Exam HPE7-A02 Topic 6 Question 141 Discussion
Actual exam question for HP's HPE7-A02 exam
Question #: 141
Topic #: 6
Question #: 141
Topic #: 6
Refer to the exhibits.
You are setting up HPE Aruba Networking ClearPass Policy Manager (CPPM) to authenticate wireless clients with EAP-TLS and 802.1X. CPPM should assign clients to an AOS firewall role named contractors- fullaccess if the clients meet these requirements:
* AD account is enabled: AccountStatus 512
* Security group name is Contractors
What should you do to make these policies meet these requirements?
You are setting up HPE Aruba Networking ClearPass Policy Manager (CPPM) to authenticate wireless clients with EAP-TLS and 802.1X. CPPM should assign clients to an AOS firewall role named contractors- fullaccess if the clients meet these requirements:
* AD account is enabled: AccountStatus 512
* Security group name is Contractors
What should you do to make these policies meet these requirements?
Suggested Answer: D Vote an answer
The role mapping policy is configured to Evaluate all , so a client with an enabled AD account receives role1
, and a client in the Contractors group receives role2 . A client that meets both requirements receives both roles. The enforcement policy uses First applicable , and rule 1 already checks for both conditions: Tips:
Role EQUALS role1 AND Tips:Role EQUALS role2 . Therefore, the matching logic is already correct.
What is missing is the correct enforcement action. To assign an AOS firewall role, CPPM must return the appropriate RADIUS enforcement profile containing the Aruba-User-Role VSA set to contractors-fullaccess
. Changing only role mapping names does not assign the firewall role. Adding a separate role2-only rule would incorrectly match Contractors users whose AD account status is not enabled.
, and a client in the Contractors group receives role2 . A client that meets both requirements receives both roles. The enforcement policy uses First applicable , and rule 1 already checks for both conditions: Tips:
Role EQUALS role1 AND Tips:Role EQUALS role2 . Therefore, the matching logic is already correct.
What is missing is the correct enforcement action. To assign an AOS firewall role, CPPM must return the appropriate RADIUS enforcement profile containing the Aruba-User-Role VSA set to contractors-fullaccess
. Changing only role mapping names does not assign the firewall role. Adding a separate role2-only rule would incorrectly match Contractors users whose AD account status is not enabled.
by Jim at Oct 16, 2026, 03:00 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).