A company has AOS-CX switches and HPE Aruba Networking ClearPass Policy Manager (CPPM).

802.1X and User Role Download:

AOS-CX switches use RADIUS attributes to dynamically download user roles from CPPM.

The HPE-User-Role VSA (Vendor-Specific Attribute) must be configured in the RADIUS enforcement profiles to specify which role the switch should apply.

Option Analysis:

Option A: Incorrect. Exporting roles in XML is not needed for dynamic role download.

Option B: Incorrect. Switches authenticate via RADIUS, not admin accounts with specific privileges.

Option C: Correct. RADIUS enforcement profiles must include the HPE-User-Role VSA to implement user role download.

Option D: Incorrect. TPM certificates are unrelated to RADIUS-based user role downloads.