HP HPE7-A01 Aruba Certified Campus Access Professional Exam Exam Practice Test

OSPF (Open Shortest Path First) is a routing protocol that uses link-state information to calculate the best path to each destination in the network. OSPF establishes adjacencies with neighboring routers to exchange routing information and maintain a consistent view of the network topology1.

To establish an OSPF adjacency, the routers need to have some common parameters, such as the area ID, the network type, the hello interval, the dead interval, and the authentication method2. The routers also need to have a matching subnet mask on the interface that connects them3.

In this case, the Aruba CX 6300 VSF stack has an SVI (Switched Virtual Interface) on VLAN 10 with an IP address of 10.1.1.1/24 and a LAG (Link Aggregation Group) on port 1/1/1 and port 2/1/1 that connects to a neighboring device. The SVI is configured with OSPF area 0 and network type broadcast. The LAG is configured with OSPF passive mode, which means that it will not send or receive OSPF hello packets.

The neighboring device has an interface with an IP address of 10.1.1.2/24 and a LAG on port 1/0/1 and port 2/0/1 that connects to the Aruba CX 6300 VSF stack. The interface is configured with OSPF area 0 and network type broadcast.

Since the Aruba CX 6300 VSF stack and the neighboring device have the same area ID, network type, subnet mask, and default hello and dead intervals on their interfaces, they will be able to establish an OSPF adjacency over SVI 10 with LAG 1. The OSPF passive mode on the LAG will not affect the adjacency, because it only applies to the LAG interface, not the SVI interface.

This is the most likely cause of the issue where the access points in a Microbranch group are online in Aruba Central, but no VPN tunnels are forming. A Microbranch group is a group that contains both APs and Gateways and allows them to form VPN tunnels for secure communication. The VPN tunnels use GRE (Generic Routing Encapsulation) as the encapsulation protocol and IPSec as the encryption protocol. If there is a firewall blocking GRE traffic between the AP and the gateway, the VPN tunnels cannot be established. The other options are incorrect because they either do not affect the VPN tunnel formation or do not apply to a Microbranch group. References: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/gateways/microbranch.htm https://www.arubanetworks.com/assets/tg/TB_ArubaGateway.pdf

Proves knowledge of the PMK

Exchanges messages for generating PTK

Distributes an encrypted GTK to the client

Sets first initialization vector (IV)

https://www.arubanetworks.com/techdocs/central/2.5.8/content/aos10x/aos10x-overview/aos10-kms-workflow.htm

a) Support up to 10 devices per stack - >  VSF 

b) Support two devices per stack - >  VSX 

c) Individual ISL links up to 400G are supported - >  VSX 

d) individual ISL links up to 50G are supported - >  VSF 

e) A maximum aggregate ISL bandwidth of 200G is supported - >  VSF

A failed VLAN Probe indicates that the gateway cluster members do not have the required common Layer 2 connectivity for those VLANs. When the VLAN probes fail, the relationship between cluster members is effectively treated as L3-connected rather than L2-connected. Aruba’s clustering documentation distinguishes these two operating conditions very clearly.

For an L3-connected cluster, only APs are fully replicated. Client/user information is not fully synchronized between cluster members, and high-value application sessions are not synchronized. Aruba’s official ArubaOS 8 Fundamentals Guide summarizes the distinction as follows: for L2-connected members, APs and clients are fully replicated, users and high-value sessions are synchronized, and failover occurs without deauthentication. For L3-connected members, only APs are fully replicated, users and high-value sessions are not synchronized, and users can be deauthenticated during failover. Aruba Networks

Therefore, option B precisely describes the outcome when VLAN probing fails across the required VLANs. Option A requires L2-connected clustering. Option C describes full L2 redundancy. Option D is reversed: L3-connected operation does not provide hitless client failover and users may be deauthenticated during a gateway failure. Aruba Networking

Study Guide Topics: Gateway Clustering, VLAN Probe, L2-Connected vs. L3-Connected Clusters, AP/Client State Synchronization, Stateful Failover, High-Value Session Synchronization.

