Free HPE6-A88 sample questions

Correct answer: Persistent Agent

The Persistent Agent is required for these checks. It is an installed application that can perform deep health checks, such as verifying registry keys, running processes (antivirus), and system properties (domain-joined status). The Dissolvable Agent is temporary and has limited capabilities, while the Agentless approach can only check attributes visible from the network, not internal device state.

Correct answer: ClearPass Zones

ClearPass Zones are designed for this exact purpose. By grouping subscribers into zones based on geographic location, NADs can be configured to prioritize authenticating to subscribers within their local zone. This minimizes WAN latency for AAA traffic and provides regional resilience if the connection to the publisher is lost.

Correct answers: Connection:Service-Type BELONGS_TO Login-User,PAP-User; Connection:NAD-IP-Address BELONGS_TO_GROUP

Correct answer: Authentication Source

Authentication Sources are used to connect ClearPass to external identity stores like Active Directory, LDAP, and generic SQL databases. Within the Authentication Source configuration for a SQL DB, an administrator defines the server connection details, database name, and the specific SQL queries to be used for authentication and fetching attributes.

Correct answer: Self-Registration with sponsor confirmation

The 'Self-Registration with sponsor confirmation' workflow is specifically designed for this scenario. A guest fills out the registration form, and an approval request is sent to a designated sponsor (the store manager). The guest account remains disabled until the sponsor approves the request via email or by logging into ClearPass.

Correct answer: True

This statement is true. The fundamental architecture of a ClearPass cluster is a single-master model where the Publisher holds the master configuration database. All administrative changes must be made on the Publisher, which then replicates those changes to all Subscriber nodes.

Correct answer: Aruba-User-Role

The 'Aruba-User-Role' is a specific Aruba Vendor-Specific Attribute (VSA) used for this purpose. When ClearPass sends a RADIUS Access-Accept message, it includes this attribute with the value set to the name of the role (e.g., 'Finance'). The Aruba switch or gateway receives this and applies its locally configured policy for that user role to the client's session.

Correct answer: Download the update files from the Aruba support portal and import them via the Administration > Agents and Software Updates > Software Updates page.

For air-gapped systems, the correct procedure is to download the necessary update files from the Aruba support portal onto a machine with internet access. The files are then transferred to the ClearPass server and imported manually through the UI at Administration > Agents and Software Updates > Software Updates. This allows offline servers to stay current with posture and other subscription data.

Correct answer: The ClearPass REST API

The ClearPass REST API is the correct tool for programmatic interaction. The developer would create an API client in ClearPass, obtain an access token, and then use HTTP requests (e.g., a PATCH request to the Endpoint or GuestUser entity) to change an attribute that an enforcement policy can act upon to deny access. For active sessions, a RADIUS Change of Authorization (CoA) could also be triggered via the API.

Correct answer: To evaluate a set of conditions and select an Enforcement Profile to apply to a session.

An Enforcement Policy acts as a decision-making engine. It contains a set of rules that evaluate attributes from the authentication session (such as user role, device type, posture status). Based on which rule is matched, it selects the appropriate Enforcement Profile, which contains the specific access control actions (like assigning a VLAN or user role) to be sent back to the NAD.