I85PREP
⌘ K
Aruba ClearPass APC study materials
Aruba ClearPass APC study resources

Aruba ClearPass APC practice questions

One question at a time. Build your Aruba ClearPass APC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ClearPass Fundamentals and Architecture

Which ClearPass component provides the web-based administrative interface and policy configuration layer?

  1. ClearPass Onboard
  2. Insight
  3. Policy Manager Correct answer.
  4. OnGuard Agent

Explanation

Policy Manager is the central management console where services, policies, roles, and enforcement profiles are configured. The other listed components are specialized modules or clients rather than the core policy configuration interface.

Question 2ClearPass Fundamentals and Architecture

What is the primary function of the ClearPass Policy Manager platform within a network?

  1. Centralized network access policy and AAA services Correct answer.
  2. WAN traffic shaping and compression
  3. Wireless RF spectrum optimization
  4. Endpoint disk encryption management

Explanation

ClearPass acts as a centralized policy engine providing authentication, authorization, and accounting along with role-based access enforcement. The other functions belong to different product categories such as wireless controllers or WAN optimizers.

Question 3ClearPass Fundamentals and Architecture

Which protocol does ClearPass commonly use to receive accounting and authentication requests from network access devices?

  1. RADIUS Correct answer.
  2. SMTP
  3. NTP
  4. SNMP

Explanation

RADIUS is the standard AAA protocol used between network access devices and ClearPass for authentication and accounting. The other protocols serve mail, monitoring, or time synchronization functions rather than AAA.

Question 4ClearPass Fundamentals and Architecture

In ClearPass, what does a service define?

  1. A physical switch port configuration template
  2. A certificate authority hierarchy
  3. A set of matching conditions that determine which policy evaluation path applies Correct answer.
  4. A backup schedule for the database

Explanation

A service groups match criteria such as device type, SSID, or RADIUS attributes that select the appropriate authentication and authorization flow. Other options describe unrelated configuration objects.

Question 5ClearPass Fundamentals and Architecture

Which ClearPass module is responsible for onboarding and provisioning corporate devices with certificates?

  1. Guest
  2. Insight
  3. Onboard Correct answer.
  4. OnGuard

Explanation

Onboard handles device provisioning, including certificate enrollment and configuration profiles for corporate devices. OnGuard provides posture assessment, Insight provides reporting, and Guest handles visitor access.

Question 6ClearPass Fundamentals and Architecture

What role does the ClearPass Guest module serve?

  1. Storing RADIUS accounting records
  2. Enforcing endpoint posture compliance
  3. Managing visitor registration and sponsored access workflows Correct answer.
  4. Providing high availability clustering

Explanation

Guest provides self-registration, sponsor approval, and visitor account lifecycle management. Posture, accounting storage, and clustering are handled by other ClearPass functions.

Question 7ClearPass Fundamentals and Architecture

Which ClearPass component is used to collect and report on authentication and endpoint activity?

  1. Insight Correct answer.
  2. OnGuard
  3. Policy Manager
  4. Onboard

Explanation

Insight stores and analyzes authentication, accounting, and endpoint data to produce reports and dashboards. The other components perform posture, provisioning, or policy configuration roles.

Question 8ClearPass Fundamentals and Architecture

An administrator needs to ensure ClearPass can resolve the hostnames of external RADIUS servers. Which configuration should be verified?

  1. The OnGuard agent cache size
  2. DNS server settings in the server network configuration Correct answer.
  3. The Insight data retention period
  4. The Guest sponsor email template

Explanation

Hostname resolution depends on correctly configured DNS servers in the ClearPass network settings. The other options relate to unrelated modules and do not affect name resolution.

Question 9ClearPass Fundamentals and Architecture

Which service type in ClearPass would typically be selected to authenticate users connecting through a wireless SSID?

  1. RADIUS Correct answer.
  2. TACACS+
  3. Web login
  4. SAML

Explanation

Wireless network access devices send authentication requests to ClearPass using RADIUS. TACACS+ is used for device administration, web login is for browser-based flows, and SAML is for federated identity.

