Quiz
ClearPass
Erstelle ein kostenloses Konto, um dieses Quiz zu beenden
Speichere deinen Fortschritt und sieh dir dein Endergebnis an.
oder mit deiner E-Mail registrieren
Schon ein Konto? Anmelden
Fragen in diesem Quiz (57)
1A customer is setting up Guest access with ClearPass. They are considering using 802.1X for both the Employee network and the Guest network.
What are two issues the customer may encounter when deploying 802.1X with the Guest network? (Choose two.)- AClearPass will not be able to enforce individual Access Control policies.
- Bdifficult to maintain in an environment with a large number of transient guest users.
- Cthe lack of encryption during the authentication process
- DGuests will not be able to be uniquely identified.
- Ethe high level of complexity for users to join the guest network.
2Where will the guests browser be redirected during a captive portal login attempt?
securelogin.arubanetworks.com- AThe redirect will time out and fail to resolve.
- BThe captive portal page hosted on Aruba Central in the cloud
- CThe captive portal page hosted on the Aruba controller.
- DThe captive portal page hosted on ClearPass.
3An organization has configured guest self-registration with internal sponsorship.
Which options can be configured to send guest users their credentials outside of the initial login web-page? (Choose two.)- AConfigure a Simple Mail Transport Protocol (SMTP) server in ClearPass Policy Manager administration.
- BConfigure a Simple Mail Transport Protocol (SMTP) server in ClearPass Guest administration
- CConfigure a Short Message Service (SMS) Gateway in ClearPass Policy Manager administration
- DConfigure a Short Message Service (SMS) Gateway under ClearPass Guest configuration
- EConfigure the self-registration page for the guest to receive a Simple Mail Transport Protocol (SMTP) receipt
4A client is attempting to authenticate using their Windows account with a bad password.
If the Remote Lab AD server is down for maintenance, what will be the expected result?
- AClearPass receives a timeout attempt when trying the Remote Lab AD server first. It will then try the server Backup 1 and receive a result of Active Directory Authentication failed. No further processing will occur
- BClearPass try either server Backup 1 or Backup 2 depending on which has responded the fastest in prior attempts to authenticate ClearPass will then receive a result of Active Directory Authentication failed. No further processing will occur.
- CClearPass receives a timeout attempt when trying the Remote Lab AD server first. It will then try the server Backup 1 and Backup 2; both will send a result authentication failed
- DClearPass receive a timeout attempt when trying the Remote Lab AD server first. No further processing will occur until the Remote Lab AD server is marked as "Down" by the Administrator.
5When ClearPass is communicating with external context servers, which connection protocol is typically used?
- AFTP over SSH
- BREST APIs over HTTPS
- CSOAP and XML
- DYAML
6ClearPass receives fingerprinting profile data for a client device that is based on MAC OUI, NMAP, DHCP, and OnGuard.
Which fingerprint or fingerprints are used?- ANMAP because it is actively obtained
- BThe last fingerprint gathered
- COnGuard because it is application based
- DAll fingerprints are applied
7What does Search Base Dn do when joining an Active Directory domain? (Choose two.)
- Avalidates the connection details entered in the Connection Details
- Bsearches for the Base DN (Distinguished Name) based on what was typed in the field
- Csets the starting point in the directory tree for the Base DN (Distinguished Name) search
- Dupdates the Base DN (Distinguished Name) in Active Directory if no match is found
- Eruns an Active Directory query that returns all results along with any matching the entered Base DN (Distinguished Name)
8Which fingerprint collectors can help to distinguish between an iPhone and an iPad? (Choose two.)
- ASNMP
- BIF-MAP
- CMAC OUI
- DTCP header capture
- EHTTP
9Sponsorship has been enabled on the guest network. A guest user connects and completes the self-registration form indicating a valid sponsor. The guest then clicks submit.
What is the current state of the guest account?- AThe guest account is created in an enabled state with the "Log In" button functional.
- BThe guest account is created in disabled state, the "Log In" button will appear only after the sponsor approval process is completed.
- CThe guest account is created in a disabled state with the "Log In" button grayed out.
- DThe guest account is not yet created and remains in a disabled state. There is not "Log In" button yet displayed.
10What is the purpose of service rules in ClearPass?
- Aselects the Enforcement Profiles used in a service
- Bselects the Service to process a request
- Cselects the Authentication Source for the client
- Dselects the Posture Policy used with OnGuard
11What is a function of the posture token in ClearPass OnGuard? (Choose two.)
- AIdentifies clients that are not security compliant.
- BInitiates the Auto-Remediation process.
- CIndicates the Health Status of the Client
- DDenies access to unhealthy clients.
- EControls access to network resources
12Which ClearPass feature assesses endpoint context and client device type?
- AProfiling
- BCaptive Portal
- COnboard
- DPosture
13When should a role mapping policy be used in an 802.1x service with Active Directory as the authentication source?
- AWhen you want to match Active Directory attributes directly to an enforcement policy.
- BWhen you want to match Active Directory attributes to an Aruba firewall role on an Aruba Network Access Device.
- CWhen you want to translate and combine Active Directory attributes into ClearPass roles.
- DWhen you want to enable attributes as roles directly without combining multiple attributes.
14What is a good collector type used for ClearPass to discover devices with static IP addresses?
- ADHCP Collectors
- BClearPass Air Monitors
- CActive Collectors
- DNetwork Functions
15When is it appropriate to use the built-in Local user database in ClearPass?
- AIn a public-facing guest network environment where the guests are prompted to self-register
- BIn small-business environments where the user accounts rarely change and new accounts are uncommon.
- CIn a hospitality deployment for guest accounts created and managed by staff.
- DIn a large campus environment where Students and Contractors account for 35.000 entries that change weekly
16What are two consequences of the Cache Timeout being set to 36000 seconds? (Choose two.)
- AClearPass will cache all user and machine attributes from AD every 10 hours in anticipation of one of those users or machines attempting to authenticate
- BLess traffic is required between ClearPass and the AD server when re-authenticating within a 10 hour period
- CThe Cache Timeout is designed to reduce the amount of traffic between ClearPass and the AD server by caching user credentials for a 10 hour period
- DA user changing departments may not see their Department attribute change in AD reflected while authenticating until the Cache Timeout period has ended
- EOn a failed authentication attempt, ClearPass will consider any subsequent attempts within 10 hours as total failed attempts before blacklisting the client
17When creating a new ClearPass Service, the [Time Source] has been added as an authorization source.
What time source is ClearPass referencing?
- Athe ClearPass server where Insight Master has been enabled
- Bthe local clock of the ClearPass server doing the authentication
- Cthe local time setting found on the authenticating client machine
- Dthe NTP (Network Time Protocol) source indicated in the Cluster settings
18What is an effect of the Cache Timeout setting on the authentication source settings for Active Directory?
- AClearPass will validate the user credentials, then, for the duration of the cache, ClearPass will just fetch account attributes
- BThe Cache Timeout is designed to reduce the amount of traffic between ClearPass and the A/D server by caching the attributes
- CClearPass will validate the user credentials on the first attempt, then will always fetch the account attributes.
19Which user authentication request will match the service rules of the Policy Service shown?
- Aa wireless user connection would fail because of miss-configured service rules
- Ba wireless user connected to any SSID named "CORP"
- Ca wireless user connecting to any SSID on an Aruba Controller
- Da wireless user connecting to an Aruba IAP on the SSID "CORP"
20What is the significance of using the [Allow ALL MAC AUTH] as an Authentication Method for Guests?
- AClient attempts will fail without an additional Authentication method applied
- BAll clients with unknown endpoints will be granted guest access regardless of authorization
- CAll clients with known endpoints will be granted guest access regardless of authorization.
- DThis removes the reliance on the known or unknown status for MAC authentication.
21What is true regarding Posturing and Profiling?
- AProfiling describes categorizing the user based on their department while Posturing validates the user as authenticated.
- BProfiling is the act of identifying the endpoint type while Posturing is assigning a status as to the health of the endpoint.
- CPosturing and Profiling are role assignments in ClearPass used internally to map to enforcement policies.
- DBoth Posturing and Profiling describe the same thing; what is the health of the client endpoint?
22Which option supports DHCP profiling for devices in a network?
- ADHCP profiling is enabled on ClearPass by default; configuration of DHCP relay on the Network Access Device (NAD) is not required
- BConfiguring DHCP relay on ClearPass in order to allow the client to receive DHCP after being profiled.
- CEnabling the DHCP server to profile endpoints and forward the meta-data to ClearPass.
- DEnabling DHCP relay on Network Access Devices (NADs) to forward DHCP requests to ClearPass.
23A user connects to an Aruba Access Point wireless SSID named "Secure-Corporate" and performs an 802.1X authentication with ClearPass as the authentication server.
Based on this service configuration, which service will be triggered?
- ANo service will be triggered
- BService Three
- CService Two
- DService One
24Which two are required to add a Network Access Device (NAD) into ClearPass? (Choose two.)
- AHTTPS certificate
- BNAD IP address
- CClearPass Admin login credentials
- DShared Secret
- ESSH password
25Which configuration options are necessary to add a Network Access Device into the ClearPass Policy Manager? (Choose two.)
- AHTTPS certificate
- BClearPass Admin Password
- CCLI Console Password
- DNAD IP Address
- EShared Secret
26Which must be taken into account if a customer wants to use the DHCP collector with 802.1X authentication?
- AWhen a client sends an authentication request to ClearPass, the profiler will also gather DHCP information
- BBecause DHCP fingerprinted is a Layer-3 function, it cannot be used with an 802.1X authentication service.
- CThe client needs to connect to an open network first to be profiled, then shifted to the secure 802.1x network
- DThe client needs to be granted limited access before the enforcement policy can take into account the device type
27Which statement is true about OnGuard? (Choose two.)
- AIt is used to ensure that Antivirus/Antispyware programs are running
- BIt supports both Windows and Mac OS X clients
- CIt is used to identify and remove any malware/viruses
- DIt only supports 802.1X authentication
28Which are valid enforcement profile types? (Choose two.)
- AClearPass Entity Update Enforcement
- BAruba Script Enforcement
- CPolicy Service Enforcement
- DRADIUS Change of Authorization (CoA)
29What are "known" endpoints in ClearPass?
- A"Known" endpoints have be fingerprinted to determine their operating system and manufacturer.
- BThese are endpoints whose beacons have been detected but have never completed authentication
- CThe label "Known" indicates rogue endpoints labeled as "friendly" or "ignore"
- D"Known" endpoints can be authenticated based on MAC address to bypass the captive portal login.
30Which option supports DHCP profiling for devices in a network?
- Aconfiguring ClearPass as a DHCP relay for the client
- BDHCP profiling is enabled on ClearPass by default; configuration of the network access devices is not necessary
- Cenabling the DHCP server to profile endpoints and forward meta-data to ClearPass
- Denabling DHCP relay on our network access devices so DHCP requests are forwarded to ClearPass
31What is RADIUS Change of Authorization (CoA)?
- AIt is a mechanism that enables ClearPass to assigned a User-Based Tunnel (UBT) between a switch and controller for Dynamic Segmentation.
- BIt allows clients to issue a privilege escalation request to ClearPass using RADIUS to switch to TACACS+
- CIt allows ClearPass to transmit messages to the Network Attached Device/Network Attached Server (NAD/NAS) to modify a userג€™s session status
- DIt forces the client to re-authenticate upon roaming to an access point controlled by a foreign mobility controller.
32A customer with 677 employees would like to authenticate employees using a captive portal guest web login page. Employees should use their AD credentials to login on this page.
Which statement is true?- AThe customer needs to add second guest service in the policy manager for the guest network.
- BThe customer needs to add the AD server as an authentication source in a guest service.
- CEmployees must be taken to a separate web login page on the guest network.
- DThe customer needs to add the AD servers RADIUS certificate to the guest network.
33What happens when a client successfully authenticates but does not match any Enforcement Policy rules?
- AA RADIUS reject is returned for the client.
- BA RADIUS Accept is returned with no Enforcement Profile applied.
- CA RADIUS Accept is returned, and the default Enforcement Profile is applied.
- DA RADIUS Accept is returned, and the default rule is applied to the device.
34Your boss suggests configuring a guest self-registration page in ClearPass for an upcoming conference event.
What are the benefits of using guest self-registration? (Choose two.)- AThis will allow conference employees to pre-load additional device information as guests arrive and register.
- BThis strategy effectively stops employees from putting their own corporate devices on the guest network.
- CThis will enable additional information to be gathered about guests during the conference.
- DThis allows guest users to create and manage their own login account.
- EThis will allow employee personal devices to be Onboarded to the corporate network.
35Which Authorization Source supports device profile enforcement?
- ALocal User Repository
- BOnGuard Repository
- CEndpoints Repository
- DGuest User Repository
36Which items can be obtained from device profiling? (Choose three.)
- ADevice Category
- BDevice Family
- CDevice Health
- DDevice Type
- EDevice Location
37Which is true regarding the Cisco Device Sensor feature in ClearPass? (Choose two.)
- AForwards DHCP and HTTP user-agent info to ClearPass using Control and Datagram Transport Layer Security (DTLS) encapsulation
- BRequires the purchase of a supported Cisco Access Point licensed as an Aruba Monitor Mode AP, to then act as the sensor.
- CForwards DHCP and HTTP user-agent info to ClearPass using RADIUS accounting packets.
- DGathers raw endpoint data from Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP).
- ERequires a Cisco Smart Net license to be installed on the Network Access Device (NAD) utilizing the feature
38Which most accurately describes the "Select All Matches" rule evaluation algorithm in Enforcement Policies?
- AEach rule is checked, and once a match is found, the Enforcement profile assigned to that rule is applied and the rule matching stops
- BAll rules are checked, and if there is no match, no Enforcement profile is applied.
- CAll rules are checked for any matching rules and their respective Enforcement profiles are applied.
- DEach rule is checked, and once a match is found, the Enforcement profile assigned to that rule is applied, along with the default Enforcement profile.
39When using Guest Authentication with MAC Caching service template, which statements are true? (Choose two.)
- AThe guest authentication is provided better security than without using MAC caching
- BThe endpoint status of the client will be treated as "known" the first time the client associates to the network.
- CWhich wireless SSID and wireless controller must be indicated when configuring the template.
- DThe client will be required to re-enter their credentials even if still within the MAC-Auth Expiry term.
40What is true regarding leaving the indicated option "Use cached Roles and Posture attributes from previous sessions" unchecked?
- AA posture change applied to an endpoint is going to be lost each time the client re-authenticates.
- BThe service will make the enforcement decision based upon the updated Posture regardless of caching.
- CPosturing will no longer be evaluated in determining the enforcement policy for current or future sessions.
- DCached posture results are no longer stored by ClearPass but instead are saved to the endpoint of the client
41What are benefits of using Network Device Groups in ClearPass? (Choose two.)
- ANetwork Access Devices (NADs) only require Aruba factory installed certificates to join a Network Device Group.
- BAllows Service selection rules to match based upon which Network Device Group the Network Access Device (NAD) belongs to.
- CA Network Access Device is must be discovered by ClearPass prior to be added to a Network Device Group
- DAnother way to add a customizable "attribute" field to reference when processing authentication requests.
- ECan apply to both Network Access Devices (NADs) as well as client machines as a way to filter authentication requests
42Which authentication method requires a client certificate?
- AEAP-TLS
- BGuest self-registration
- CPEAP
- DMAC Authentication
43What needs to be configured for ClearPass use an enforcement rule base on client Data Cap?
- AEnable Logging of Accounting Start-Stop packets.
- BInterim Accounting on the Network Access Device (NAD).
- CMake sure the Endpoint Profiling is configured
- DEnable Active Sessions in ClearPass Guest
44What are possible ways that it was profiled? (Choose two.)
- AExchange Plugging agent
- BNAD ARP listening handler
- C3rd part MDM
- DDNS fingerprinting
- ECisco Device Sensor
45Aruba self-registration with sponsorship is a solution best applied to which type of network?
