Which statements are true about Aruba downloadable user roles? (Select three.)

• A. Aruba downloadable user role is a built in enforcementtemplate in ClearPass
• B. Can use these roles for other authentication methods not involving ClearPass
• C. Aruba downloadable user role are universally available across the environment
• D. Can be applied only on ports or WLAN users authenticated by ClearPass.
• E. Administering downloadable user roles can be difficult for a large enterprise
• F. Downloadable role names must be defined in Aruba switch or controller

You have Integrated ClearPass Onboard with Active Directory Certificate Services (ADCS) web enrollment to sign the Anal device TLS certificates The Onboard provisioning process completes successfully but when the user finally clicks connect, the user falls to connect to the network with an unknown_ca certificate error.
What steps will you follow to complete the requirement?

• A. Export the self-signed certificate from the ClearPass servers and manually add them as trusted certificates in clients
• B. Make sure both the ClearPass servers have different certificates used for both SSL and RADIUS server identity.
• C. Make sure that the ClearPass servers are using the default self-signed certificates for both SSL and RADIUS server identity
• D. Add the ADCS root certificate to both the CPPM Certificate trust list and to the Onboard Certificate Store trust list

Refer to the exhibit:



You are doing a ClearPass PoC at a customer site with a single Aruba Mobility Controller. The customer asked for a demonstration of a simple Web Login functionality. You used a service template to create the guest services. During testing, the usergets redirected back to the weblogin page with an Authentication failed message. The guest configurations on the Aruba Mobility Controller are configured correctly.
Why would the guest fail to authenticate successfully?

• A. The username and/or password used for authentication is incorrect Re-enter the correct password on the weblogin page.
• B. The authentication source mapped in the service is incorrect, it should be mapped as (Guest Device Repository] [Local SQL DB].
• C. The Unique-Device-Count does not allow any Client devices.Update the Enforcement policy condition:
  Unique-Device-Count.
• D. The username used for authentication does not exist in the Guest User Database Create a new user and authenticate again.

Refer to the exhibit:

A customer has configured Onboard in a cluster. After the Primary server's failure, the BYOD devices fail to connect to the network. What would you do to troubleshoot?

• A. Check if a DNS entry is available for the ClearPass hostname in the certificate, resolvable from the DNS server assigned to the client
• B. Check EAP certificate on the secondary node is issued by the same common root Certificate Authority (CA)
• C. Reboot the active ClearPass server and reconnect the client to the SSID by selecting the correct certificate when prompted
• D. Verify
  the OSCP URL under TLS authentication method is mapped to http://localhost/guestmdps_ocsp.php/2

Refer to the exhibit:





You configured the 802 1 x service enforcement conditions with the Endpoint profiling data. When the client connects to the network. ClearPass successfully profiles the client but the client always receives an incorrect enforcement profile The configurations in the Aruba controller are completed correctly.
What is the cause of the issue?

• A. The enforcement policy rules evaluation algorithm Is not configured correctly.
• B. The option, use cached roles and posture from previous sessions should be enabled.
• C. An additional authorization source should be configured for profiling to work.
• D. The enforcement policy conditions configured with profiling data are not correct.