the ClearPass servers are using the default self-signed certificates for both SSL and RADIUS server identity
- C. Export the self-signed certificate from the ClearPass servers and manually add them as trusted certificates in clients
- D. Add the ADCS root certificate to both the CPPM Certificate trust list and to the Onboard Certificate Store trust list
Answer: B
NEW QUESTION 44
Refer to the exhibit:
A customer is trying to configure a TACACS Authentication Service for administrative access to the Aruba Controller, During testing the authentication is not successful Given the screen shot what could be the reason for the Login status REJECT?
- A. The Enforcement profile used is not a TACACS profile.
- B. The password used by the administrative user,user is wrong.
- C. The Read-only Administrator role does not exist on the Controller.
- D. The Enforcement profile is not designed to be used on Aruba Controller.
Answer: B
NEW QUESTION 45
......
HPE6-A77 Exam Dumps - PDF Questions and Testing Engine: https://www.practicedump.com/HPE6-A77_actualtests.html