HPE6-A86 HPE Network Switching Associate Exam Questions and Answers

The correct answer is C. The wrong subnet mask has been configured. The PC is configured with IP address 10.211.55.151 and subnet mask 255.255.255.0, which is a /24 network. However, the HPE Aruba Networking CX switch SVI for VLAN 55 is configured as 10.211.55.1/25. A /25 mask divides the 10.211.55.0/24 range into two subnets: 10.211.55.0–10.211.55.127 and 10.211.55.128–10.211.55.255. The switch gateway address 10.211.55.1/25 is in the first /25 subnet, while the PC address 10.211.55.151 is in the second /25 subnet. This means the PC and its configured default gateway are not actually in the same subnet from the switch’s perspective. HPE Aruba Networking AOS-CX CLI documentation shows IP addressing on interfaces using prefix-length notation, such as /25, which defines the subnet size. Option A is incorrect because the port is configured with no shutdown and no STP error state is shown. Option B is incorrect because an access port does not require VLAN tagging from the PC. Option D is incorrect because a PC normally uses a default gateway, not a static route, for Internet access.

Built-in stateful firewall = D

400Gb port speeds = C

7–12U chassis form factor = A

8U chassis form factor = B

The correct matches are CX 10000 for built-in stateful firewall, CX 9300 for 400Gb port speeds, CX 6400 for the 7–12U chassis form factor, and CX 8400 for the 8U chassis form factor. HPE Aruba Networking documentation describes the CX 10000 Distributed Services Switch as including stateful firewall capabilities through its distributed services architecture, making it the correct match for built-in stateful firewall. The CX 9300 is identified by HPE Aruba Networking as a high-density 100G/400G switch platform, so it matches the 400Gb port-speed feature. The CX 6400 is a modular chassis family available in 5-slot and 10-slot models; HPE QuickSpecs describe these as compact 7 RU and 12 RU chassis models, matching the 7–12U chassis form factor. The CX 8400 is a modular campus core and aggregation switch described by HPE as a compact 8-slot, 8U chassis, which matches the 8U chassis form factor. These four features are product-line differentiators and should not be interchanged.

The correct answer is C. The DHCP server has run out of leases. The key clue is the LLDP neighbor management address of 169.254.2.58. A 169.254.x.x address is a link-local address, which indicates the AP did not successfully receive a usable DHCP address from the intended management VLAN. The switch configuration shows VLAN 10 has an SVI address of 10.80.10.1/24 and an ip helper-address 10.200.10.51, so the DHCP server does not need to be in the same subnet as the AP. HPE Aruba Networking AOS-CX documentation explains that DHCP relay forwards DHCP messages from clients on a subnet without a local DHCP server to DHCP servers on other subnets and relays answers back to clients. Therefore, option B is incorrect. Option A is incorrect because Aruba APs support DHCP for address assignment. Option D is not the best answer because the AP is on the native VLAN of a trunk, which can carry untagged management traffic while also allowing additional VLANs. The likely issue is DHCP service failure, such as no available leases.

The correct answer is A. CX 6300. The requirement asks for a fixed 1U access switch that can support 25G speeds toward the aggregation layer. HPE Aruba Networking CX 6300 switches are described as stackable switches suitable for enterprise access, aggregation, core, and data center top-of-rack deployments. HPE QuickSpecs for the CX 6300 list 1U models with SFP/SFP+/SFP28/SFP56 transceiver support, including 1G, 10G, 25G, and 50G uplink capability depending on the model. This makes the CX 6300 the best fit among the options. The CX 6400 is not the best answer because it is a modular chassis platform, not a fixed 1U switch. The CX 6100 is an entry-level Layer 2 access switch with 10G uplinks, not 25G. The CX 6200 supports access switching with uplinks up to 10G, so it also does not satisfy the 25G uplink requirement. Therefore, the initial proposal should be the CX 6300 family.