Question 10ClearPass Fundamentals and Architecture

In the policy evaluation flow, what happens after a service matches an incoming request?

  1. The request is forwarded to the backup publisher
  2. A new service is automatically generated
  3. Authentication and authorization policies are evaluated to determine the enforcement profile Correct answer.
  4. The request is immediately sent to Insight for reporting

Explanation

Once a service matches, ClearPass evaluates authentication methods and role mapping to select an enforcement profile. Reporting, failover, and service creation are not steps in this evaluation sequence.

Question 11ClearPass Fundamentals and Architecture

Which ClearPass role maps a user or device to a set of permissions after successful authentication?

  1. Certificate revocation
  2. Node discovery
  3. Role mapping Correct answer.
  4. Service matching

Explanation

Role mapping assigns a role based on attributes, and that role drives enforcement decisions. Service matching selects the flow, while revocation and discovery are separate functions.

Question 12ClearPass Fundamentals and Architecture

Which ClearPass deployment model places the Policy Manager and Publisher on the same server?

  1. Distributed deployment
  2. Publisher-subscriber deployment
  3. Standalone deployment Correct answer.
  4. Cluster deployment

Explanation

In a standalone deployment, a single server runs both the publisher and policy management functions. Clustered and distributed models separate these roles across multiple servers.

Question 13ClearPass Fundamentals and Architecture

What is the purpose of a ClearPass subscriber node in a cluster?

  1. To serve as the sole configuration authority
  2. To process authentication requests and replicate configuration from the publisher Correct answer.
  3. To store only Insight report data
  4. To act as the certificate authority

Explanation

Subscribers handle authentication traffic and receive replicated configuration from the publisher. The publisher is the configuration authority, and the other roles are separate.

Question 14ClearPass Fundamentals and Architecture

An administrator wants ClearPass to evaluate endpoint health before granting access. Which module is required?

  1. OnGuard Correct answer.
  2. Onboard
  3. Guest
  4. Insight

Explanation

OnGuard collects posture information such as antivirus status and patch level for health evaluation. Onboard provisions devices, Guest manages visitors, and Insight reports on activity.

Question 15ClearPass Fundamentals and Architecture

Which ClearPass feature allows integration with an external identity store such as Active Directory?

  1. Node cleanup policy
  2. Authentication source configuration Correct answer.
  3. Service template export
  4. Enforcement profile configuration

Explanation

Authentication sources define connections to external identity stores like Active Directory or LDAP. Enforcement profiles define actions, while the other options are administrative utilities.

Question 16ClearPass Fundamentals and Architecture

What does the ClearPass enforcement profile define?

  1. The certificate template used for onboarding
  2. The database replication schedule
  3. The action or attributes returned to the network device after a policy decision Correct answer.
  4. The list of services available on the server

Explanation

Enforcement profiles specify the response sent to the network access device, such as VLAN assignment or downloadable role. The other options describe unrelated configuration objects.

Question 17ClearPass Fundamentals and Architecture

A company needs ClearPass to authenticate guests through a self-registration portal with sponsor approval. Which combination of modules is required?

  1. Onboard with certificate enrollment
  2. OnGuard with posture policies
  3. Insight with report scheduling
  4. Guest with sponsor confirmation and a web login service Correct answer.

Explanation

Guest provides self-registration and sponsor approval, and a web login service delivers the portal to visitors. Posture, provisioning, and reporting do not implement guest registration workflows.

Question 18ClearPass Fundamentals and Architecture

Which statement best describes how ClearPass uses service match criteria during request processing?

  1. All matching services are evaluated and their results combined
  2. The service with the most match criteria always wins
  3. Services are selected randomly to balance load
  4. The first matching service in evaluation order determines the authentication and authorization path Correct answer.

Explanation

ClearPass evaluates services in order and uses the first service whose match criteria are satisfied. Results are not combined across services, and selection is deterministic rather than random.

Question 19ClearPass Fundamentals and Architecture

An administrator observes that authentication requests are being rejected before any policy is evaluated. Which layer should be investigated first?

