A client is connected to an AOS-CX switch, which tunnels the client's traffic to an AOS-10 gateway. The gateway assigns the client to a role with these rules:any any svc-dhcp permituser alias hostl svc-dns permituser alias net1 svc-https permituser alias net2 tcp 8086 permituser alias net3 any denyuser alias net4 svc-https permitThe gateway has these aliases defined:- host1 = 10.0.6.8- net1 = 10.0.0.0 255.255.252.0- net2 = 10.0.3.0 255.255.255.0- net3 = 10.0.0.0 255.255.248.0- net4 = 10.0.0.0 255.255.0.0The client sends two packets:- 1: tcp 8086 to 10.0.3.75- 2: https to 10.0.7.24What happens?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.You have imported the root certificate for the Windows CA to the ClearPass CA Trust list. Which usages should you add to it based on the scenario requirements?

You are designing an AOS-10 architecture and ClearPass solution for a manufacturing company. The company that has legacy equipment that is only WPA2 capable. You need to enhance security for these devices.This equipment will connect to an SSID named "Factory." If the equipment passes authentication and receives custom Device Category "Manufacturing," it should receive this AOS user role: "equipment." That role and a "profiling" role for unprofiled devices are already configured on the AOS devices.The users responsible for configuring PSKs on the equipment belong to the "FactoryAdmins" group in the company's Active Directory domain. CPPM has an authentication source for that domain named MyAD. As part of the solution, you have created these services on CPPM:- Service 1:- Type: Application- Authentication source: MyAD- Authorization source: None- Enforcement policy:- Rule 1 condition: Authorization:Endpoints Repository:Category EQUALS Manufacturing- Rule 1 profile list: Enforcement profiles that permit application access and assign the Guest Operators role- Default action: Deny access- Service 2- Type: Wireless with mPSK- Authentication source: Guest Devices Repository- Authorization source: None- Enforcement policy:- Rule 1 condition: Endpoint Device Insight Tag EQUALS Manufacturing- Rule 1 profile list: Enforcement profile that assigns Aruba-User-Role = equipment and [Registered Device MPSK] profile- Rule 2 condition: Endpoint:Device Insight Tag NOT_EXISTS- Rule 2 profile list: Enforcement profile that assigns Aruba-User-Role = profiling and [Registered Device MPSK] profile- Default action: Deny accessWhat is an error in this configuration?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.The customer has now decided that it needs CPPM to assign certain mobile-onboarded devices to a "nurse-call" AOS user role. These are mobile-onboarded devices that are communicating with IP address 10.1.18.12 using port 4343.What are the prerequisites for fulfilling this requirement?

A client is connected to an AOS-CX switch, which tunnels the client's traffic to an AOS-10 gateway. The gateway assigns the client to a role with these rules: any any svc-dhcp permit user alias hostl svc-dns permit user alias net1 svc-https permit user alias net2 tcp 8086 permit user alias net3 any deny user alias net4 svc-https permitThe gateway has these aliases defined:- host1 = 10.0.6.8- net1 = 10.0.0.0 255.255.252.0- net2 = 10.0.3.0 255.255.255.0- net3 = 10.0.0.0 255.255.248.0- net4 = 10.0.0.0 255.255.0.0The client sends two packets:- 1: tcp 8086 to 10.0.3.75- 2: https to 10.0.7.24What happens?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.You have imported the root certificate for the Windows CA to the ClearPass CA Trust list. Which usages should you add to it based on the scenario requirements?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8The customer needs a secure way for users to enroll their new wireless clients in Intune. You are recommending a new WLAN that will provide the users with limited access for the enrollment. You have set up captive portal for clients on this WLAN to a web page with instructions for enrolling devices. You will need to add several hostnames to the captive portal allowlist manually.What is one of those hostnames?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.On CPPM, you are creating the authentication source. You have configured the settings shown in the tab and have not altered any other settings.What else do you need to do to help authentication proceed correctly?

