2026 Actual HP HPE6-A84 Dumps, Updated Exam Questions for Guaranteed Pass

HPE6-A84 free sample questions and answers

HP HPE6-A84 practice quiz with correct answers for search indexing.

1. Question 1

   A customer requires a secure solution for connecting remote users to the corporate main site. You are designing a client-to-site virtual private network (VPN) based on Aruba VIA and Aruba Mobility Controllers acting as VPN Concentrators (VPNCs). Remote users will first use the VIA client to contact the VPNCs and obtain connection settings.

   The users should only be allowed to receive the settings if they are the customer's ''RemoteEmployees'' AD group. After receiving the settings, the VIA clients will automatically establish VPN connections, authenticating to CPPM with certificates.

   What should you do to help ensure that only authorized users obtain VIA connection settings?

   ASet up the VPNCs' VIA web authentication profile to use CPPM as the authentication server; set up a service on CPPM that uses AD as the authentication source.
   

   BSet up the VPNCs' VIA web authentication profile to use an AD domain controller as the LDAP server.
   

   CSet up the VPNCs' VIA connection profile to use two authentication profiles, one RADIUS profile to CPPM and one LDAP profile to AD.
   

   DSet up the VPNCs' VIA connection profile to use one authentication profile, which is set to the AD domain controller's hostname.
   

   Correct answer: A

   The VIA web authentication profile is used to authenticate the users who want to download the VIA connection settings from the VPNCs. The VPNCs can use either an internal database or an external server (such as RADIUS or LDAP) as the authentication source for this profile. To ensure that only authorized users obtain VIA connection settings, you should use CPPM as the external server and configure a service on CPPM that uses AD as the authentication source.This way, you can leverage the role mapping and enforcement features of CPPM to check if the users belong to the ''RemoteEmployees'' AD group and grant or deny them access accordingly1

   The other options are not correct because they do not allow you to verify the users' AD group membership before providing them with VIA connection settings. Option B would only check the users' credentials against AD, but not their group membership. Option C would only apply to the VPN connection phase, not the VIA connection settings phase.Option D would not work because the VPNCs do not support LDAP as an authentication source for VIA connection profiles2

   
   

   1: Configuring the VIA Controller - Aruba, section ''Configuring VIA Web Authentication Profile''2: Configuring VIA Connection Profile - Aruba, section ''Configuring Authentication Profile''

2. Question 2

   Refer to the scenario.

   # Introduction to the customer

   You are helping a company add Aruba ClearPass to their network, which uses Aruba network infrastructure devices.

   The company currently has a Windows domain and Windows C

   AThe Window CA issues certificates to domain computers, domain users, and servers such as domain controllers. An example of a certificate issued by the Windows CA is shown here.
   

   

   

   The company is in the process of adding Microsoft Endpoint Manager (Intune) to manage its mobile clients. The customer is maintaining the on-prem AD for now and uses Azure AD Connect to sync with Azure AD.
   # Requirements for issuing certificates to mobile clients
   The company wants to use ClearPass Onboard to deploy certificates automatically to mobile clients enrolled in Intune. During this process, Onboard should communicate with Azure AD to validate the clients. High availability should also be provided for this scenario; in other words, clients should be able to get certificates from Subscriber 2 if Subscriber 1 is down.
   The Intune admins intend to create certificate profiles that include a UPN SAN with the UPN of the user who enrolled the device.
   # Requirements for authenticating clients
   The customer requires all types of clients to connect and authenticate on the same corporate SSID.
   The company wants CPPM to use these authentication methods:
   To succeed, EAP-TLS (standalone or as a TEAP method) clients must meet these requirements:
   # Requirements for assigning clients to roles
   After authentication, the customer wants the CPPM to assign clients to ClearPass roles based on the following rules:
   The customer requires CPPM to assign authenticated clients to AOS firewall roles as follows:
   # Other requirements
   Communications between ClearPass servers and on-prem AD domain controllers must be encrypted.
   # Network topology
   For the network infrastructure, this customer has Aruba APs and Aruba gateways, which are managed by Central. APs use tunneled WLANs, which tunnel traffic to the gateway cluster. The customer also has AOS-CX switches that are not managed by Central at this point.
   

   

   # ClearPass cluster IP addressing and hostnames
   A customer's ClearPass cluster has these IP addresses:
   The customer's DNS server has these entries
   You cannot see flow attributes for wireless clients.
   What should you check?
   

   ADeep packet inspection is enabled on the role to which the Aruba APs assign the wireless clients.
   

   BFirewall application visibility is enabled on the Aruba gateways, and the gateways have been rebooted.
   

   CGateway IDS/IPS is enabled on the Aruba gateways, and the gateways have been rebooted.
   

   DDeep packet inspection is enabled on the Aruba Aps, and the APs have been rebooted.
   