  1. Shared secret and RADIUS client configuration on the network device Correct answer.
  2. Insight report retention settings
  3. Guest sponsor email templates
  4. Onboard certificate expiry dates

Explanation

Requests rejected before policy evaluation typically indicate a RADIUS shared secret mismatch or an unconfigured network device. The other options affect reporting, notifications, or provisioning rather than initial RADIUS acceptance.

Question 20ClearPass Fundamentals and Architecture

Which ClearPass capability supports enforcing different access based on device type discovered during authentication?

  1. Profiling with role mapping and enforcement policies Correct answer.
  2. NTP synchronization
  3. DNS forwarder configuration
  4. Static VLAN assignment on the switch

Explanation

Profiling identifies device characteristics, which feed role mapping and enforcement to apply differentiated access. Static VLANs, DNS, and NTP do not provide dynamic device-based enforcement.

Question 21ClearPass Deployment and Licensing

Which ClearPass component is responsible for enforcing role-based access control policies on network devices after a user or endpoint is authenticated?

  1. Insight
  2. Guest
  3. OnGuard
  4. Policy Manager Correct answer.

Explanation

Policy Manager evaluates authentication and authorization policies and returns enforcement profiles to the network device. It is the central policy decision point in a ClearPass deployment. OnGuard, Insight, and Guest are separate services with different roles.

Question 22ClearPass Deployment and Licensing

A company needs ClearPass to validate endpoint health such as antivirus status and OS patches before granting access. Which ClearPass service provides this capability?

  1. Policy Manager
  2. Insight
  3. OnGuard Correct answer.
  4. Guest

Explanation

OnGuard is the ClearPass endpoint posture agent that collects health attributes from endpoints for policy evaluation. Policy Manager consumes those attributes but does not collect them itself. Insight and Guest do not perform posture assessment.

Question 23ClearPass Deployment and Licensing

What is the maximum number of ClearPass Policy Manager nodes supported in a single cluster?

  1. 4
  2. 16 Correct answer.
  3. 2
  4. 8

Explanation

A ClearPass Policy Manager cluster supports up to 16 nodes, combining publisher and subscriber roles. This limit governs how large a single cluster can scale. Smaller numbers reflect individual node roles or older guidance, not the cluster maximum.

Question 24ClearPass Deployment and Licensing

In a ClearPass cluster, which node role is authoritative for configuration and is the only node where configuration changes should be made?

  1. Proxy
  2. Standby
  3. Subscriber
  4. Publisher Correct answer.

Explanation

The publisher holds the master configuration database and replicates changes to subscribers. Administrators make configuration changes on the publisher so they propagate cluster-wide. Subscribers receive replicated configuration and serve authentication requests.

Question 25ClearPass Deployment and Licensing

An administrator wants to add a second Policy Manager node for redundancy so authentication continues if the primary fails. Which node type should be deployed?

  1. Publisher
  2. Subscriber Correct answer.
  3. OnGuard
  4. Insight

Explanation

Subscribers replicate configuration from the publisher and can serve authentication requests, providing redundancy. A second publisher is not used for horizontal scaling of authentication. OnGuard and Insight are services, not Policy Manager node roles.

Question 26ClearPass Deployment and Licensing

Which ClearPass licensing construct determines the number of concurrent endpoints that can be authenticated?

  1. Insight licenses
  2. Guest licenses
  3. OnGuard licenses
  4. Access licenses Correct answer.

Explanation

Access licenses govern the number of endpoints that ClearPass can authenticate concurrently. OnGuard, Insight, and Guest licenses enable specific features rather than the base authentication capacity. Base access capacity is the foundation on which feature licenses are added.

Question 27ClearPass Deployment and Licensing

A customer wants to use ClearPass Guest self-registration and sponsor approval. Which license category must be present?

  1. Access
  2. Insight
  3. OnGuard
  4. Guest Correct answer.

Explanation

Guest licenses enable the guest self-registration, sponsor, and visitor management features. Access licenses provide base authentication capacity but do not enable guest workflows. OnGuard and Insight licenses cover posture and reporting respectively.

Question 28ClearPass Deployment and Licensing

What is the purpose of a ClearPass licensing evaluation period?

  1. To run full functionality temporarily before purchasing licenses Correct answer.
  2. To convert OnGuard licenses into Access licenses
  3. To disable the publisher node after expiration
  4. To permanently extend access license capacity

Explanation

The evaluation period allows full ClearPass functionality for a limited time so customers can validate the deployment before buying licenses. It does not permanently add capacity or convert license types. After expiration, functionality is restricted rather than the publisher being disabled.

Question 29ClearPass Deployment and Licensing

Which protocol does ClearPass Policy Manager use to communicate with network access devices for RADIUS authentication?

  1. TACACS+
  2. RADIUS Correct answer.
  3. LDAP
  4. SNMP

Explanation

ClearPass acts as a RADIUS server to authenticate and authorize network access requests from NADs. TACACS+ is used for device administration, not endpoint network access. SNMP and LDAP serve monitoring and directory functions respectively.

Question 30ClearPass Deployment and Licensing

An administrator needs ClearPass to look up user attributes from Microsoft Active Directory during authentication. Which type of authentication source should be configured?

  1. SQL database
  2. RADIUS proxy
  3. Active Directory Correct answer.
  4. Local user database

Explanation

An Active Directory authentication source lets ClearPass query AD for user credentials and attributes. Local user databases store accounts within ClearPass rather than in AD. SQL and RADIUS proxy sources serve different lookup or forwarding needs.

Question 31ClearPass Deployment and Licensing

What is the recommended practice for the ClearPass publisher node's management interface in a production deployment?

  1. Rely on DNS-only resolution
  2. Assign a static IP address Correct answer.
  3. Use a link-local address
  4. Use DHCP with a long lease

Explanation

ClearPass nodes should use static IP addressing so cluster communication and service availability remain stable. DHCP leases can change and disrupt replication and authentication. Link-local and DNS-only approaches do not provide stable addressing.

Question 32ClearPass Deployment and Licensing

Which ClearPass deployment consideration affects whether a single cluster can serve multiple geographic sites?

  1. Color scheme of the Guest portal
  2. Type of endpoint operating systems
  3. Number of Guest sponsors
  4. Network latency between nodes Correct answer.

Explanation

Cluster replication and authentication traffic are sensitive to latency, so inter-node latency constrains multi-site clustering. Guest sponsor counts, endpoint OS types, and portal appearance do not determine geographic clustering feasibility. Designers often place subscribers close to users to reduce latency.

Question 33ClearPass Deployment and Licensing

A company requires high availability for ClearPass authentication so that a single node failure does not interrupt access. Which design element provides this?

  1. OnGuard-only deployment
  2. One node with a larger license
  3. Multiple subscriber nodes behind load balancing Correct answer.
  4. A single publisher with no subscribers

Explanation

Deploying multiple subscribers with load balancing lets authentication continue if one node fails. A single node is a single point of failure regardless of license size. OnGuard alone does not provide authentication redundancy.

Question 34ClearPass Deployment and Licensing

Which statement best describes how ClearPass Access licenses are counted?

  1. They are based on concurrent authenticated endpoints Correct answer.
  2. They are based on total historical logins
  3. They are based on number of network devices
  4. They are based on number of administrators

Explanation

Access licensing is capacity-based on concurrent endpoints authenticated at a point in time. Historical login totals and administrator or device counts do not drive access license consumption. This concurrency model lets capacity be shared across the user population.

Question 35ClearPass Deployment and Licensing

What must be configured on a network access device so it can send authentication requests to ClearPass?

  1. A RADIUS server entry pointing to ClearPass Correct answer.
  2. A syslog server entry pointing to ClearPass
  3. A DHCP relay pointing to ClearPass
  4. An NTP server entry pointing to ClearPass

Explanation

The NAD must be configured with ClearPass as its RADIUS server and share a matching secret. DHCP relay, NTP, and syslog entries do not carry authentication requests. The shared secret must also be defined on the ClearPass side for the device.

