Aruba ClearPass APC study plan
Aruba ClearPass APC · Give each week a clear focus.
8 weeks · About 7 hours per week
ClearPass Policy Manager Configuration & ClearPass Fundamentals and Architecture
Diagram the ClearPass Policy Manager service flow from RADIUS request to enforcement decision
Identify the function of each core service (Policy Manager, OnGuard, Guest, Insight, Onboard) and where each is licensed
Configure a lab Policy Manager instance and enumerate default service, role, and enforcement policy objects
Explain how services, roles, and enforcement policies chain together to produce an access decision
Your checkpoint
A one-page architecture diagram plus a written mapping of each ClearPass service to its licensing and function
ClearPass Policy Manager Configuration & Network Access Control and Enforcement
Build a working 802.1X service with role mapping and a single enforcement policy in the lab
Write enforcement policy rules that match on role, device type, and time-of-day conditions
Configure enforcement profiles that return VLAN, role, and downloadable ACL attributes
Test policy evaluation order and document how the first matching rule is selected
Your checkpoint
A working lab service with at least three enforcement policies and a table of rule conditions and resulting profiles
Authentication Methods and Identity Sources & Network Access Control and Enforcement
Configure RADIUS authentication against an Active Directory identity source
Compare EAP-TLS, PEAP-MSCHAPv2, and EAP-TTLS in terms of certificate and credential requirements
Configure a local user database and a second external identity source and set source ordering
Explain how authorization attributes are fetched and used after successful authentication
Your checkpoint
A configuration write-up covering two identity sources, two EAP methods, and the resulting authorization attribute flow
ClearPass Deployment and Licensing & Troubleshooting and Monitoring
Size a ClearPass deployment (hardware vs. virtual, single node vs. cluster) for a given user and device count
Describe licensing tiers and how access licenses are counted and consumed
Configure a two-node cluster with publisher and subscriber roles and verify replication status
Use Insight and the access tracker to trace a failed authentication end to end
Your checkpoint
A deployment and licensing plan for a 5,000-device scenario plus a documented access-tracker trace of one failed login
Guest Access and Onboarding & Authentication Methods and Identity Sources
Configure a guest self-registration web login flow with sponsor approval
Set up a guest role and enforcement policy that restricts guest access to internet only
Configure device onboarding with certificate enrollment for a BYOD device
Integrate a social or SMS-based guest authentication method and describe its limitations
Your checkpoint
A working guest self-registration plus sponsor approval flow, with screenshots or config notes of the resulting enforcement
ClearPass OnGuard & Network Access Control and Enforcement
Deploy OnGuard on a test endpoint and configure health checks for antivirus and OS patch level
Write an enforcement policy that quarantines a non-compliant endpoint and remediates it
Explain the difference between agent-based and agentless posture assessment
Configure posture token mapping and verify a compliant endpoint receives full access
Your checkpoint
A posture policy set with at least two health checks and a demonstrated quarantine-to-remediation enforcement path
Troubleshooting and Monitoring & Integration with Aruba and Third-Party Infrastructure
Configure syslog and SNMP traps to an external monitoring target
Integrate ClearPass with an Aruba controller for RADIUS and CoA, and verify a CoA-triggered session change
Configure a third-party integration such as an MDM or firewall and describe the data exchanged
Build an Insight report that summarizes authentication failures by identity source
Your checkpoint
An integration and monitoring runbook covering one Aruba controller, one third-party system, and one saved Insight report
ClearPass Fundamentals and Architecture & ClearPass Deployment and Licensing & Network Access Control and Enforcement & ClearPass Policy Manager Configuration & Authentication Methods and Identity Sources & Guest Access and Onboarding & ClearPass OnGuard & Troubleshooting and Monitoring & Integration with Aruba and Third-Party Infrastructure
Review weak areas identified from earlier milestone checks and re-test those configurations
Complete a full timed practice exam and score each domain
Re-derive the enforcement decision path for three different scenarios from memory
Document remaining gaps and a post-exam remediation plan
Your checkpoint
A scored practice exam with a per-domain breakdown and a prioritized list of remaining weak areas
Milestones
Week 2: Can explain and demonstrate, without notes, how a RADIUS request flows through service selection, role mapping, and enforcement to produce a VLAN assignment
Week 4: Cluster is healthy, replication is verified, and you can trace a failed authentication to its root cause using the access tracker
Week 6: A non-compliant endpoint is quarantined and then successfully remediated to full access through OnGuard posture policy
Week 8: Practice exam score is at or above target with no domain below 70 percent, and remaining gaps are documented