To onboard a new UXI in an existing environment with 802.1X authentication, you need to use the UXI app on your smartphone and connect the UXI via Bluetooth. The UXI app allows you to scan the QR code on the UXI sensor and configure its network settings, such as SSID, password, IP address, etc. The Bluetooth connection allows you to communicate with the UXI sensor without requiring any network access or cellular connection. The other options are incorrect because they either do not use the UXI app or do not use Bluetooth. References: https://www.arubanetworks.com/products/network-management-operations/analytics-monitoring/user-experience-insight-sensors/ https://help.centralon-prem.arubanetworks.com/2.5.4/documentation/online_help/content/nms-on-prem/aos-cx/get-started/uxi-sensor.htm

This is the appropriate solution for this scenario where wireless 802.1X authentication will be against a RADIUS server in the cloud and the security team is concerned that the traffic between the AP and the RADIUS server will be exposed. RadSec, also known as RADIUS over TLS, is a protocol that provides encryption and authentication for RADIUS traffic over TCP and TLS. RadSec can be configured on both the AP and the RADIUS server to establish a secure tunnel for exchanging RADIUS packets. The other options are incorrect because they either do not provide encryption or authentication for RADIUS traffic or do not involve RadSec. References: https://www.securew2.com/blog/what-is-radsec/ https://www.cloudradius.com/radsec-vs-radius/

These are two benefits enabled by LLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery). LLDP-MED is an extension of LLDP that provides additional capabilities for network devices such as VoIP phones and APs. One of the capabilities is to automatically configure voice VLANs for VoIP phones, which allows them to be placed in a separate VLAN from data devices and receive QoS and security policies. Another capability is to request power as needed from PoE-enabled switch ports, which allows APs to adjust their power consumption and performance based on the available power budget. The other options are incorrect because they are either not enabled by LLDP-MED or not related to LLDP-MED. References: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/wlan-qos/lldp-med.htm https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/wlan-rf/poe.htm

The capability that enables plug-and-play provisioning of access points in an HPE Aruba network is the UCC Service. The UCC Service is a cloud-based service that allows the access points to automatically discover and connect to the Aruba Central management platform without any manual intervention. The UCC Service also provides zero-touch configuration, firmware updates, and monitoring for the access points1.

The other options are incorrect because:

B. LLDP-MED: LLDP-MED is a protocol that enhances the interoperability between network devices and IP phones. It does not enable plug-and-play provisioning of access points2.

C. SRTP: SRTP is a protocol that provides encryption and authentication for voice and video traffic. It does not enable plug-and-play provisioning of access points3.

D. CSMA: CSMA is a protocol that regulates how devices share a common medium, such as a wireless channel. It does not enable plug-and-play provisioning of access points.

To create a new OSPF configuration for a separate routing table, you need to create a new OSPF process ID with vrf name. This will create a new OSPF instance that is associated with the specified VRF and its routing table. The other options are incorrect because they either do not create a new OSPF instance or do not associate it with a VRF. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch02.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch03.html

The reason is that AOS 10.x does not support clustering gateways with different versions in the same cluster profile. A cluster profile defines the configuration settings for a group of gateways that are managed by Aruba Central.

According to the Aruba documentation2, “You can combine 7200 Series and 7000 Series gateways in the same cluster with a maximum size of four devices with reduced AP client capacity on 7000 Series gateways.”

HPE Aruba Networking Central performs rogue AP detection, classification, and containment through RAPIDS (Rogue Access Point Intrusion Detection System). In the Classic Central interface, detected wireless devices are managed under Security > RAPIDS > Rogues. RAPIDS categorizes detected APs as Rogue, Suspected Rogue, Interfering, Neighbor, Manually Contained, or other applicable states. Aruba Networking

For manual reclassification, the administrator selects the detected AP, chooses Reclassify, and then selects the desired classification. Aruba documentation explicitly lists Rogue, Neighbor, and Manually contained among the available manual classifications. A Manually contained classification enables rogue containment against the selected AP, subject to the required containment configuration being enabled. Aruba Networking

Therefore, Security > RAPIDS is the appropriate location for this task. Applications > IDS/IPS is not the workflow used to reclassify detected APs. Devices > Access Points primarily manages authorized infrastructure APs rather than RAPIDS classifications. Audit Trail records administrative and system activities; it is not the rogue-device classification interface.

Study Guide Topics: Aruba Central Security, RAPIDS, WIDS/WIPS, Rogue AP Classification, Manual Containment, Neighbor APs.

 Aruba Installer App is a mobile app that simplifies site installations and enables network connectivity for Aruba devices. The app allows the user to scan the barcode of the device and add it to the network using Aruba Central. The app also automates importing Aruba devices into Aruba NetEdit for intelligent configuration management and continuous conformance validation

Encryption is a feature supported by SNMPv3 that provides an advantage over SNMPv2c. Encryption protects the confidentiality and integrity of SNMP messages by encrypting them with a secret key. SNMPv2c does not support encryption and relies on community strings for authentication and authorization, which are transmitted in clear text and can be easily intercepted or spoofed. Transport mapping, community strings, and GetBulk are features that are common to both SNMPv2c and SNMPv3. References: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/snmp/snmp.htm https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/snmp/snmpv3.htm

These are the correct requirements to ensure that WMM (Wi-Fi Multimedia) is working effectively. WMM is a standard that provides quality of service (QoS) for wireless networks by prioritizing traffic into four categories: voice, video, best effort, and background. To use WMM, both the APs and the controller must be Wi-Fi CERTIFIED for WMM, which means they have passed interoperability tests and comply with the standard. WMM must also be enabled on the APs and the controller, which is usually the default setting. The client device must also be Wi-Fi CERTIFIED for WMM and configured for WMM marking, which means it can tag its traffic with the appropriate priority level based on the application type. The other options are incorrect because they are either not related to WMM or not required for WMM to work. References: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/wlan-qos/wmm.htm https://www.wi-fi.org/discover-wi-fi/wi-fi-certified-wmm

The Aruba CX 6400 switch is a modular switch that supports high-performance and high-density Ethernet switching for campus and data center networks. One of the features that distinguishes the Aruba CX 6400 switch from most typical campus switches is virtual output queueing (VOQ). VOQ is a technique that implements large ingress packet buffers on each port to prevent head-of-line blocking and packet loss due to congestion2. VOQ allows each port to have multiple queues for different output ports and prioritize packets based on their destination and QoS class2. VOQ enables the Aruba CX 6400 switch to achieve high throughput and low latency for various traffic types and scenarios. References: 2 https://www.arubanetworks.com/assets/ds/DS_CX6400Series.pdf

In the AOS-CX behavior covered by this Campus Access question, an HPE Compute/Server DAC is treated as an unsupported transceiver product when it is not specifically included in the supported Aruba CX transceiver matrix. HPE Aruba ' s AOS-CX Fundamentals documentation explicitly identifies HPE-branded products intended for HPE Compute Servers or Storage as examples of products classified as unsupported for AOS-CX switching platforms. Aruba Networking

The AOS-CX mechanism for permitting such devices is Unsupported Transceiver Mode (UT-mode) , controlled using the global:

allow-unsupported-transceiver

command. The command permits unsupported optical transceivers, DACs, and AOCs to establish connections on supported interfaces. Aruba Networking

Therefore, for the certification scenario, the Server DAC connected to interface 1/1/26 requires allow-unsupported-transceiver to be enabled, making C the intended answer. Simply stating that the port remains disabled describes the consequence when unsupported-transceiver operation is not permitted, but C identifies the actual configuration requirement.

Be aware that Aruba has changed default UT-mode behavior in later AOS-CX releases, so this question should be interpreted according to the course/exam software context rather than assuming every current release behaves identically. Aruba Networking

Study Guide Topics: CX 6300 Interfaces, DAC Support, Unsupported Transceiver Mode, Transceiver Compatibility, allow-unsupported-transceiver.

According to the Aruba Documentation Portal1, the Aruba CX 6200F VSF stack is a feature that allows you to create a virtual switching framework (VSF) with up to eight members that can be managed as a single logical device. The VSF stack provides benefits such as load balancing, failover, redundancy, and security.

To add a new device to the VSF stack, you need to configure the device with the VSF command vsf member and specify the type, link, and secondary-member information. The type of the new device can be one of the following: JL726A, JL726B, JL726C, or JL726D. The link is the interface that connects the new device to the existing VSF members. The secondary-member is an optional parameter that specifies which member will act as a backup in case of a failure.