The correct answer is A. operators. HPE Aruba Networking AOS-CX documentation for the CX 8400 identifies built-in user groups that exist by default on the switch. These include administrators, operators, and auditors. The operators group has limited privileges, such as basic display-only CLI access and the ability to view nonsensitive switch configuration information. It does not have full switch configuration privileges. The other options—helpdesk, servicedesk, and support—are not listed as built-in default user groups for the CX 8400. Those names could be created manually as custom local user groups in some environments, but they are not default AOS-CX groups. Therefore, from the available choices, the default group is operators.

The correct answer is D. As a response to the broadcast DHCP query. DHCP clients initially do not have an IP address, so they commonly use broadcast DHCP discovery/request traffic to locate a DHCP server on the local network. HPE Aruba Networking documentation for DHCP relay explains that when a DHCP client broadcasts a request, the DHCP relay agent on the switch receives the packets and forwards them to the DHCP server as unicast requests. In this scenario, the access points are in VLAN 50, and VLAN 50 also contains DHCP servers. Because the DHCP server is on the same local management VLAN as the APs, the APs can obtain addresses through the normal DHCP broadcast process within that VLAN. Anycast and multicast are not used for the basic DHCP address request in this scenario. A unicast DHCP relay message can occur between a relay agent and a DHCP server when the server is on another subnet, but the client-side DHCP discovery begins as broadcast traffic.

The correct answer is C. In-band management uses the production switching network rather than the dedicated out-of-band management port. For an HPE Aruba Networking CX 4100i switch, HPE Aruba Networking AOS-CX documentation states that configuring the in-band management interface begins by entering interface vlan 1. The guide then shows that the in-band management interface can be configured with DHCP or with a static IP address. Therefore, assigning ip address 10.10.10.10/24 under interface vlan 1 is the correct in-band management configuration from the choices. Option A is incorrect because interface mgmt is the out-of-band management interface, not in-band management. Option D is also out-of-band for the same reason. Option B is not the best answer because routing is not required under the VLAN interface for this in-band management IP configuration. The essential configuration is the VLAN interface with the static IP address

The correct answer is C. The management port is used for multi-active detection. The show vsf output clearly shows Split Detection Method : mgmt, which means the stack is using the management interface as the VSF split-detection method. HPE Aruba Networking AOS-CX VSF documentation states that VSF split detection provides a mechanism for stack fragments to discover each other if a stack split occurs. Once fragments are discovered, the fragment with the primary member remains active, while the other fragment becomes inactive and its non-VSF interfaces are brought down to avoid duplicate MAC or IP addresses and reduce network disruption. The same guide states that the 6200 and 6300 switch series support split detection through the management interface and that the CLI command to enable it is vsf split-detect mgmt. Option A is incorrect because the output does not show peer-switch-based detection. Option B is incorrect because “Status: No Split” is the current state, not the detection method. Option D is incorrect because a ring changing to a chain is a topology change, but the configured integrity method shown is management-based split detection. ( arubanetworking.hpe.com )

The correct answer is D. Peer device native VLAN ID is 1. The LLDP output shows Neighbor Port VLANID : 1, which identifies the VLAN ID advertised by the neighboring device for that port. HPE Aruba Networking AOS-CX documentation for show lldp neighbor-info explains that LLDP neighbor output displays information about neighboring devices and that the details vary based on the TLVs sent by the neighbor. In the Aruba examples, Neighbor Port VLAN ID and Neighbor Port VLAN Name are shown as LLDP fields, so the VLAN ID value in the output can be validated directly. Option A is not the best answer because although the VLAN name field is blank, the stronger validated configuration item is the VLAN ID value. Option B is incorrect because Neighbor MAU type : 10GIGBASER indicates a 10 Gigabit Ethernet BASE-R PHY type, not a 1 Gigabit transceiver. Option C is incorrect because Port: 1/1/25 is the local switch interface where the neighbor was discovered; the peer device’s port is shown separately as Neighbor Port-ID : 1/1/51. Therefore, the validated statement is that the peer device native VLAN ID is 1.

