HPE6-A82 · Question #63
Drag and Drop Question Match the correct Profiling Collector with the Collector Type. Collector Types may be used more than once. Answer:
The correct answer is DHCP; Controler IF-MAP; Cisco Device Sensor; TCP Fingerprinting; OnGuard; NMAP; SNMP. Important Note on Question Completeness The question as presented is incomplete - the "Collector Types" target categories are missing. The "Correct Arrangement" just re-lists the items in order without showing what each is being matched to. This is likely an Aruba ClearPass (CPPM
Question
Drag and Drop Question Match the correct Profiling Collector with the Collector Type. Collector Types may be used more than once. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- DHCP
- Controler IF-MAP
- Cisco Device Sensor
- TCP Fingerprinting
- OnGuard
- NMAP
- SNMP
Explanation
Important Note on Question Completeness
The question as presented is incomplete - the "Collector Types" target categories are missing. The "Correct Arrangement" just re-lists the items in order without showing what each is being matched to. This is likely an Aruba ClearPass (CPPM) exam question where items are matched to Active vs Passive (and sometimes Agent-based) collector types.
The Core Concept: Active vs Passive Profiling
| Type | Definition |
|---|---|
| Passive | Listens to existing network traffic - no direct device contact |
| Active | Initiates contact/queries to probe the endpoint directly |
| Agent-based | Relies on software installed on the endpoint |
Each Collector Explained
1. DHCP - Passive
When a device joins the network and requests an IP, it sends DHCP packets containing fingerprinting clues (Option 55 parameter request list, hostname, vendor class identifier). ClearPass listens to this traffic without generating any. Classic passive collector.
2. Controller IF-MAP - Passive
IF-MAP (Interface for Metadata Access Points) is a publish/subscribe protocol. Aruba wireless controllers push endpoint metadata (IP, MAC, SSID, role) to ClearPass. ClearPass only receives - it never probes the device.
3. Cisco Device Sensor - Passive
A feature on Cisco IOS switches/routers that intercepts DHCP, CDP, and LLDP data on access ports and forwards it to ClearPass via RADIUS accounting. The switch does the passive collection; ClearPass just ingests the report.
4. TCP Fingerprinting - Passive
Analyzes TCP/IP stack characteristics (TTL values, window size, flags) from traffic already flowing through the network. No packets are sent to the endpoint - it's pure observation.
5. OnGuard - Agent-based (often classified as Active)
OnGuard is a software agent installed on the endpoint. It actively collects detailed host info (OS, running processes, AV status) and reports it to ClearPass. Because it requires an installed agent and actively pushes data, it's classified as agent-based or active - not passive.
6. NMAP - Active
NMAP is a network scanner that sends packets directly to the endpoint to discover open ports, OS version, and running services. ClearPass initiates these scans, making NMAP explicitly active.
7. SNMP - Active
ClearPass sends SNMP queries (GET requests) to network devices or endpoints to retrieve MIB data. Because ClearPass initiates the query, this is active profiling.
Common Mistakes
| Mistake | Correction |
|---|---|
| Thinking DHCP is active because "ClearPass uses it" | ClearPass just sniffs DHCP exchanges - it never sends them |
| Confusing OnGuard as passive | The agent actively pushes data; it's not passive observation |
| Treating SNMP as passive | SNMP polling = ClearPass sending requests = active |
| Confusing IF-MAP with active scanning | IF-MAP is a push protocol - the controller sends data to ClearPass, not the reverse |
If you have access to the original exam image showing the actual target categories, I can give you a more precise matching explanation.
Topics
Community Discussion
No community discussion yet for this question.