HPE6-A88 Practice Questions

RadSec (RADIUS over TLS) does not use a Pre-Shared Key (PSK) for security; it relies on TLS certificates for mutual authentication and encryption between the NAD and the ClearPass server. When RadSec is selected in the ClearPass UI, the PSK field is no longer relevant. The system automatically populates it with the fixed, non-editable string 'radsec' as a placeholder to indicate that a traditional shared secret is not being used. While the option is poorly worded (RadSec does not require a PSK), it is the only choice that correctly links the behavior to the RadSec protocol itself.

B. The network device is not compatible with RadSec configuration: This is incorrect. The UI behavior is a function of the protocol selected within ClearPass, not the compatibility of the external device.

C. The administrator’s user permissions restrict changes to the PSK field: This is incorrect. The field becomes non-editable due to the selection of the RadSec protocol, a system-wide behavior unrelated to user-specific permissions.

- Aruba ClearPass Policy Manager 6.11 User Guide, page 111, "Adding and Modifying Network Devices". The guide notes, "If you select RadSec for the network device, the Shared Secret field is automatically populated with the string 'radsec' and cannot be changed. RadSec uses TLS for authentication and not a shared secret."

When configuring RadSec (RADIUS over TLS), the Pre-Shared Key (PSK) is not the primary security mechanism. RadSec relies on TLS, which uses certificates to establish a secure and encrypted tunnel. The most critical step is to ensure that the certificate authority that signed the Network Access Device's (NAD) certificate is included in ClearPass's trust list. This allows ClearPass to validate the NAD's identity and establish a trusted TLS session. The 'radsec' PSK is often a placeholder and is superseded by the certificate-based trust.

A. The PSK field is largely irrelevant for RadSec's certificate-based authentication and encryption; changing it does not establish the required trust.

B. Rebooting the network device is a final activation step, not the critical configuration step for establishing the trust relationship in ClearPass.

- Aruba ClearPass Policy Manager 6.9 User Guide, page 563, "Configuring RadSec in ClearPass": "For RadSec, you must configure a trust list that includes the CA certificate that signed the RadSec server certificate on the network device." This highlights the necessity of the trust chain.

- RFC 6614, "Transport Layer Security (TLS) Encryption for RADIUS", Section 2.3: "The underlying TLS implementation provides for server authentication, and optionally for client authentication." This confirms the reliance on certificate-based authentication.

Factory-default ArubaOS/Instant devices ship with an HTTPS certificate whose Common Name is “securelogin.arubanetworks.com”. If the system is configured (or upgraded image expects) to intercept traffic to “securelogin.hpe.com”, the hostname in the URL no longer matches the certificate’s CN. Browsers therefore reject the TLS session and the controller never receives the HTTP request, appearing as if DNS interception failed.

A. ClearPass IP settings are unrelated to the built-in HTTPS server used for DNS intercept.

C. The Page Name affects the redirect URI after TLS is established; the mismatch happens before that stage.

1. Aruba Instant 8.8.0.0 User Guide, §24.4 “Default Factory Certificate”, p. 227 – CN = securelogin.arubanetworks.com.

2. ArubaOS 10.3 Release Notes, “Change in captive-portal FQDN to securelogin.hpe.com”, p. 19 – must replace certificate or hostname to match.

3. RFC 2818 “HTTP over TLS”, §3.1 – host name must match certificate CN/SAN.

The "Self-Registrations" page type in ClearPass Guest's Web Content Manager is specifically designed for creating self-service portals. This feature allows an administrator to build customizable forms where guests can request their own accounts. These registrations can be configured for automatic approval or to require sponsorship, directly fulfilling the requirement for guests to request and maintain their own identities.

A: Web Logins are pages used for authenticating users who already have valid credentials, not for creating new accounts.

C: Web Pages are generally used for displaying static or informational content, such as an Acceptable Use Policy (AUP), and lack the built-in forms for account creation.

1. Aruba ClearPass Guest 6.11 User Guide, Chapter 2: "Getting Started with Guest", Page 28, Section: "Web Content Manager". The guide explicitly differentiates the page types: "Self-Registration: Create pages for guest self-registration... Web Logins: Create pages for guest login." This clearly identifies Self-Registrations as the correct tool for the task.

Upon receiving an HTTP API call from ClearPass indicating a device's status has changed to "stolen," the Enterprise Mobility Management (EMM) server can execute a range of pre-configured security actions on the device itself. Standard EMM capabilities for a compromised or stolen device include remotely locking the device, sending a custom message to the lock screen (e.g., "This device is lost, please contact IT"), or initiating a corporate or full device wipe to protect sensitive data. These actions are central to the security function of an EMM platform.

A. Blocking network traffic is a network-level enforcement action typically performed by a switch or firewall based on a policy (e.g., VLAN assignment) from ClearPass.

C. While an EMM might disable a network interface, a remote wipe or lock are more common, comprehensive, and standardized security responses for a stolen device.

1. Aruba Networks, "ClearPass Integration with EMM/MDM," Solution Guide, page 5, "Use Cases". The guide lists actions such as "Wipe corporate data from a device" and "Lock a device" as typical remediation actions that ClearPass can trigger on an MDM/EMM server.