   Correct answer: A, A

   
   

3. Question 3

   A customer needs you to configure Aruba ClearPass Policy Manager (CPPM) to authenticate domain users on domain computers. Domain users, domain computers, and domain controllers receive certificates from a Windows C

   ACPPM should validate these certificates and verify that the users and computers have accounts in Windows AD. The customer requires encryption for all communications between CPPM and the domain controllers.
   You have imported the root certificate for the Windows CA to the ClearPass CA Trust list.
   Which usages should you add to it based on these requirements?
   

   ARadec and Aruba infrastructure
   

   BEAP and AD/LDAP Server
   

   CEAP and Radsec
   

   DLDAP and Aruba infrastructure
   

   Correct answer: C

   EAP (Extensible Authentication Protocol) is a framework that allows different authentication methods to be used for network access. EAP is used for RADIUS/EAP authentication, which is a common method for authenticating domain users on domain computers using certificates. EAP requires that the RADIUS server, such as ClearPass Policy Manager (CPPM), validates the certificates presented by the clients and verifies their identity against an identity source, such as Windows AD. Therefore, the root certificate for the Windows CA that issues the certificates to the clients should have the EAP usage in the ClearPass CA Trust list.

   Radsec (RADIUS over TLS) is a protocol that allows secure and encrypted communication between RADIUS servers and clients using TLS. Radsec is used for encrypting all communications between CPPM and the domain controllers, which act as RADIUS clients. Radsec requires that both the RADIUS server and the RADIUS client validate each other's certificates and establish a TLS session. Therefore, the root certificate for the Windows CA that issues the certificates to the domain controllers should have the Radsec usage in the ClearPass CA Trust list.

   
   

4. Question 4

   Refer to the scenario.

   A customer requires these rights for clients in the ''medical-mobile'' AOS firewall role on Aruba Mobility Controllers (MCs):

   External devices should not be permitted to initiate sessions with ''medical-mobile'' clients, only send return traffic.

   The line below shows the effective configuration for the role.

   

   There are multiple issues with this configuration. What is one change you must make to meet the scenario requirements? (In the options, rules in a policy are referenced from top to bottom. For example, ''medical-mobile'' rule 1 is ''ipv4 any any svc-dhcp permit,'' and rule 6 is ''ipv4 any any any permit'.)

   AApply the 'apprf-medical-mobile-sjcT policy explicitly to the 'medical-mobile' user-role under the 'medical-mobile' policy.
   

   BIn the 'medical-mobile' policy, change the action for rules 2 and 3 to reject.
   

   CIn the 'medical-mobile' policy, move rule 5 under rule 6.
   

   DIn the 'medical-mobile* policy, change the subnet mask in rule 5 to 255.255.252.0.
   

   Correct answer: D

   The scenario requires that the clients in the ''medical-mobile'' role are denied access to the 10.1.12.0/22 subnet, which is a range of IP addresses from 10.1.12.0 to 10.1.15.255. However, the current configuration in rule 5 has a subnet mask of 255.255.240.0, which means that it matches any IP address from 10.1.0.0 to 10.1.15.255. This is too broad and would deny access to other subnets in the 10.1.0.0/16 range that should be permitted according to the scenario.Therefore, the subnet mask in rule 5 should be changed to 255.255.252.0, which would match only the IP addresses from 10.1.12.0 to 10.1.15.255 and deny access to them as required by the scenario.1

   
   

   1: Configuring Firewall Policies - Aruba, section ''Firewall Policies''

5. Question 5

   You need to install a certificate on a standalone Aruba Mobility Controller (MC). The MC will need to use the certificate for the Web UI and for implementing RadSec with Aruba ClearPass Policy Manager. You have been given a certificate with these settings:

   What issue does this certificate have for the purposes for which the certificate is intended?

   AIt has conflicting EKUs.
   

   BIt is issued by a private CA.
   

   CIt specifies domain info in the CN field instead of the DC field.
   

   DIt lacks a DNS SAN.
   

   Correct answer: D

   A DNS SAN (Subject Alternative Name) is an extension of the X.509 certificate standard that allows specifying additional hostnames or IP addresses that the certificate can be used for. A DNS SAN is useful for validating the identity of the server or client that presents the certificate, especially when the common name (CN) field does not match the hostname or IP address of the server or client.

   In this case, the certificate has a CN of mc41.site94.example.com, which is the fully qualified domain name (FQDN) of the standalone Aruba Mobility Controller (MC). However, this CN may not match the hostname or IP address that the MC uses for the Web UI or for implementing RadSec with Aruba ClearPass Policy Manager. For example, if the MC uses a different FQDN, such as mc41.example.com, or an IP address, such as 192.168.1.41, for these purposes, then the certificate would not be valid for them. Therefore, the certificate should have a DNS SAN that includes all the possible hostnames or IP addresses that the MC may use for the Web UI and RadSec.