Question 36ClearPass Deployment and Licensing

Which ClearPass feature allows administrators to define the conditions under which a device is authorized, such as role, time, and location?

  1. Role mapping and enforcement policies Correct answer.
  2. Insight report scheduling
  3. OnGuard auto-remediation
  4. Guest sponsor approval

Explanation

Role mapping assigns roles to authenticated entities, and enforcement policies use those roles with conditions to decide authorization. Insight scheduling, guest sponsorship, and auto-remediation serve other functions. Together they form the authorization decision in Policy Manager.

Question 37ClearPass Deployment and Licensing

An administrator is planning a ClearPass deployment for 5,000 endpoints with peak concurrency of 3,000. Which licensing figure is most relevant to purchase?

  1. OnGuard licenses sized for 5,000 endpoints
  2. Access licenses sized for 3,000 concurrent endpoints Correct answer.
  3. Access licenses sized for 5,000 total endpoints
  4. Insight licenses sized for 3,000 endpoints

Explanation

Access licenses are sized to peak concurrent authenticated endpoints, so 3,000 is the relevant figure. Total endpoint counts overstate the required capacity. OnGuard and Insight licenses address posture and reporting, not base capacity.

Question 38ClearPass Deployment and Licensing

Which ClearPass component stores historical authentication and accounting records for reporting?

  1. Guest
  2. Insight Correct answer.
  3. OnGuard
  4. Policy Manager

Explanation

Insight collects and stores authentication and accounting data for reporting and analytics. Policy Manager makes policy decisions but relies on Insight for historical reporting. OnGuard and Guest are feature services, not the reporting repository.

Question 39ClearPass Deployment and Licensing

A design team must decide between a single-site cluster and a multi-site cluster. Which factor most strongly favors keeping all nodes in one data center?

  1. Low inter-node latency and simpler replication Correct answer.
  2. A wider variety of endpoint vendors
  3. A larger number of guest sponsors
  4. More frequent password changes

Explanation

Keeping nodes in one data center minimizes inter-node latency and simplifies replication, which favors a single-site cluster. Guest sponsor counts, endpoint vendor variety, and password change frequency do not drive node placement. Multi-site designs are chosen when latency and locality requirements allow.

Question 40ClearPass Deployment and Licensing

What is required before a subscriber node can join a ClearPass cluster?

  1. It must be the RADIUS proxy for all sites
  2. It must have a Guest license installed
  3. It must be able to reach the publisher and share cluster credentials Correct answer.
  4. It must run OnGuard locally

Explanation

A subscriber must reach the publisher over the network and authenticate with cluster credentials to join and replicate configuration. Guest licenses, local OnGuard, and proxy roles are not prerequisites for cluster membership. Network reachability and trust are the core requirements.

Question 41Network Access Control and Enforcement

In ClearPass, which component is responsible for making the final permit-or-deny decision and applying role-based enforcement to a connecting endpoint?

  1. The OnGuard agent
  2. The Policy Service Correct answer.
  3. The NAD (network access device)
  4. The Insight database

Explanation

The Policy Service evaluates the service's rules and enforcement policies to decide the role applied to a request and returns that decision to the NAD. The NAD merely relays the request and enforces whatever the Policy Service returns.

Question 42Network Access Control and Enforcement

An enforcement policy in ClearPass returns the attribute Aruba-User-Role = Employee. What is the primary effect of this returned attribute?

  1. It assigns the endpoint to a role that the NAD maps to a role-based ACL or VLAN Correct answer.
  2. It triggers a CoA to move the client to the guest VLAN
  3. It permanently writes the role into the endpoint's Active Directory account
  4. It forces the endpoint to re-run posture assessment on every packet

Explanation

Aruba-User-Role is a RADIUS return attribute that the Aruba controller uses to place the client into a role whose role-based ACLs and settings govern access. The role is applied at the NAD, not written to any identity store.