The correct answer is B. Request to issue the command no shutdown on the port the DAC cable is connected to. On HPE Aruba Networking CX 8100 and similar data center switch platforms, interfaces are Layer 3 and disabled by default. HPE Aruba Networking AOS-CX IP Services documentation states that, by default, all interfaces on these platforms are Layer 3 and disabled, and its examples explicitly enable the interface with no shutdown. Therefore, even if a supported 10Gb DAC cable is physically attached and the peer switch port is monitored, the link will remain down until the CX 8100 interface is administratively enabled. Option A is not the best answer because the symptom is not that the DAC is in the wrong port; the default shutdown state explains the link-down condition. Option C is incorrect because switching enable is not the AOS-CX command used to bring the port online. Option D is incorrect because DAC cables do not require manual Tx/Rx polarity swapping like separate fiber strands might. ( arubanetworking.hpe.com )

The correct answer is B. LLDP. Link Layer Discovery Protocol, or LLDP, is the most useful feature for building a physical connectivity diagram because it helps identify directly connected neighboring devices and their interface relationships. HPE Aruba Networking Central documentation notes that LLDP is enabled by default on switches and is used to display AOS-CX switches in topology views. Aruba Central’s topology feature provides a graphical representation of the site, including the network layout and device details. This makes LLDP directly relevant to discovering and documenting physical network connections. Option A, MSTP, is a spanning tree protocol used to prevent Layer 2 loops and manage redundant paths, not to document physical connectivity. Option C, ZTP, is used for automated device provisioning, not topology discovery. Option D, L2TP, is a tunneling protocol and is unrelated to creating physical connectivity diagrams. Therefore, LLDP is the best answer because it provides neighbor discovery information that can be used to map how network devices are physically connected.

The correct answer is D. Allowed VLANs between access switches. The diagram shows Server-1 connected to Access-2 in VLAN 20 and PC-1 connected to Access-1. The inter-switch link between Access-1 and Access-2 is shown as a trunk carrying VLANs 1, 10, and 20. If users on Access-1 cannot reach Server-1 in VLAN 20 after a recent change, while devices directly connected to Access-2 are not affected, the most likely issue is that VLAN 20 is not being correctly carried across the trunk between the access switches. HPE Aruba Networking AOS-CX documentation states that vlan trunk allowed defines which VLAN traffic is allowed across a trunk interface. It also explains that allowed VLANs are the VLANs that can be transported by the trunk; if a required VLAN is missing from the allowed list, that VLAN’s traffic will not traverse the trunk. Option A is less likely because devices directly connected to Access-2 can access Server-1, indicating Server-1’s local VLAN placement is probably correct. Option B is unlikely because a down trunk would affect more VLANs than just access to VLAN 20. Option C is not supported by the symptom pattern.

The correct answer is D. It is available as a cloud solution. HPE Aruba Networking Central is described in official Aruba documentation as a cloud-based management platform for managing AOS-CX infrastructure. It provides centralized functions for provisioning, configuring, monitoring, and troubleshooting AOS-CX switches. This means it is not limited to on-premises deployment. Option A is incorrect because AOS-CX support in Aruba Central is not limited only to templates; Central also supports monitoring, troubleshooting, and UI-based workflows depending on the software version, group type, and deployment model. Option B is also incorrect because monitoring-only mode is one supported option, but it is not the only supported mode. HPE Aruba documentation specifically notes that AOS-CX switches can be added in monitoring-only mode, but also separately documents configuration using templates and UI groups. Therefore, the broad and correct description for a customer conversation is that HPE Aruba Networking Central is available as a cloud management solution for AOS-CX switches.

The correct answers are C and D. TCP uses sequence numbers and requires an established connection. HPE Aruba Networking documentation references TCP sequence-number enforcement as a firewall/security function, which confirms that TCP traffic uses sequence numbers that can be tracked and validated. HPE Aruba documentation also describes TCP traffic with an “established” option for controlling TCP connection traffic in access control entries, which indicates that TCP is connection-oriented and maintains connection state. Option A is incorrect because TCP does support retransmission; HPE Aruba EdgeConnect documentation discusses features that avoid the need for TCP retransmission, which only makes sense because retransmission is a normal TCP behavior. Option B is incorrect because connectionless behavior describes UDP, not TCP. Option E is also incorrect because latency-sensitive traffic, such as real-time voice or video, commonly favors UDP because retransmission and connection-state handling can add delay. TCP is better suited for applications that need reliable, ordered delivery, such as web, file-transfer, or management traffic, rather than real-time latency-sensitive flows.

