Free HPE Networking ClearPass Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the HPE Networking ClearPass Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In an 802.1X access exchange, which entity acts as the authenticator?

   1. A.The endpoint supplicant
   2. B.The RADIUS server
   3. C.The identity directory
   4. D.The network access deviceCorrect answer: D

   Explanation: "There are three entities: supplicant (client device), authenticator (network device), and the authentication server (commonly a RADIUS server)." The network device is the authenticator; the endpoint is the supplicant and the server supplies authentication.

   Reference: ClearPass Wired Policy Enforcement Guide — 802.1X

2. 2Which ClearPass component provisions unique device credentials and network settings for BYOD devices?

   1. A.OnGuard
   2. B.OnboardCorrect answer: B
   3. C.Insight
   4. D.Access Tracker

   Explanation: "Secure provisioning of unique device credentials for BYOD and IT‐managed devices." Onboard provisions the credentials and settings; OnGuard assesses posture, Insight reports historical activity, and Access Tracker displays request activity.

   Reference: Aruba ClearPass Guest 6.12 Online Help — Onboard Feature List

3. 3What is an authentication source in ClearPass Policy Manager?

   1. A.A database of completed authentication session logs
   2. B.A switch configuration that enforces a returned VLAN
   3. C.An identity store against which users and devices are authenticatedCorrect answer: C
   4. D.A rule that maps a request to a network enforcement profile

   Explanation: "An authentication source is the identity store (Active Directory, LDAP directory, etc.) against which users and devices are authenticated." The source supplies the identity store. Service rules, logs, and switch enforcement perform different functions.

   Reference: ClearPass Policy Manager 6.11 Online Help — Adding and Configuring Authentication Sources

4. 4Two enabled ClearPass services have rules that both match a request. Which service is selected?

   1. A.The first matching service in the configured orderCorrect answer: A
   2. B.The last matching service in the configured order
   3. C.The service with the most enforcement profiles
   4. D.The service with the newest authentication source

   Explanation: "The service associated with the first matching service rule is then associated with this request." ClearPass selects the first match, so a broad rule above a specific rule can capture the request.

   Reference: ClearPass Policy Manager 6.11 Online Help — Completing the Cisco Downloadable ACL Setup: Reorder Services

5. 5In the Guest Authentication with MAC Caching template, what happens on subsequent logins while a cached MAC is valid?

   1. A.The switch skips all authentication for the device.
   2. B.MAC authentication bypasses the captive portal.Correct answer: B
   3. C.Every login requires a new captive portal password.
   4. D.The guest must enroll a new EAP-TLS certificate.

   Explanation: "Subsequent logins will use MAC authentication and bypass the Captive Portal." The template uses MAC authentication after the initial portal login; bypassing the portal does not mean bypassing authentication.

   Reference: ClearPass Policy Manager 6.7 Guest Authentication with MAC Caching Service Template — Guest Authentication with MAC Caching Service Template

6. 6What does a ClearPass role-mapping policy derive for enforcement evaluation?

   1. A.Enforcement profiles directly from RADIUS packets
   2. B.Authentication methods from guest receipt settings
   3. C.Accounting records from device profile changes
   4. D.Roles from client identity or request attributesCorrect answer: D

   Explanation: "A Role-Mapping Policy reduces client (user or device) identity or attributes associated with the request to Role(s) for Enforcement Policy evaluation." Role mapping derives roles from request identity and attributes; enforcement profiles define actions, authentication methods verify identity, and accounting records describe sessions.

   Reference: ClearPass Policy Manager 6.10: Identity Roles Architecture and Workflow — Identity Roles Architecture and Workflow

7. 7Which certificate-related mechanism can ClearPass Onboard's certificate authority use for certificate enrollment?

   1. A.SCEPCorrect answer: A
   2. B.OCSP
   3. C.CRL
   4. D.RADIUS CoA

   Explanation: "Supports SCEP enrollment of certificates" SCEP provides enrollment; the same feature list describes OCSP for status and CRLs for revocation lists, while CoA is dynamic authorization.

   Reference: Aruba ClearPass Guest 6.12 Online Help — Onboard Feature List: Certificate Authority

8. 8Which ClearPass cluster node accepts configuration database writes?

   1. A.The standby subscriber before promotion
   2. B.Every Insight-enabled node
   3. C.The publisherCorrect answer: C
   4. D.Any subscriber

   Explanation: "Administration, configuration, and database write operations can occur only on the Publisher." The publisher accepts configuration writes; subscribers hold replicated read-only configuration copies.

   Reference: HPE Aruba Networking ClearPass Policy Manager 6.12 User Guide — Introduction

9. 9Why should MAC authentication be combined with other authorization signals such as device profiling?

   1. A.Because MAC addresses can be impersonated.Correct answer: A
   2. B.Because MAC addresses cannot be observed by a switch.
   3. C.Because MAC addresses cannot be sent in RADIUS requests.
   4. D.Because MAC addresses prove device type without profiling.

   Explanation: "One thing to be aware of is that MAC addresses can be spoofed." A copied MAC can impersonate a registered device; profiling provides additional context. The switch can send the MAC in RADIUS, and the MAC alone does not prove device type.

   Reference: ClearPass Wired Policy Enforcement Guide — MAC Authentication

10. 10Which ClearPass feature performs endpoint health assessments for use in network access policy?

    1. A.Onboard
    2. B.Insight
    3. C.Guest
    4. D.OnGuardCorrect answer: D

    Explanation: "Policy Manager OnGuard performs advanced endpoint posture assessments by running checks on the endpoints that are attempting to gain access to the network." OnGuard supplies posture information. Onboard provisions devices, Insight reports activity, and Guest manages guest workflows.

    Reference: ClearPass Policy Manager 6.11 Online Help — OnGuard Authentication Configuration: Overview