HP Aruba Certified ClearPass Expert Written - HPE6-A77 Exam Questions [2026]

QUESTION NO: 1
A customer has deployed an OnGuard Solution to all the corporate devices using a group policy rule to push the OnGuard Agents. The network administrator is complaining that some of the agents are communicating to the ClearPass server that is located in a DMZ, outside the firewall The network administrator wants all of the agents System Health Validation traffic to stay inside the Management subnets.
What can the ClearPass administrator do to move the traffic only to the ClearPass Management Ports?

A. Edit the agent.conf file being deployed to the clients to use the ClearPass Management Port for SHV updates. B. Filter TCP port 6658 on the firewall, forcing the OnGuard agent to use the ClearPass Management port. C. Select the correct OnGuard Agent installer, and use the one configured for Management Port for the clients. D. Configure a Policy Manager Zone mapping so the OnGuard agent will use the Management Port IP.

Correct Answer: D

QUESTION NO: 2
A customer has completed all the required configurations in the Windows server in order for Active Directory Certificate Services (ADCS) to sign Onboard device TLS certificates. The Onboard portal and the Onboard services are also configured. Testing shows that the Client certificates ate still signed by the Onboard Certificate Authority and not ADCS.
How can you help the customer with the situation?

A. Enable access to SCEP servers from the Certificate Authority to make ClearPass Onboard to use of the Active Directory Certificate Services (ADCS) web enrollment to sign the device TLS certificates. B. Enable access to EST servers from the Certificate Authority to make ClearPass Onboard to use of the Active Directory Certificate Services (ADCS) web enrollment to sign the device TLS certificates. C. Configure
the identity certificate signer as Active Directory Certificate Services and enter the ADCS URL
http://ADCSVVeoEnrollmentServemostname/certsrv in the OnBoard Provisioning settings. D. Educate the customer that, when integrating with Active Directory Certificate Services (ADCS) the Onboard CA will the same authority used for signing me final TLS certificate of the device.

Correct Answer: B

QUESTION NO: 3
Refer to the exhibit:

A customer has configured a Guest Self registration page for their Cisco Wireless network with the settings shown. What should be changed in order to successfully authenticate guests users?

A. Change \he IP Address to the Cisco Controller DNS name B. Login Method should be Controller-initiated - using HTTPs form submit C. Change the Vendor Settings to Airespace Networks D. Secure Login should use HTTP

Correct Answer: A

QUESTION NO: 4
Refer to the exhibit:

You configured a new Wireless 802.1X service for a Cisco WLC broadcasting the Secure-ADM-5007 SSID.
The client falls to connect to the SSID. Using the screenshots as a reference, how would you fix this issue?
(Select two.)

A. Change the service condition to Radius:lETF Calling-Station-ld EQUALS Secure-ADM-5007 B. Remove the service condition Radius:lETF Service-Type BELONGSJTO Login-User (1). 2. 8 C. Make sure that the Network Devices entry for the Cisco WLC has a vendor setting of "Airspace" D. Update the service condition Radius:IETF Called-Station-ld CONTAINS secure-adm-5007

Correct Answer: B,D

QUESTION NO: 5
Refer to the exhibit:

A customer has configured the Aruba Controller for administrative authentication using ClearPass as a TACACS server. During testing, the read-only user is getting the root access role. What could be a possible reason for this behavior? (Select two.)

A. On the Controller, the TACAC$ authentication server Is not configured for Session authorization B. The Controller Server Group Match Rules are changing the user role C. The read-only enforcement profile is mapped to the root role D. The ClearPass user role associated to the read-only user is wrong E. The Controllers Admin Authentication Options Default role is mapped to toot.

Correct Answer: A,B

QUESTION NO: 6
Refer to the exhibit:

You are doing a ClearPass PoC at a customer site with a single Aruba Mobility Controller. The customer asked for a demonstration of a simple Web Login functionality. You used a service template to create the guest services. During testing, the usergets redirected back to the weblogin page with an Authentication failed message. The guest configurations on the Aruba Mobility Controller are configured correctly.
Why would the guest fail to authenticate successfully?

A. The username and/or password used for authentication is incorrect Re-enter the correct password on the weblogin page. B. The Unique-Device-Count does not allow any Client devices.Update the Enforcement policy condition:
Unique-Device-Count. C. The username used for authentication does not exist in the Guest User Database Create a new user and authenticate again. D. The authentication source mapped in the service is incorrect, it should be mapped as (Guest Device Repository] [Local SQL DB].

Correct Answer: D