HPE6-A84 practice question 2 of 15

A customer needs you to configure Aruba ClearPass Policy Manager (CPPM) to authenticate domain users on domain computers. Domain users, domain…

A customer needs you to configure Aruba ClearPass Policy Manager (CPPM) to authenticate domain users on domain computers. Domain users, domain computers, and domain controllers receive certificates from a Windows CA. CPPM should validate these certificates and verify that the users and computers have accounts in Windows AD. The customer requires encryption for all communications between CPPM and the domain controllers. You have imported the root certificate for the Windows CA to the ClearPass CA Trust list.

Which usages should you add to it based on these requirements?

Answer options

A: Radec and Aruba infrastructure

B: EAP and AD/LDAP Server Correct answer

C: EAP and Radsec

D: LDAP and Aruba infrastructure

Correct Answer:

B. EAP and AD/LDAP Server

Explanation

The scenario requires the Certificate Authority (CA) certificate to be trusted for two distinct purposes. First, for validating the certificates presented by domain users and computers during 802.1X authentication, the EAP (Extensible Authentication Protocol) usage is necessary. This allows ClearPass to act as a RADIUS server and validate the client's certificate chain in EAP-TLS or PEAP-EAP-TLS. Second, the requirement for encrypted communication between ClearPass and the domain controllers for account lookups implies the use of LDAPS (LDAP over SSL/TLS). For ClearPass to establish a secure LDAPS session, it must trust the server certificate presented by the domain controller. Enabling the AD/LDAP Server usage for the imported root CA certificate allows ClearPass to validate the domain controller's certificate.

Why Incorrect

A. Radec and Aruba infrastructure: Radsec is for secure RADIUS-to-RADIUS communication, and Aruba Infrastructure is for device management; neither is relevant for client authentication or AD lookups in this context.
C. EAP and Radsec: Radsec is incorrect. The encrypted communication is with an Active Directory domain controller (which uses LDAPS), not another RADIUS server.
D. LDAP and Aruba infrastructure: The Aruba Infrastructure usage is not required. While AD/LDAP Server usage is correct, this option pairs it with an incorrect one.

References

1. HPE Aruba ClearPass Policy Manager 6.9 User Guide

Page 288

"Trust List Page". This section details the certificate usages.

EAP: "Select this check box to use this certificate for EAP." This directly supports the requirement to validate client certificates.

AD/LDAP Server: "Select this check box to use this certificate for AD/LDAP Server." This supports the requirement to trust the domain controller's certificate for a secure connection.

Radsec: "Select this check box to use this certificate for Radsec." This defines Radsec for secure RADIUS proxying

which is not the scenario described.

2. HPE Aruba ClearPass Policy Manager 6.9 User Guide

Page 111

"Adding Active Directory Authentication Sources". This section describes the "Connection Security" setting for an AD authentication source.

To meet the requirement for encrypted communication

the "AD over SSL" option would be selected

which uses port 636 (LDAPS). The guide states

"To use this option

the root CA of the AD server certificate must be available in the Certificate Trust List." This confirms the need for the AD/LDAP Server usage.

Keep practicing

Take the free HPE6-A84 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test