You are designing an AOS-10 architecture and ClearPass solution for a manufacturing company. The company that has legacy equipment that is only WPA2 capable. You need to enhance security for these devices.This equipment will connect to an SSID named "Factory." If the equipment passes authentication and receives custom Device Category "Manufacturing," it should receive this AOS user role: "equipment." That role and a "profiling" role for unprofiled devices are already configured on the AOS devices.The users responsible for configuring PSKs on the equipment belong to the "FactoryAdmins" group in the company's Active Directory domain. CPPM has an authentication source for that domain named MyAD. As part of the solution, you have created these services on CPPM:- Service 1:- Type: Application- Authentication source: MyAD- Authorization source: None- Enforcement policy:- Rule 1 condition: Authorization:Endpoints Repository:Category EQUALS Manufacturing- Rule 1 profile list: Enforcement profiles that permit application access and assign the Guest Operators role- Default action: Deny access- Service 2- Type: Wireless with mPSK- Authentication source: Guest Devices Repository- Authorization source: None- Enforcement policy:- Rule 1 condition: Endpoint Device Insight Tag EQUALS Manufacturing- Rule 1 profile list: Enforcement profile that assigns Aruba-User-Role = equipment and [Registered Device MPSK] profile- Rule 2 condition: Endpoint:Device Insight Tag NOT_EXISTS- Rule 2 profile list: Enforcement profile that assigns Aruba-User-Role = profiling and [Registered Device MPSK] profile- Default action: Deny accessWhat is an error in this configuration?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.You have created a role mapping policy as shown in the exhibits below.What is one change that you need to make to this policy?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.A customer has AOS-CX switches with this configuration on their edge ports:port-access onboarding-method concurrent enableaaa authentication port-access mac-authenablequiet-period 60aaa authentication port-access dotx1 authenticatorenableThe switch authenticates clients to HPE Aruba Networking ClearPass Policy Manager (CPPM) which has these services:1. An 802.1 X service that uses an EAP-TLS method for most clients2. A MAC-Auth service that uses the [MAC-Auth] method for devices such as printers imported from an inventory managerThe customer now wants to provide limited access to wired guest devices and new devices that need to be enrolled with certificates. You have set up these rights in an AOS-CX role named "guest-login."How should you apply the "guest-login" role on the switches?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.You have started to create a CA to meet the customer's requirements for issuing certificates to mobile clients, as shown in the exhibit below.What change will help to meet those requirements and the requirements for authenticating clients?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.Assume that you have set up CPPM to assign HPE Aruba Networking ClearPass roles and AOS user roles as indicated in the scenario. However, a penetration tester was able to access the network with medical staff privileges on a client with a valid computer certificate but revoked medical user certificate. In this circumstance, the customer wants the client to receive computer-only access.What can you do to correct this issue while still meeting the other customer requirements?

# Introduction to the customerYou are helping a company add HPE Aruba Networking ClearPass to their network, which uses HPE Aruba Networking network infrastructure devices.The company currently has a Windows domain and Windows CA. The Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.# ClearPass cluster IP addressing and hostnamesA customer's ClearPass cluster has these IP addresses:• Publisher = 10.47.47.5• Subscriber 1 = 10.47.47.6• Subscriber 2 = 10.47.47.7• Virtual IP with Subscriber 1 and Subscriber 2 = 10.47.47.8The customer's DNS server has these entries• cp.acnsxtest.com = 10.47.47.5• cps1.acnsxtest.com = 10.47.47.6• cps2.acnsxtest.com = 10.47.47.7• radius.acnsxtest.com = 10.47.47.8• onboard.acnsxtest.com = 10.47.47.8Refer to the scenario.You have started to create a CA to meet the customer's requirements for issuing certificates to mobile clients, as shown in the exhibit below.What change will help to meet those requirements and the requirements for authenticating clients?