Question 43Network Access Control and Enforcement

Which ClearPass feature allows an administrator to define the ordered set of enforcement profiles that will be applied when a rule matches?

  1. A role mapping policy
  2. A posture policy
  3. An enforcement policy Correct answer.
  4. A service rule

Explanation

An enforcement policy is a named, ordered collection of enforcement profiles that is referenced by a service rule and applied when that rule matches. Role mapping and posture policies serve different purposes in the evaluation flow.

Question 44Network Access Control and Enforcement

What does a ClearPass enforcement profile primarily define?

  1. The list of authentication sources queried during 802.1X
  2. The schedule during which a service is active
  3. The specific action and attributes returned to the NAD, such as a VLAN or downloadable ACL Correct answer.
  4. The certificate template used for EAP-TLS server validation

Explanation

An enforcement profile is the concrete action container-it specifies the type (RADIUS, TACACS+, etc.) and the attributes returned to the device. Enforcement policies group these profiles, and service rules select the policy.

Question 45Network Access Control and Enforcement

A client connects to the network and is denied access because no enforcement profile matched. Which ClearPass object is evaluated to determine the role when the enforcement result does not explicitly set one?

  1. The device fingerprint policy
  2. The posture policy
  3. The audit log
  4. The role mapping policy Correct answer.

Explanation

Role mapping policies translate authorization attributes into roles and provide the role when enforcement does not override it. Posture and fingerprinting feed attributes but do not determine the final role directly.

Question 46Network Access Control and Enforcement

Which RADIUS response attribute is commonly used to instruct an Aruba controller to place a client into a specific VLAN?

  1. Session-Timeout
  2. Filter-Id
  3. Tunnel-Private-Group-ID Correct answer.
  4. Acct-Interim-Interval

Explanation

Tunnel-Private-Group-ID carries the VLAN identifier in a tunneled session and is used by Aruba controllers to assign the VLAN. Session-Timeout and Acct-Interim-Interval control session behavior and accounting, not VLAN placement.

Question 47Network Access Control and Enforcement

A ClearPass enforcement profile uses a downloadable role with a Filter-Id of 'Employee-ACL'. What does the NAD do with this attribute?

  1. Applies the named ACL to the client's session traffic Correct answer.
  2. Requests a fresh posture assessment
  3. Re-authenticates the client against a different source
  4. Changes the EAP method for the session

Explanation

Filter-Id references an access control list name that the NAD applies to the client session. It does not affect EAP method selection or trigger reauthentication.

Question 48Network Access Control and Enforcement

Which enforcement action type would an administrator select in a ClearPass enforcement profile to send a Change of Authorization to disconnect a client?

  1. A TACACS+ command profile
  2. An SNMP read profile
  3. A web login redirect profile
  4. A RADIUS CoA profile Correct answer.

Explanation

A RADIUS CoA enforcement profile sends a disconnect or CoA message to the NAD to terminate or modify an active session. SNMP and TACACS+ profiles serve unrelated management functions.

Question 49Network Access Control and Enforcement

A service rule matches when the endpoint's posture status is 'Healthy'. Which attribute source most directly supplies this condition?

  1. OnGuard posture attributes Correct answer.
  2. The RADIUS NAS-Port attribute
  3. The service's authentication method
  4. The endpoint's DHCP fingerprint

Explanation

OnGuard collects posture data such as AV status and patch level and publishes it as attributes the service rule can evaluate. NAS-Port and DHCP fingerprints describe connection and device type, not health.

Question 50Network Access Control and Enforcement

In a ClearPass service, what is the purpose of the 'Enforcement' tab configuration?

  1. To configure the NADs that may send RADIUS requests
  2. To set the certificate authority used for EAP server certificates
  3. To define the policy that selects enforcement profiles based on matched rules Correct answer.
  4. To list the authentication sources used to validate credentials

Explanation

The Enforcement tab binds the service to an enforcement policy whose rules select profiles based on conditions. Authentication sources and NAD lists are configured elsewhere in the service.