QUESTION: 25

Refer to the exhibit.

Based on the Enforcement Policy configuration shown, when a user with Role Remote Worker connects to the network and the posture token assigned is quarantine, which Enforcement Profile will be applied?

RestrictedACL
Remote Employee ACL
[Deny Access Profile]
EMPLOYEE_VLAN
HR VLAN

Answer(s): B

Explanation:

The first rule will match, and the Remote Employee ACL will be used.

Reveal Solution Next Question

QUESTION: 26

Refer to the exhibit.

Based on the Access Tracker output for the user shown, which statement describes the status?

The Aruba Terminate Session enforcement profile as applied because the posture check failed.
A Healthy Posture Token was sent to the Policy Manager.
A RADIUS-Access-Accept message is sent back to the Network Access Device.
The authentication method used is EAP-PEAP.
A NAP agent was used to obtain the posture token for the user.

Answer(s): B

Explanation:

We see System Posture Status: HEALTHY(0)
End systems that pass all SHV tests receive a Healthy Posture Token, if they fail a single test they receive a Quarantine Posture Token.

Reference:

CLEARPASS ONGUARD CONFIGURATION GUIDE (July 2015), page 13 https://community.arubanetworks.com/aruba/attachments/aruba/aaa-nac-guest-access- byod/21122/1/OnGuard%20config%20Tech%20Note%20v1.pdf

Reveal Solution Next Question

QUESTION: 27

Why can the Onguard posture check not be performed during 802.1x authentication?

Health Checks cannot be used with 802.1x.
Onguard uses RADIUS, so an additional service must be created.
Onguard uses HTTPS, so an additional service must be created.
Onguard uses TACACS, so an additional service must be created.
802.1x is already secure, so Onguard is not needed.

Answer(s): C

Explanation:

OnGuard uses HTTPS to send posture information to the ClearPass appliance. For OnGuard to use HTTPS, it must have access to the network. If a customer requires 802.1x authentication on the wired switch, a separate 802.1x authentication must be used prior to the OnGuard posture check. In this example, an 802.1x PEAP-EAP-MSCHAPv2 authentication is completed first. A separate WebAuth service must be setup with posture checks to use the OnGuard agent. Reference:
MAC Authentication and OnGuard Posture Enforcement using Dell WSeries ClearPass and Dell Networking Switches (August 2013), page 21

Reveal Solution Next Question

QUESTION: 28

Refer to the exhibit.

Based on the Enforcement Profile configuration shown, which statement accurately describes what is sent?

A limited access VLAN value is sent to the Network Access Device.
An unhealthy role value is sent to the Network Access Device.
A message is sent to the Onguard Agent on the client device.
A RADIUS CoA message is sent to bounce the client.
A RADIUS access-accept message is sent to the Controller

Answer(s): C

Explanation:

The OnGuard Agent enforcement policy retrieves the posture token. If the token is HEALTHY it returns a healthy message to the agent and bounces the session. If the token is UNHEALTHY it returns an unhealthy message to the agent and bounces the session.

Reference:

CLEARPASS ONGUARD CONFIGURATION GUIDE (July 2015), page 27

Reveal Solution Next Question

Free HPE6-A68 Exam Braindumps (page: 7)

QUESTION: 25

Explanation:

QUESTION: 26

Explanation:

Reference:

QUESTION: 27

Explanation:

QUESTION: 28

Explanation:

Reference: