Discuss HP HPE6-A88 Exam Topic 2 Question 9

An IT administrator attempts to join a ClearPass server to an Active Directory domain. They notice that the system clocks of the ClearPass server and the AD domain are not in sync. The ClearPass server is 10 minutes behind the AD domain. What will be the likely outcome of this attempt to join the domain?

AThe join will succeed but ClearPass will generate a warning about the clock skew.

BThe join will succeed because ClearPass automatically adjusts the clock skew during the join process.

CThe join will fail because Active Directory only allows a maximum of five minutes of clock skew.

Suggested Answer: C

Kerberos, the underlying protocol for Active Directory authentication, is extremely time-sensitive. To prevent 'replay attacks,' AD Domain Controllers strictly enforce a maximum clock skew of 5 minutes. If the ClearPass server's clock differs from the AD domain by 10 minutes, the Kerberos tickets will be considered invalid, and the domain join attempt will fail. Administrators must ensure both systems are synced to a reliable NTP source before joining.

Get Premium HPE6-A88 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Nada 2 months ago

Option C makes sense. Security reasons for time sync.

Stacey 2 months ago

Yeah, I agree. Clock skew is critical for AD.

Major 2 months ago

I think the join will fail. Five minutes max, right?

Nickolas 3 months ago

I've seen it work with a bit more skew, but usually not 10 mins.

Mauricio 3 months ago

Totally agree with C, time issues can mess everything up!

Junita 3 months ago

Wait, does ClearPass really adjust the clock? Sounds odd.

Dorian 3 months ago

I think A could be possible too, warnings happen.

Maryann 3 months ago

C is correct, AD is strict about time sync.

Elli 3 months ago

I think the maximum allowed clock skew is five minutes, so if ClearPass is ten minutes behind, the join will definitely fail.

Alex 4 months ago

I feel like I’ve seen something about ClearPass adjusting the clock during the join, but I can’t recall if that’s actually true.

Filiberto 4 months ago

I’m not entirely sure, but I think there was a practice question that mentioned a warning could be generated if the clocks were off.

Celestina 4 months ago

I remember reading that Active Directory has strict requirements about time synchronization, so I think the join will fail due to the clock skew.

HPE6-A88 Exam - Topic 2 Question 9 Discussion