- Aa large corporate environment with hundreds of contractors requiring wireless access to printers and internet but no other guest access is allowed
- Ba chain of auto part stores where employees are assigned mobile devices using a Mobile Device Manager (MDM) and public wireless is available for customers
- Ca hotel where hundreds of guests are checked in and out of the building daily that may want access to wireless internet
- Da chain of coffee shops using in a public downtown area with a high amount of guest turnover needing access to public wireless
46When joining ClearPass to an Active Directory (AD) domain, what information is required? (Choose two.)
- AFully Qualified Domain Name (FQDN) of the AD Domain Controller.
- BClearPass Policy Manager (CPPM) enterprise credentials.
- CDomain Administrator credentials with at least read access.
- DCache Timeout value set to at least 10 hours.
- EDomain User credentials with read-write access.
47What does a bold field indicate?
- AThe field is a non-system field
- BThe field is currently enabled
- CThe field has been customized
- DThe field is required
48An organization with 347 employees wants to have the guest create their own accounts for access to the public WLAN, and when guests reconnect, they do not want the guest to have to log in again.
Which ClearPass features can be used to meet these requirements?- AGuest access with MAC caching
- BGuest self-registration with sponsor approval
- CEnforcement based on endpoint profiling
- DClearPass Onboard Portal
49What services are recommended to be allowed by the pre-authenticated role assigned to the Client during the Captive Portal process? (Choose three.)
- ADHCP options 43 and 150
- BRADIUS to ClearPass
- CHTTPS to ClearPass
- DHTTPS to the Internet
- EDHCP address assignment
- FDNS resolution
50An organization wants guests to be able to create their own guest accounts for access to the public WLAN. Guests do not want to have to repeatedly log in multiple times through the day.
Which ClearPass feature can meet these requirements?- AClearPass Onboard Portal.
- BGuest access with Media Access Control (MAC) caching.
- CEnforcement based on endpoint profiling.
- DGuest self-registration with sponsor approval.
51What will be the enforcement for the user "neil"?
- AAllow Full Access
- BSecure Corp BYOD Access
- CAllow Internet Only Access
- DCorp Secure Contractor
52Which actions are necessary to set up a ClearPass guest captive portal web login page to execute with no errors? (Choose two.)
- AConfigure the vendor settings in the Web Login page to match the Network Access Device (NAD).
- BInstall a publicly signed HTTPS certificate in ClearPass and the Network Access Device (NAD).
- CInstall an enterprise Certificate Authority (CA) signed HTTPS certificate in the Network Access Device (NAD).
- DInstall an enterprise Certificate Authority (CA) signed HTTPS certificate in ClearPass and the Network Access Device (NAD)
- EConfigure the vendor settings in the Network Access Device (NAD) to match the web login page.
53What is the benefit of installing a wild card certificate for captive portal authentication?
- AWild card certificates provide greater security than normal certificates.
- BAllows different certificates for each controller for increased security.
- CGuests no longer are required to validate certificates during captive portal.
- DAllows the single wild card certificate to be installed on all controllers in the environment.
54What are two ways to add guest accounts to ClearPass? (Choose two.)
- AImporting accounts from Active Directory once ClearPass is added with Admin credentials.
- BAssigning the default role "Lobby Ambassador to a receptionist to then add the accounts
- CUsing the "Import Accounts" under ClearPass Guest
- DUsing the "Create Account" or "Create Multiple" options under ClearPass Guest.
- EUsing the "Sync Accounts" under ClearPass Guest.
55Which ClearPass fingerprint collectors are valid for active profiling of endpoints? (Choose two.)
- AHTTP user agents
- BIF-MAP
- CDHCP fingerprinting
- DNMAP
- ESNMP
56An organization wants to have guests connect their own personal devices to the wireless network without requiring a receptionist setting up a guest account.
Which ClearPass feature can be used to meet the organization's requirements?- APolicy Manager Enforcement
- BMAC authentication with profiling
- CClearPass Onboard
- DGuest with self-registration
57Which Authorization Source support device profile enforcement?
- AOnGuard Repository
- BLocal user Repository
- CGuest User Repository
- DEndpoint Repository
Informationen
- Beschreibung
- Informática Quiz am ClearPass, erstellt von Gerson Sa am 14/02/2022.
- Autor
- Gerson Sa
- Sprache
- Español
- Aufrufe
- 0
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz