HPE Aruba Networking ClearPass Free Sample Questions

ClearPass Endpoint Profiling is the correct feature. It allows ClearPass to collect attributes about devices using methods like DHCP fingerprinting, MAC OUI, and other network traffic analysis to classify non-802.1X devices. Onboard is for BYOD certificate provisioning, OnGuard is for posture assessment of managed clients, and Guest is for managing temporary network access.

The error 'Outer EAP-Type not configured on the server' specifically indicates that the EAP method being requested by the client (in this case, EAP-TLS) is not enabled or allowed within the service's authentication method configuration. The server is rejecting the request because it's not configured to handle that EAP type.

The Persistent Agent is required for these checks. It is an installed application that can perform deep health checks, such as verifying registry keys, running processes (antivirus), and system properties (domain-joined status). The Dissolvable Agent is temporary and has limited capabilities, while the Agentless approach can only check attributes visible from the network, not internal device state.

ClearPass Zones are designed for this exact purpose. By grouping subscribers into zones based on geographic location, NADs can be configured to prioritize authenticating to subscribers within their local zone. This minimizes WAN latency for AAA traffic and provides regional resilience if the connection to the publisher is lost.

Authentication Sources are used to connect ClearPass to external identity stores like Active Directory, LDAP, and generic SQL databases. Within the Authentication Source configuration for a SQL DB, an administrator defines the server connection details, database name, and the specific SQL queries to be used for authentication and fetching attributes.

The 'Self-Registration with sponsor confirmation' workflow is specifically designed for this scenario. A guest fills out the registration form, and an approval request is sent to a designated sponsor (the store manager). The guest account remains disabled until the sponsor approves the request via email or by logging into ClearPass.

This statement is true. The fundamental architecture of a ClearPass cluster is a single-master model where the Publisher holds the master configuration database. All administrative changes must be made on the Publisher, which then replicates those changes to all Subscriber nodes.

The 'Aruba-User-Role' is a specific Aruba Vendor-Specific Attribute (VSA) used for this purpose. When ClearPass sends a RADIUS Access-Accept message, it includes this attribute with the value set to the name of the role (e.g., 'Finance'). The Aruba switch or gateway receives this and applies its locally configured policy for that user role to the client's session.

For air-gapped systems, the correct procedure is to download the necessary update files from the Aruba support portal onto a machine with internet access. The files are then transferred to the ClearPass server and imported manually through the UI at Administration > Agents and Software Updates > Software Updates. This allows offline servers to stay current with posture and other subscription data.