HPE Networking ClearPass (HPE6-A88) Certification Sample Questions

01. A public library network gives staff Wi-Fi access with a single pre-shared key. The IT team plans to replace it with Onboard-issued certificates and EAP-TLS for staff devices. Which two benefits does this change provide?
(Select two.)
a) Access Tracker can tie each connection to a specific user and device
b) Staff devices no longer need ClearPass to authorize each connection
c) Wi-Fi traffic is encrypted, which a pre-shared key cannot provide
d) Role mapping can use user and device attributes read from each certificate

02. During a match, a WAN fault cuts a stadium's AOS-CX switches off from every ClearPass Policy Manager node. Point-of-sale terminals that reconnect during the outage must still reach the local payment gateway, while unknown devices must not receive full access.
Which switch-side role addresses this situation?
a) The default role that the Role Mapping Policy assigns
b) A critical role applied when no RADIUS server responds
c) An initial role widened to allow all traffic until CPPM returns
d) A reject role applied when CPPM returns an Access-Reject

03. A government agency's ClearPass cluster has a Publisher and three Subscribers. The operations manager requires that, if the Publisher fails outside business hours, configuration changes such as new guest accounts become possible again without an administrator taking any action.
Which configuration meets this requirement?
a) Add a second Publisher to the cluster so each Publisher holds a writable copy
b) Schedule nightly configuration backups so a replacement Publisher can be restored
c) Designate one Subscriber as the Standby Publisher
d) Configure a virtual IP address shared by the Publisher and one Subscriber for the network devices

04. Several staff tablets in a public library network, all onboarded during the same week, stop connecting to the secure SSID on the same day. Access Tracker shows each EAP-TLS request rejected because the client certificate has expired; the staff accounts are active.
What restores access for these tablets?
a) Add the Onboard root CA to the ClearPass certificate trust list
b) Revoke the expired certificates in Onboard so the stale sessions are cleared first
c) Reset the staff members' Active Directory passwords and resync the tablets
d) Run each tablet through Onboard again so it receives a new EAP-TLS certificate

05. A city council wants its ClearPass administrators to log in to the Policy Manager admin interface with their Active Directory accounts instead of local admin accounts. Members of the NetOps group must get full administrative rights, and members of the HelpDesk group read-only rights.
Which two configurations are required?
(Select two.)
a) Assign TACACS+ privilege levels on the access switches for each group
b) Map each AD group to a role and return the matching admin privilege level
c) Create a Guest operator profile for each group with its level of access
d) Create a separate local admin user in ClearPass for each NetOps and HelpDesk team member
e) Authenticate admin logins against an Active Directory authentication source

06. A research laboratory replaced a failed standalone ClearPass server and restored the most recent backup onto the new appliance. Services, policies and authentication sources came back exactly as they were, but when auditors ask for last month's authentication history, Access Tracker shows no requests from before the failure.
Why are the older records missing?
a) Session records are rebuilt from the switches' RADIUS accounting after a restart
b) Access Tracker history is kept only in Insight, so a restore of Policy Manager never brings it back
c) The backup captured the configuration only, so it never contained the authentication history
d) A restore deliberately clears Access Tracker so old sessions cannot be replayed

07. A coworking space uses colorless AOS-CX ports. Members' laptops authenticate with 802.1X, and member policy depends on who the member is. Shared printers and smart displays have no 802.1X supplicant but must still get their own restricted roles on the same ports.
What port configuration supports both kinds of device?
a) Enable only 802.1X, with a guest VLAN for devices that fail it
b) Enable only MAC authentication, so every device uses one method
c) Disable authentication on the ports where printers are installed
d) Enable 802.1X and MAC authentication together on the ports

08. A state agency's ClearPass nodes present a RADIUS/EAP server certificate issued by the agency's internal CA. Staff laptops connect with PEAP-MSCHAPv2, and their supplicant profile validates the server certificate and trusts only that internal CA. The certificate expires next month, and a project lead proposes replacing it with one bought from a public CA.
Which two statements should shape the renewal plan?
(Select two.)
a) Each switch needs a new RADIUS shared secret, because the EAP certificate secures that secret
b) A public CA certificate needs the laptops set to trust that CA before the swap
c) Laptops check only the certificate's expiry date, so a certificate from any issuing CA is accepted
d) A certificate from the same internal CA, with the same server name, needs no laptop change

09. A K-12 district keeps ClearPass administration on an isolated management network that users, guests and network devices cannot reach. Each ClearPass node has a management interface and a data interface, and switches, controllers and guest browsers reach ClearPass only through the routed user-facing networks.
How should the two interfaces be used?
a) Administration on the management interface, with RADIUS and portal traffic on the data interface
b) All traffic on the data interface, with the management interface left unused
c) Administration on the data interface, with RADIUS on the management interface
d) RADIUS and administration on the management interface, with only the guest portal on the data interface

10. In a retail store, security cameras share a VLAN and subnet with other store devices. A risk review requires that each camera can reach only the network video recorder, and never another camera, even though all cameras sit in the same subnet.
Which approach meets the requirement?
a) Move all cameras into a dedicated camera VLAN and subnet
b) Give each camera a static IP address outside the DHCP scope
c) Return a camera role whose policy permits only traffic to the recorder
d) Classify cameras with profiling so they appear as their own device category