NEW QUESTION 1
What are "Known" endpoints in ClearPass?

• A. These are endpoints whose beacons have been detected but have never completed authentication
• B. The label "Known" indicates rogue endpoints labeled as "friendly" or "ignore"
• C. "Known" endpoints have be fingerprinted to determine their operating system and manufacturer.
• D. "Known" endpoints can be authenticated based on MAC address to bypass the captive portal login.

Answer: D

NEW QUESTION 2
An organization with 345 employees wants to have the guest create their own accounts for access to the public WLAN. and when guests reconnect they do not want the guest to have to tog in again
Which ClearPass features can be used to meet these requirements?

• A. ClearPass Onboard Portal
• B. Guest access with MAC caching
• C. Guest serf-registration with sponsor approval
• D. Enforcement based on endpoint profiling

Answer: B

NEW QUESTION 3
Refer to the Endpoint in the screenshot.

What are possible ways that it was profiled? (Select two)

• A. Cisco Device Sensor
• B. Exchange Plugging agent
• C. 3rd part MDM
• D. DNS fingerprinting
• E. NAD ARP listening handler

Answer: CE

NEW QUESTION 4
When should a role mapping policy be used in an 802.1x service with Active Directory as the authentication source?

• A. When you want to match Active Directory attributes directly to an enforcement policy.
• B. When you want to enable attributes as roles directly without combining multiple attributes
• C. When you want to translate and combine Active Directory attributes into ClearPass roles.
• D. When you want to match Active Directory attributes to a Aruba firewall role on a Aruba Network Access Device.

Answer: A

NEW QUESTION 5
Which authentication method requires a client certificate?

• A. PEAP
• B. Guest serf-registration
• C. EAP-TLS
• D. MAC Authentication

Answer: C

NEW QUESTION 6
What are benefits of using Network Device Groups in ClearPass? (Select two.)

• A. Allows Service selection rules to match based upon which Network Device Group the Network Access Device (NAD) belongs to
• B. Network Access Devices (NADs) only require Aruba factory installed certificates to join a Network Device Group
• C. A Network Access Device is must be discovered by ClearPass prior to be added to a Network Device Group
• D. Another way to add a customizable "attribute" field to reference when processing authentication requests
• E. Can apply to both Network Access Devices (NADs) as wen as client machines as a way to filter authentication requests

Answer: D

NEW QUESTION 7
Which most accurately describes the "Select All Matches" rule evaluation algorithm in Enforcement Policies?

• A. Each rule is checked, and once a match is found, the Enforcement profile assigned to that rule is applied and the rule matching stops.
• B. All rules are checke
• C. And if there is no match no Enforcement profile is applied.
• D. Each rule is checked, and once a match is found, the Enforcement profile assigned to that rule ts applied, along with the default Enforcement profile.
• E. All rules are checked for any matching rules and their respective Enforcement profiles are applied.

Answer: D

NEW QUESTION 8
When ClearPass is communicating with external context servers, which connection protocol is typically used?

• A. YAML
• B. SOAP and XML
• C. REST APIs over HTTPS
• D. FTP over SSH

Answer: B

NEW QUESTION 9
An organization has configured guest self-registration with internal sponsorship Which options can be configured to send guest users their credentials outside of the initial login web-page? (Select two )

• A. Configure a Short Message Service (SMS) Gateway under ClearPass Guest configuration.
• B. Configure the self-registration page for the guest to receive a Simple Mali Transport Protocol (SMTP) receipt
• C. Configure a Short Message Service (SMS) Gateway in ClearPass Policy Manager administration.
• D. Configure a Simple Mail Transport Protocol (SMTP) server in ClearPass Guest administration.
• E. Configure a Simple Man Transport Protocol (SMTP) server in ClearPass Policy Manager administration

Answer: BE

NEW QUESTION 10
Match the correct Profiling Collector with the Collector Type. Collector Types may be used more than once.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:

NEW QUESTION 11
What are two ways to add guest accounts to ClearPass? (Select two.)

• A. Using the "Import Accounts" under ClearPass Guest
• B. Using the "Create Account" or "Create Multiple'' options under ClearPass Guest
• C. Assigning the default role "Lobby Ambassador to a receptionist to then add the accounts
• D. Using the "Sync Accounts'' under ClearPass Guest
• E. importing accounts from Active Directory once ClearPass is added with Admin credentials

Answer: AB

NEW QUESTION 12
Select all that apply
Match the security description to the term that best fits. Options are used only once.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:

NEW QUESTION 13
Which ClearPass feature assesses endpoint context and client device type?

• A. Profiling
• B. Posture
• C. Captive Portal
• D. Onboard

Answer: A

NEW QUESTION 14
Aruba self-registration with sponsorship is a solution best applied to which type of network?