2. VMware Workspace ONE UEM, "Device Actions," VMware Docs. (Representative EMM documentation). This official documentation lists "Device Wipe," "Send Message," and "Device Lock" as core remote actions available to administrators, confirming these are standard EMM functions.

To send SMS receipts, an SMS transport must be configured in Messaging Setup. In the ClearPass Guest Admin UI, navigate to Messaging ➜ Setup and click “Configure SMS Gateway” to define an HTTP, SMPP, or email-to-SMS gateway. Once added, guest receipts can be delivered simultaneously via the already-configured email relay and the SMS gateway.

A. SMTP handles email only; SMS requires a gateway (HTTP/SMPP), not another SMTP server.

C. No “dual messaging” toggle exists; simultaneous delivery is enabled automatically once both email and SMS transports are configured.

1. Aruba ClearPass Guest 6.10 User Guide, “Messaging Setup,” pp. 124-129 – details configuring Email Relay and “Configure SMS Gateway” link.

2. Aruba ClearPass Guest 6.10 User Guide, Figure 6-5, p. 126 – shows dual-channel receipt once SMS gateway is defined.

ClearPass Profiler collects attributes from endpoints to categorize them by type, vendor, and operating system. When an upgrade is required for a specific type of problematic device, the administrator can use this profiling data to instantly view a complete inventory of all such devices on the network. This provides clear visibility into the scope and potential impact of the upgrade, allowing for better planning and targeted action without affecting other, non-problematic devices.

B. Blocking devices is an enforcement action, not a method for identifying the scope or impact of an upgrade.

C. ClearPass is a Network Access Control (NAC) solution; it does not have the native capability to perform firmware upgrades on endpoints.

- Aruba ClearPass Policy Manager 6.11 User Guide, "Profiling Collectors and Namespaces," Page 1. The document states, "ClearPass uses device profiling to collect endpoint context data... This data is used to classify client devices when they connect to the network."

- Aruba ClearPass Policy Manager Data Sheet, "Key Features > Profiler," Page 3. It describes how Profiler provides "precise device visibility" and "discovers and classifies all endpoints," which enables administrators to understand the types and numbers of devices on their network.

The guest registration receipt page in ClearPass is dynamic and uses AJAX polling to check the account's status. When a sponsor approves the account, its status changes from pending to active. The receipt page detects this change during its next poll and automatically updates the page content. This process enables the previously disabled (grayed out) "Log In" button, making it active and clickable for the guest to proceed.

A: The button does not remain grayed out; the page is designed to update its state automatically upon approval to provide a seamless user flow.

C: The button does not disappear; its purpose is to become usable upon approval, providing the logical next step for the guest user.

1. Aruba ClearPass Guest 6.11 User Guide, Chapter 4: "Self-Registration", Page 111, Section: "The Guest Registration Workflow". The guide describes the receipt page behavior: "The receipt page can be configured to poll the server for status updates... When the account is enabled, the page will be updated to show a login button."

To create a seamless login experience for repeat guest visitors, combining MAC authentication with the captive portal is the standard and most effective method. On a guest's first visit, they authenticate through the captive portal, and ClearPass records their device's MAC address. For subsequent connections, a MAC authentication service identifies the known device and allows it on the network without redirecting to the login page. This process, often called MAC caching, provides convenience for returning users while maintaining initial registration security.

A: A full 802.1X implementation is too complex for a typical guest environment, requiring supplicants and credentials that guests do not have.

C: A web login page alone requires guests to manually authenticate every time they connect, which is the opposite of a seamless experience.

- Aruba ClearPass Deployment Guide, Version 6.7, page 138, "Guest Access with MAC Caching": "The workflow for guest access with MAC caching is as follows: 1. The user connects and is redirected to a Web Login page... 3. On subsequent authentications, the user’s MAC address is known and they are allowed on the network."

- ClearPass Policy Manager 6.9 User Guide, page 1, "Service Templates": Describes the "Guest MAC Authentication" service template used for this purpose.

This is a standard Public Key Infrastructure (PKI) trust issue. When a server presents a certificate, the client validates it by checking the signature chain up to a trusted root Certificate Authority (CA). Certificates from internal CAs are not trusted by default because the internal root CA is not in the client's public trusted root store. To establish trust, the root certificate of the internal CA must be installed on each client device. This allows the client to validate the entire certificate chain and trust the ClearPass server.

A. Disable the trust check in the client's validation process: This is extremely insecure as it would make clients vulnerable to man-in-the-middle attacks by accepting any certificate.

C. Reissue the certificate from a public Certificate Authority: This is a valid alternative strategy but does not solve the problem using the existing internal CA, which is the implied context of the question.

1. Aruba ClearPass Policy Manager 6.7 Hardening Guide, Page 10, "Certificates > HTTPS Certificate". The guide states, "For clients to trust the server, the CA that signed the server certificate must be present in the clients’ trust list."

2. Aruba ClearPass Deployment Guide, Version 6.7, Page 38, "Installing the HTTPS Server Certificate". The guide explains the need for clients to trust the CA that issued the ClearPass HTTPS certificate for functions like OnGuard and Onboarding.