Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
After a guest user submits their self-registration form, their account is created in a disabled state. What visual cue indicates this status on the registration receipt?
When an account is pending approval (either by a sponsor or via email verification), it is created in a 'Disabled' state in the Guest Repository. ClearPass Guest receipt pages are context-aware; they check the account status before rendering. If the account is disabled, the Log In button will be grayed out and unclickable, informing the user that they must wait for further action before they can access the network.
An IT administrator is tasked with creating a self-service portal for guest users to request and maintain their own user identities. Which type of web page should they create using ClearPass Guest's Web Content Manager?
ClearPass Guest distinguishes between simple login pages and complex registration workflows. A Self-Registration page is the correct choice for this requirement because it includes the logic for the guest to enter their information, select a sponsor, receive credentials, and manage their own account details (like password changes or extending their stay).
An IT administrator notices that a client endpoint has failed a health check and wants to send a notification that will not only inform the user but also force the client to re-authenticate. Which action should the administrator take?
In OnGuard, you can configure Post-Auth Actions. When a device fails compliance, simply telling the user is often not enough. By choosing an action to 'Restart the session,' ClearPass sends a RADIUS CoA (Change of Authorization) to the switch or controller, which bounces the user's connection. This forces the device to re-authenticate, at which point the new 'Unhealthy' status will trigger a restricted or quarantine policy.
An IT administrator is setting up guest access on a corporate network using ClearPass. They have configured the RADIUS service correctly and enabled the Allow All MAC AUTH method. However, they notice that clients are not redirected to the captive portal for authentication. What is the likely reason for this issue?
Redirection to a captive portal is triggered by the Network Access Device (NAD) based on the RADIUS response from ClearPass. If ClearPass returns a role or attribute (like a redirect-URL or a specific 'logon' role) that the gateway does not recognize or support, the gateway will not intercept the user's web traffic. The 'captive portal access' value (often a VSA or a filter-ID) must exactly match a pre-configured role on the Aruba gateway that has the 'Captive Portal' profile attached.
An IT administrator needs to quickly identify all devices connected to a specific subnet within their network. They decide to use the search feature to find all IP addresses within the 10.0.0.0/8 subnet. Which search term should they use?
The search bar in the ClearPass Endpoints and Access Tracker views supports partial-string matching. To find all devices in the 10.x.x.x (10/8) range, simply typing '10.' will filter the list to show every entry where the IP address field begins with those two characters. This is the most efficient way to perform broad subnet filtering without using complex query syntax.
An IT administrator set the Base DN to the OU containing user accounts but noticed that computer accounts are not authenticated. What could be the reason?
The Base DN (Distinguished Name) defines the 'starting point' where ClearPass begins searching the Active Directory tree. If an organization stores Users in OU=Users,DC=corp and Computers in OU=Workstations,DC=corp, setting the Base DN specifically to the Users OU prevents ClearPass from seeing any objects in the Workstations OU. To fix this, the administrator should set the Base DN higher in the hierarchy (e.g., DC=corp) and use search filters to find the specific objects.
A company wants to ensure that only healthy devices can access its network. ClearPass enforces this policy. Which component of the enforcement process evaluates the collected data and matches it to predefined rules?
The Enforcement Policy is the logic engine of ClearPass. While the 'Service' selects which policy to run, and the 'Profile' contains the actual attributes (like VLANs) to send, the Enforcement Policy Rules are responsible for the evaluation. These rules use 'If/Then' logic to compare the gathered context---such as user role, device type, and OnGuard posture status---against predefined security criteria to determine the final access level.
Exam domains verified against: Official HP HPE6-A88 exam guide, last checked October 2026.
Network access control restricts resources based on user identity, device type and security posture. Learn how enforcement mechanisms grant or deny access according to defined security policies that prevent unauthorized devices and users from connecting to the network.
Sample question from this domain above: Q6
ClearPass core components include Policy Manager, Guest, Onboard and OnGuard modules. Each module handles a specific function within the access control ecosystem and they interact together to deliver unified network access management.
Sample question from this domain above: Q4
Authentication confirms user or device identity via 802.1X, MAC or web login methods. Authorization determines access levels based on identity and policy rules while Accounting logs user activity for auditing and compliance reporting.
Services function as policy containers that match specific network request types to defined rules. Service selection uses criteria such as connection type and RADIUS attributes to determine which policy applies to each request.
Captive portals redirect unauthenticated users to self-registration or login pages for guest account creation and sponsorship workflows. Guest policies are kept separate from corporate access to maintain network security while enabling time-limited access provisioning.
Roles are assigned dynamically based on authentication results, device attributes and policy conditions. Role-based access control segments users into different network zones or VLANs with dynamic role assignment enabling consistent policy enforcement across wired and wireless networks.
Sample question from this domain above: Q1
Onboard automates personal device configuration with correct network credentials and certificates. Posture assessment checks devices for compliance attributes like OS version, antivirus and patch status with non-compliant devices quarantined or given limited access until remediation.
Server deployment options include standalone, cluster and publisher/subscriber configurations. Administrative tasks cover certificate management, software updates, backup procedures and monitoring tools that maintain system health and enable troubleshooting.
Common questions about the exam itself