1: https://www.arubanetworks.com/techdocs/AOS-CX/10.06/HTML/5200-7726/index.html 2: https://buy.hpe.com/us/en/networking/switches/fixed-port-l3-managed-ethernet-switches/6000-switch-products/aruba-6200f-48g-4sfp-switch/p/jl726a 3: https://addin.co.th/shop/switch/aruba-switch/6200f-series/jl726a/

The best option to enhance security for the new IP cameras and scanners in this environment is C. MPSK provides for each device in the WLAN to have its own unique pre-shared key.

MPSK stands for Multi Pre-Shared Key, and it is a feature that allows different devices to connect to the same SSID with different pre-shared keys. This improves the security and scalability of the network, as each device can have its own key and role without requiring 802.1X authentication or an external policy engine. MPSK can be configured either locally on the AP or centrally on Aruba Central12.

The other options are incorrect because:

A. MPSK Local is a feature that allows the user to configure 24 PSKs per SSID locally on the device. These local PSKs would serve as an extension of the base MPSK functionality. However, MPSK Local is not suitable for this scenario, as it can only support up to 24 devices per SSID, while the client has 250 devices1.

B. Aruba ClearPass is a network access control solution that can perform 802.1X authentication and install certificates for devices. However, this option is not feasible for this scenario, as the new IP cameras and scanners do not support 802.1X authentication3.

D. MPSK Local will not allow the cameras to share a key and the scanners to share a different key. MPSK Local will assign a different key to each device, regardless of their type. Moreover, MPSK Local can only support up to 24 devices per SSID, while the client has 250 devices1.

The reason is that the Inter-Switch Link Protocol (ISLP) is a protocol that enables VSX stack join and synchronization between two VSX peer switches. ISLP uses a hello interval to exchange control messages between the switches.

The hello interval is a parameter that specifies the time interval between sending hello messages. The default value of the hello interval is 1 second. The hello interval can be configured from 1 second to 10 seconds.

https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/index.html

Two parts of the solution for these requirements are Option C and Option E.

Option C is a part of the solution because it defines a policy-based routing action list named route_test, which specifies the next hop IP address as 10.1.1.253 for the matching traffic. This is the new default route that the user wants to use for the subnet 10.2.250.0/24. The interface null parameter indicates that the traffic will be routed to the next hop without using a specific interface1.

Option E is a part of the solution because it applies the policy-based routing action list route_test to the VLAN interface 250, which has an IP address of 10.2.250.1/24. This is the subnet that the user wants to test the new default route for. The apply policy command enables policy-based routing on the interface and associates it with the action list2.

Option A is not a part of the solution because it defines a policy-based routing action list named route_test, but does not specify the next hop IP address as 10.1.1.253, which is the new default route that the user wants to use. Instead, it specifies a next hop IP address of 10.1.1.254, which is different from the requirement.

Option B is not a part of the solution because it defines a policy-based routing action list named route_test, but does not specify any next hop IP address at all, which is necessary for policy-based routing to work. Instead, it specifies an interface null parameter without any IP address, which is invalid.

Option D is not a part of the solution because it applies the policy-based routing action list route_test to the VLAN interface 200, which has an IP address of 10.2.200.1/24. This is not the subnet that the user wants to test the new default route for, but a different subnet that should not be affected by this change.

When a UXI sensor must be deployed into an environment protected by 802.1X but lacks cellular connectivity, the appropriate bootstrap mechanism is the UXI Onboarding application using Bluetooth. The sensor initially cannot authenticate to the protected network because it has not yet obtained the required 802.1X credentials, certificates, or other connectivity configuration. Bluetooth provides an out-of-band path for supplying that initial configuration.

HPE Aruba Networking ' s UXI onboarding documentation states that when Ethernet connectivity or cellular onboarding is unavailable, the UXI onboarding app can send the sensor ' s initial configuration over Bluetooth. The application supports configuring network parameters including 802.1X credentials and certificates. Cape Networks Help Center

HPE ' s UXI QuickSpecs likewise confirms that UXI sensors include a Bluetooth 5.0 radio specifically enabling setup through the UXI mobile application. Hewlett Packard Enterprise

Therefore, D is correct. Barcode scanning alone does not solve the sensor ' s protected-network connectivity requirement. Sensors are not onboarded by daisy-chaining configuration from another UXI, and UXI deployment is not based on serial-CLI provisioning.

Study Guide Topics: UXI Sensor Deployment, UXI Onboarding, Bluetooth Provisioning, 802.1X Authentication, Sensor Bootstrap Connectivity.

PAPI is the protocol that is used to establish tunnels between the CX switch and the Aruba Gateway for Dynamic Segmentation1. By default, PAPI uses a simple checksum to verify the integrity of the messages, but it does not encrypt the payload2. This could expose the network to spoofing or replay attacks by malicious actors. To address this situation, the administrator must enable Enhanced PAPI security, which uses AES-256 encryption and HMAC-SHA1 authentication to protect the tunnel traffic2. Enhanced PAPI security can be enabled on the CX switch by using the command system papi enhanced-security enable3. This will ensure that the tunnels built between the CX switch and the Aruba Gateway are encrypted and authenticated.

The persona role option that should be selected to deploy a Gateway and take advantage of all the SD-WAN features is A. ArubaOS 10 Branch.

ArubaOS 10 Branch is a persona that enables the Gateway to provide both LAN and WAN functionality for branch networks. The Gateway can act as a wireless controller, a router, a firewall, and an SD-WAN device. The SD-WAN features include route and tunnel orchestration, dynamic path steering, forward error correction, SaaS traffic optimization, SASE orchestration, and more1.

The other options are incorrect because:

B. ArubaOS 10 VPN Concentrator: This is a persona that enables the Gateway to act as a VPN concentrator for remote access or site-to-site VPN connections. It does not provide SD-WAN features2.

C. ArubaOS 10 Wireless: This is a persona that enables the Gateway to act as a wireless controller for campus networks. It does not provide SD-WAN features3.

D. ArubaOS 10 Mobility: This is a persona that enables the Gateway to act as a mobility controller for campus networks. It does not provide SD-WAN features.

Multi-Domain Authentication is the feature that should be enabled to support the requirement that the switch must be able to authenticate a single computer connected through a VoIP phone. Multi-Domain Authentication is a feature that allows an Aruba CX switch to apply different authentication methods and policies to different devices connected to the same port. For example, a VoIP phone and a computer can be connected to the same port using a single cable, but they can be authenticated separately using different credentials and assigned to different VLANs. The other options are incorrect because they either do not support multiple devices on the same port or do not provide authentication. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.05/HTML/5200-7540/GUID-7D9E9F6E-5C2A-4F7E-BE6D-A2C3A6C7B9F9.html https://www.arubanetworks.com/assets/tg/TB_ArubaCX_Switching.pdf

The difference in the noise floor perceived by a client using a bonded 40 MHz wide channel as compared to an unbonded 20 MHz wide channel is 3 dB. The noise floor is the level of background noise in a given frequency band. When two adjacent channels are bonded, the noise floor increases by 3 dB because the bandwidth is doubled and more noise is captured. The other options are incorrect because they do not reflect the correct relationship between bandwidth and noise floor. References: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/wlan-rf/rf-fundamentals.htm https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/wlan-rf/channel-bonding.htm

Class 3 (15.4W): 802.3af

Class 4 (30W): 802.3at

Class 6 (60W): 802.3bt

Class 8 (90W): 802.3bt

The statements that are true regarding Aruba NAE agents are A and C.

A. A single NAE script can be used by multiple NAE agents. This means that you can create different instances of the same script with different parameters or settings. For example, you can use the same script to monitor different VLANs or interfaces on the switch1.

C. NAE agents will never consume more than 10% of switch processor resources. This is a built-in safeguard that prevents the agents from affecting the switch performance or stability. If an agent exceeds the 10% limit, it will be automatically disabled and an alert will be generated2.

The other options are incorrect because:

B. NAE agents are not active at all times. They can be enabled or disabled by the user, either manually or based on a schedule. They can also be disabled automatically if they encounter an error or exceed the resource limit1.

D. NAE scripts do not need to be reviewed and signed by Aruba before being used. You can create your own custom scripts using Python and upload them to the switch or Aruba Central. You can also use the scripts provided by Aruba or other sources, as long as they are compatible with the switch firmware version1.

E. A single NAE agent cannot be used by multiple NAE scripts. An agent is an instance of a script that runs on the switch. Each agent can only run one script at a time1.

MAC Caching is a feature that allows a guest user to bypass the captive portal page after the first authentication based on their MAC address1 MAC Caching can be enabled under the splash page settings in Aruba Cloud Guest2 MAC Caching can improve the user experience and reduce the network overhead by eliminating the need for repeated authentication.

The correct mechanism is RADIUS Change of Authorization (CoA). ClearPass Policy Manager can dynamically alter or terminate an already authenticated network session by sending a RADIUS dynamic-authorization message to the network access device. Aruba defines dynamic authorization as the capability to modify a user ' s authorization while the session is active, including disconnecting the session. Aruba Networking

For guest accounts, ClearPass can associate an expiration time or permitted access duration with the account. When the configured expiration condition requires the guest to be logged out, ClearPass can issue a RADIUS Disconnect-Request to the NAS, such as an Aruba wireless controller or access infrastructure. Aruba ' s ClearPass Guest documentation specifically describes the Disable and logout behavior as disabling further authorization and using a RADIUS Disconnect-Request for matching active sessions. Aruba Networking Once disconnected, the client must go through the applicable authentication and authorization process again before network access can resume.

An Authorization Profile defines what access should be granted but does not itself provide the dynamic session-disconnect mechanism. Active Directory session timeout and Wi-Fi Sense do not fulfill this ClearPass enforcement function.

Study Guide Topics: ClearPass Policy Manager, AAA, Guest Access, RADIUS Dynamic Authorization, Change of Authorization (CoA), Disconnect-Request, Session Enforcement.

The correct answer is B. Spanning-tree instance VLAN mapping.

To load-balance VLANs with MSTP, you need to configure the same VLAN-to-instance mapping on all switches in the same MST region. This means that you need to assign different VLANs to different MST instances, and then adjust the spanning tree parameters (such as priority, cost, or port role) for each instance to achieve the desired load balancing. For example, you can make one switch the root for instance 1 and another switch the root for instance 2, and then map half of the VLANs to instance 1 and the other half to instance 2.

According to the Cisco document Understand the Multiple Spanning Tree Protocol (802.1s), one of the steps to configure MST is:

Split your set of VLANs into more instances and configure different MST settings for each of these instances. In order to easily achieve this, elect Bridge D1 to be the root for VLANs 501 through 1000, and Bridge D2 to be the root for VLANs 1 through 500. These statements are true for this configuration:

Switch D1(config)#spanning-tree mst configuration

Switch D1(config-mst)#instance 1 vlan 501-1000

Switch D1(config-mst)#exit

Switch D1(config)#spanning-tree mst 1 priority 0

Switch D2(config)#spanning-tree mst configuration

Switch D2(config-mst)#instance 2 vlan 1-500

Switch D2(config-mst)#exit

Switch D2(config)#spanning-tree mst 2 priority 0

The above commands create two MST instances, 1 and 2, and map VLANs 501-1000 to instance 1 and VLANs 1-500 to instance 2. Then, they make switch D1 the root for instance 1 and switch D2 the root for instance 2.

The other options are incorrect because:

A. Spanning-tree bpdu-guard setting is a security feature that disables a port if it receives a BPDU from an unauthorized device. It does not affect load balancing with MSTP.

C. Spanning-tree CIST mapping is not a valid command. CIST stands for Common and Internal Spanning Tree, which is the spanning tree instance that runs within an MST region and interacts with other regions or non-MST switches.

D. Spanning-tree root-guard setting is another security feature that prevents a port from becoming a root port if it receives superior BPDUs from another switch. It does not affect load balancing with MSTP.

This is the best practice for handling voice traffic with dynamic segmentation on AOS-CX switches. Dynamic segmentation is a feature that allows AOS-CX switches to tunnel user traffic to a controller or another switch based on user roles and policies. For voice traffic, it is recommended to use switch authentication and local forwarding, which means the voice devices are authenticated by the switch and their traffic is forwarded locally without tunneling. This reduces latency and jitter for voice traffic and improves voice quality. The other options are incorrect because they either use central authentication or tunneling, which are not optimal for voice traffic. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch05.html https://www.arubanetworks.com/assets/ds/DS_AOS-CX.pdf

https://www.howtogeek.com/794724/what-is-wi-fi-calling/ 2: https://www.networkcomputing.com/networking/your-network-optimized-wifi-calling 3: https://www.arubanetworks.com/techdocs/AOS-CX/10.10/HTML/monitoring_6300-6400/Content/Chp_LEDs/fro-pan-led-630.htm

The reason is that PBR allows you to route packets based on policies that match certain criteria, such as source or destination IP addresses, ports, protocols, etc. PBR can also be used to set metrics, next-hop addresses, or tag traffic for different routes.

For switches to participate in the same Multiple Spanning Tree Protocol (MSTP) region, their MST region configuration must match. One of the critical parameters is the configuration revision number, configured in AOS-CX using:

spanning-tree config-revision < REVISION-NUMBER >

HPE Aruba Networking explicitly states that all switches within an MST region must have identical revision numbers. The revision number forms part of the MST region identity along with the configuration name and VLAN-to-instance mapping. Aruba Networking

This is essential for VLAN load balancing because MSTP allows different VLAN groups to be mapped to different MST instances. Each instance can then use a different spanning-tree topology/root, allowing otherwise blocked redundant links to forward traffic for other VLAN groups. Aruba ' s MSTP configuration example specifically demonstrates that changing the root for individual instances permits more effective load sharing across redundant links. Aruba Networking

The spanning-tree priority does not need to be identical; in fact, different instance priorities are deliberately used when different switches should become roots for different MST instances. Likewise, “root” and “secondary root” describe root-election behavior rather than an MST region parameter that must be identical across Access-1 and the other participating switches.

Therefore, among the choices, spanning-tree config-rev is the required identical configuration.

Study Guide Topics: MSTP, MST Regions, Configuration Revision, VLAN-to-MSTI Mapping, Root Bridge Selection, VLAN Load Balancing.

Multicast Transmission Optimization (MTO) improves wireless multicast efficiency by allowing an Aruba AP to transmit broadcast and multicast frames at a higher data rate than the normally configured basic multicast rate. In Aruba Instant and Aruba Central WLAN configuration, the AP determines the optimized rate using the lowest unicast rate among all associated clients, ensuring that every associated client can still receive the multicast transmission reliably. Aruba Networking

Critically, Aruba documentation states that when this feature is enabled, multicast traffic can be transmitted at up to 24 Mbps. Therefore, B is the correct answer. In the documented Instant implementation, the normal default multicast transmission rates are typically much lower—1 Mbps on 2.4 GHz and 6 Mbps on 5 GHz—so MTO can substantially reduce airtime consumed by multicast traffic. Aruba Networking

Option A is incorrect because Aruba uses the lowest, not highest, unicast rate of associated clients. Option C incorrectly specifies 48 Mbps. Option D is also incorrect because MTO ' s rate-selection mechanism is based on client unicast data rates, not client latency. Aruba Networking

Study Guide Topics: WLAN Optimization, Multicast Transmission Optimization, Broadcast/Multicast Traffic, Wireless Data Rates, Aruba Instant/Central WLAN Profiles.

The default management role that should have been assigned for the user is B. operators.

The operators user role is a predefined role that allows users to view nonsensitive configuration information on the switch, such as interfaces, VLANs, routing protocols, statistics, and more. The operators user role has a privilege level of 1, which is the lowest level of access on the switch1.

The administrators user role is a predefined role that has full access to all switch configuration information and all REST API methods. This role is more than what the Director of Security requires1.

The calculated Equivalent Isotropic Radiated Power (EIRP) for AP1 is 17 dBm.

EIRP is the measured radiated power of an antenna in a specific direction. It is equal to the input power to the antenna multiplied by the gain of the antenna. It can also take into account the losses in transmission line, connectors, and other components. The formula for EIRP is:

EIRP = P + G - L

where P is the output power of the radio, G is the gain of the antenna, and L is the loss of the cable and connectors.

For AP1, we have:

P = 10 dBm G = 9 dBi L = 2 dB

Therefore,

EIRP = 10 + 9 - 2 EIRP = 17 dBm

On an AOS-CX switch, REST API authentication uses the HTTP POST method against the login resource. Aruba specifies that a REST API session is initiated by sending the username and password through a POST request. After successful authentication, the switch returns session information that is used for subsequent API requests. Aruba Networking

For changing the administrator password, Aruba documents the use of PUT against the user resource, for example PUT /rest/v10.xx/system/users/admin, with the new password included in the request data. Therefore, D correctly associates POST with login and PUT with changing the management password. Aruba Networking

Option A is incorrect because AOS-CX does not provide comprehensive semantic validation for REST writes. Aruba explicitly warns that configuration errors written directly to the database can destabilize the switch. Aruba Networking

Option B is also incorrect. Read-only mode blocks writes to most resources, but exceptions exist. POST is still permitted for functions such as login, and certain PUT/POST operations remain available. Aruba Networking Option C simply reverses the correct HTTP methods.

Study Guide Topics: AOS-CX REST API, REST Authentication, HTTP POST/PUT Methods, API Access Modes, Read-Write versus Read-Only Access.

The required optimization is to use IEEE 802.3az Energy Efficient Ethernet (EEE) across the AP deployment. Aruba documentation states that 802.3az allows supported APs to consume less power during periods of low data activity, which directly matches the scenario of reducing nighttime energy consumption. Aruba Networking

However, Aruba explicitly documents that 802.3az is not supported on the AP-315 or the 330 Series, which includes the AP-335. Aruba Networking Consequently, those older AP-315 and AP-335 units must be replaced with models supporting EEE. The AP-515 belongs to a newer generation and does not fall within Aruba ' s documented EEE exclusions, so replacing the AP-515 is unnecessary.

After installing EEE-capable replacements, 802.3az should be enabled across the AP environment, allowing Ethernet links to reduce power usage during low-traffic periods.

IPM is not the primary mechanism for this requirement. Aruba describes Intelligent Power Monitoring as dynamically restricting AP functions when AP consumption approaches or exceeds its available power budget. It is primarily concerned with operating an AP within available PoE resources, rather than automatically exploiting nighttime Ethernet inactivity. Aruba Networking

Study Guide Topics: Energy Efficient Ethernet (802.3az), AP Ethernet Link Profiles, AP Power Optimization, Intelligent Power Monitoring (IPM), Campus WLAN Sustainability.

This is because option C shows how to create a single group in Central with different configuration methods defined for each device type. For example, you can create a group with the name Group1, and within this group, you can enable template-based configuration method for switches and UI-based configuration method for Instant APs and Gateways. Aruba Central identifies both these groups under a single name (Group1). If a device type in the group is marked for template-based configuration method, the group name is prefixed with TG (TG Group1). You can use Group1 as the group ID for workflows such as user management, monitoring, reports, and audit trail2.

https://www.arubanetworks.com/techdocs/central/latest/content/nms/groups/abt-groups.htm 2: https://www.arubanetworks.com/techdocs/central/latest/content/nms/groups/groups.htm

This is the correct explanation of how roles can help keep consistent policy enforcement in a distributed overlay fabric. Roles are used to assign group based policy IDs (GBPs) to devices after they authenticate with ClearPass or a local database. GBPs are then used to tag the traffic from the devices and send them to the ingress VTEP, which applies the GBP on the VXLAN header. The egress VTEP then enforces the policy based on the GBP and the destination device. The other options are incorrect because they either do not describe the correct sequence of events or do not use the correct terms. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch03.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch05.html

Active gateway is a first hop redundancy protocol that eliminates a single point of failure. The active gateway feature is used to increase the availability of the default gateway servicing hosts on the same subnet. An active gateway improves the reliability and performance of the host network by enabling a virtual router to act as the default gateway for that network. If you have enabled active gateway, VRRP is not required3. Active gateway is similar to VRRP in that routed traffic from the VSX node is sourced from the switch interface MAC and not the virtual MAC address (VMAC). Each active gateway sends a periodic broadcast hello packet to avoid VMAC aging on the access switches. The switch views the active gateway IP as a self IP address3. Active gateway is preferable over VRRP because with VRRP traffic is still pushed over the ISL link, resulting in latency in the network3. Therefore, VRRP and active gateway are mutually exclusive on a VLAN, and answer A is correct.