ACCP Practice Test

ACCP practice test: what's covered

• ClearPass Policy Manager
• Onboard
• OnGuard
• Guest

Free ACCP sample questions

1. A network engineer is administering a ClearPass Policy Manager cluster containing one Publisher and three Subscribers. When preparing to update service rules and policy components, where must the configuration changes be executed?

   • A. On any subscriber node; changes will automatically sync to all cluster members
   • B. Exclusively on the Publisher node; configuration changes replicate down to Subscribers
   • C. On any node in the cluster, provided the admin user has super-administrator privileges
   • D. Directly via the Insight reporting database node to bypass cluster synchronization locks
   Show answer

   Correct: B. Option B is correct because the Publisher node serves as the writeable master database for the ClearPass cluster configuration, replicating changes out to read-only Subscribers. Option A is incorrect because Subscriber databases are read-only for admin settings. Option C is incorrect because administrator privileges do not grant write permissions on Subscriber nodes. Option D is incorrect because Insight is an analytics reporting database and cannot process cluster configuration changes.

2. An enterprise architect is designing a high-availability ClearPass deployment for 10,000 endpoints spread across two geographically redundant data centres. Which TWO design practices ensure resilient RADIUS processing and cluster stability? (Choose TWO)

   • A. Deploy a central Publisher with local Subscriber pairs in each data centre behind network load balancers or NAD RADIUS server groups
   • B. Configure dead-band detection and failover timers on Network Access Devices (NADs) to switch between local and remote Subscribers
   • C. Deploy a single standalone CP6500 appliance per data centre without cluster connectivity between sites
   • D. Disable RADIUS server-group failover on NADs and rely strictly on DNS round-robin for RADIUS traffic distribution
   Show answer

   Correct: A and B. Options A and B are correct because deploying local Subscriber pairs near NADs reduces authentication latency, while NAD server groups with dead-detect timers ensure automatic failover if a subscriber becomes unreachable. Option C is incorrect because a single standalone appliance per site creates a single point of failure without database replication. Option D is incorrect because standard RADIUS clients do not support real-time DNS-based health checks for packet retransmissions.

3. A security administrator notices that incoming 802.1X requests from wireless users are matching a catch-all Guest service instead of the intended Corporate Wireless service. How does ClearPass evaluate incoming requests against defined Services?

   • A. Services are evaluated in a top-down order; the first Service whose matching rules evaluate to TRUE is selected
   • B. ClearPass evaluates all Services simultaneously and executes the Service with the highest numerical priority ID
   • C. Services are selected using bottom-up ordering, prioritizing generic catch-all rules over specific rules
   • D. Services are matched alphabetically by Service Name regardless of their position in the Service list
   Show answer

   Correct: A. Option A is correct because ClearPass processes incoming RADIUS and TACACS+ requests against the Service list in a top-down sequence, selecting the first Service with matching rules. Option B is incorrect because numerical priority IDs are not used for service selection. Option C is incorrect because bottom-up matching is not supported. Option D is incorrect because alphabetical ordering is ignored by the service selection engine.

4. A network engineer is configuring an Enforcement Policy to return dynamic network controls upon successful 802.1X authentication. Which TWO actions can be delivered inside an Enforcement Profile? (Choose TWO)

   • A. Aruba User-Role and VLAN assignment attributes returned in the RADIUS Access-Accept response
   • B. External Context-Server actions such as triggering HTTP REST calls to firewall or ITSM platforms
   • C. Automatic password rotation inside Active Directory domain controller user objects
   • D. Direct physical interface shutdown on edge switches via SNMP write commands
   Show answer

   Correct: A and B. Options A and B are correct because Enforcement Profiles encapsulate RADIUS vendor-specific attributes (such as Aruba User-Role or VLANs) returned to NADs as well as HTTP REST context-server pushes to external firewalls or IT service management systems. Option C is incorrect because ClearPass does not rotate Active Directory user passwords. Option D is incorrect because physical switch port shutdowns via SNMP write commands are not native Enforcement Profile actions.

5. A SOC analyst asks why ClearPass separates Authentication Sources from Authorization Sources within a Service configuration. Which statement correctly distinguishes the role of Authorization from Authentication?

   • A. Authentication verifies credentials (who you are), while Authorization retrieves attributes from stores like AD or SQL to determine policy rights
   • B. Authentication retrieves group memberships, while Authorization validates user passwords using RADIUS protocols
   • C. Authentication is restricted to LDAP databases, whereas Authorization can only query local endpoint repositories
   • D. Authentication and Authorization are identical functions performed sequentially against the same primary domain controller
   Show answer

   Correct: A. Option A is correct because Authentication validates credentials (such as PEAP password checks), whereas Authorization queries secondary attribute stores (AD groups, SQL fields, Endpoint Repository) to supply context for Enforcement Policy decisions. Option B is incorrect because password validation occurs during authentication. Option C is incorrect because authentication supports multiple identity stores beyond LDAP. Option D is incorrect because they perform distinct roles in policy processing.

Last updated: 2026-10-19

ACCP practice test FAQ