• A. a chain of auto part stores where employees are assigned mobile devices using a Mobile Device Manager (MDM) and public wireless is available for customers
• B. a large corporate environment with hundreds of contractors requiring wireless access to printers and internet but no other guest access is allowed
• C. a hotel where hundreds of guests are checked in and out of the building daily that may want access to wireless internet
• D. a chain of coffee shops using in a public downtown area with a high amount of guest turnover needing access to public wireless

Answer: B

NEW QUESTION 15
Refer to the exhibit.

A client is attempting to authenticate using their Windows account with a bad password if the Remote Lab AD server is down for maintenance, what win be the expected result?

• A. ClearPass receives a timeout attempt when trying the Remote Lab AD server firs
• B. It will then try the server Backup 1 and receive a result of Active Directory Authentication faile
• C. No further processing will occur.
• D. ClearPass try either server Backup 1 or Backup 2 depending on which has responded the fastest in prior attempts to authenticate ClearPass will then receive a result of Active Directory Authentication failed.No further processing will occur.
• E. ClearPass receives a timeout attempt when trying the Remote Lab AD server firs
• F. It will then try the server Backup 1 and Backup 2; both will send a result authentication failed.
• G. ClearPass receive a timeout attempt when trying the Remote Lab AD server firs
• H. No further processing will occur until the Remote Lab AD server is marked as "Down" by the Administrator.

Answer: A

NEW QUESTION 16
What services are recommended to be allowed by the pre-authenticated role assigned to the Client during the Captive Portal process? (Choose three.)

• A. DHCP options 43 and 150
• B. RADIUS to ClearPass
• C. HTTPS to ClearPass
• D. HTTPS to the Internet
• E. DHCP address assignment
• F. DNS resolution

Answer: CEF

NEW QUESTION 17
An organization wants to have guests connect their own personal devices to the wireless network without requiring a receptionist setting up a guest account. Which ClearPass feature can be used to meet the organization's requirements?

• A. Guest with self-registration
• B. ClearPass Onboard
• C. MAC authentication with profiling
• D. Policy Manager Enforcement

Answer: A

NEW QUESTION 18
What needs to be configured for ClearPass use an enforcement rule base on client Data Cap?

• A. Interim Accounting on the Network Access Device (NAD).
• B. Enable Active Sessions in ClearPass Guest
• C. Enable Logging of Accounting Start-Stop packets.
• D. Make sure the Endpoint Profiling is configured

Answer: A

NEW QUESTION 19
When is it appropriate to use the built-in Local user database in ClearPass?

• A. In small-business environments where the user accounts rarely change and new accounts are uncommon.
• B. In a hospitality deployment for guest accounts created and managed by start
• C. In a public-facing guest network environment where the guests are prompted to self-register
• D. In a large campus environment where Students and Contractors account for 35.000 entries that change weekly

Answer: D

NEW QUESTION 20
When using Guest Authentication with MAC Caching service template, which statements are true? (Select two.)

• A. The guest authentication is provided better security than without using MAC caching
• B. The guest authentication is provided better security than without using MAC caching
• C. The endpoint status of the client will be treated as "known" the first time the client associates to the network
• D. Which wireless SSID and wireless controller must be indicated when configuring the template
• E. The client will be required to re-enter their credentials even if still within the MAC-Auth Expiry term

Answer: AD

NEW QUESTION 21
What is the benefit to installing a wild card certificate for captive portal authentication?

• A. Guests no longer are required to validate certificates during captive portal.
• B. Allows different certificates for each controller for increased security
• C. Wild card certificates are provide greater security than normal certificates
• D. Allows the single wild card certificate to be installed on all controllers in the environment

Answer: D

NEW QUESTION 22
Match the ClearPass system description to the best term Options are used only once.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:

NEW QUESTION 23
Refer to the exhibit.

What does Starch Base Dn do when joining an Active Directory domain? {Select two.)

• A. sets the starting point in the directory tree for the Base DN (Distinguished Name) search
• B. searches for the Base DN (Distinguished Name) based on what was typed in the field
• C. runs an Active Directory query that returns all results along with any matching the entered Base DN (Distinguished Name)
• D. validates the connection details entered in the Connection Details
• E. updates the Base DN (Distinguished Name) in Active Directory if no match is found

Answer: AD

NEW QUESTION 24
A customer is setting up Guest access with ClearPass. They are considering using 802.1X for both the
Employee network and the Guest network. What are two issues the customer may encounter when deploying 802.1X with the Guest network? (Select two)

• A. the lack of encryption during the authentication process
• B. ClearPass win not be able to enforce individual Access Control policies.
• C. the high level of complexity for users to join the guest network
• D. Guests will not be able to be uniquely identified.
• E. difficult to maintain in an environment with a large number of transient guest users

Answer: CE

NEW QUESTION 25
......