The correct answer is D. If the ZTP operation detects that the switch configuration is different from the factory-default configuration, the ZTP operation ends. HPE Aruba Networking AOS-CX documentation explains that the ZTP process starts when the switch boots with the factory-default configuration. During the ZTP process, if the switch detects that its configuration is different from the factory-default configuration, the ZTP operation ends and the switch must be configured at the installation site. This directly addresses the customer’s concern: ZTP is intended for new or factory-default switches, and it should not overwrite or change switches that have already been manually configured or deployed. Option A is incorrect because the end condition is not based on a TFTP server detecting a serial-number configuration file. Option B is incorrect because being added to Central is not the stated stopping condition. Option C describes force provisioning, which can intentionally start provisioning behavior, but it does not address the concern about protecting already configured switches.

The correct answer is D. 6. In a switched Ethernet network, each individual switch link or switch port represents a separate collision domain. The diagram shows four end-user device links: PC-A to the VLAN 10 access switch, PC-B to the VLAN 10 access switch, PC-C to the VLAN 20 access switch, and PC-D to the VLAN 20 access switch. It also shows two uplinks from the access switches to the Layer 3 switch or routing switch that contains the SVIs for VLAN 10 and VLAN 20. That gives a total of six physical Ethernet links, and therefore six collision domains. The VLANs do not reduce this count to two; VLANs define Layer 2 broadcast domains, not collision domains. The SVIs also do not create one collision domain; they are Layer 3 gateway interfaces used for routing between VLANs. HPE Aruba Networking campus design documentation describes Layer 2 and Layer 3 switching technologies used in campus topologies, while HPE Aruba switch documentation treats physical switch ports as individual Ethernet interfaces. For this diagram, the collision-domain count is based on the physical switched links, so the answer is 6.

The correct answer is D. VSF stacking is supported within the same switch family members. HPE Aruba Networking AOS-CX VSF documentation states that a VSF stack supports combinations of models only within a supported switch family. For example, supported 6200 family models can stack with other supported 6200 family models, and supported 6300 family models can stack with other supported 6300 family models. The documentation also states that stacking is not supported across switch families. This means a VSF stack cannot mix unrelated platforms, such as chassis and fixed switches, or combine older AOS-S/Provision switches with AOS-CX switches in the same VSF stack. Option A is incorrect because VSF does not use proprietary backplane cabling; it uses supported Ethernet links, and the supported speeds depend on the switch family. Option B is incorrect because chassis and fixed platforms are not mixed in one VSF stack. Option C is incorrect because existing Provision/AOS-S switches cannot simply add CX switches as members in the same VSF stack.

The correct answer is D. SNMPv3. HPE Aruba Networking AOS-CX hardening documentation recommends using SNMPv3 instead of older SNMP versions because older SNMP versions are unauthenticated and unencrypted, with the community string transmitted in plaintext. The same guide states that SNMPv3 supports different users, authentication, and strong encryption. This makes SNMPv3 the secure protocol among the options. HTTP is not the best answer because standard HTTP does not encrypt management or web traffic; HTTPS would be the secure alternative. TFTP is not secure because it does not provide encryption or strong authentication for file transfers. Telnet is also not secure because it sends session traffic, including login information, in clear text; SSH is the secure alternative for CLI management. Therefore, from the listed protocols, only SNMPv3 provides security mechanisms appropriate for secure network management, including authenticated and encrypted communication.

The correct answer is A. Output of show tech. HPE Aruba Networking support and diagnostics documentation commonly uses technical-support command output as a key troubleshooting artifact for TAC analysis. The documentation specifically states to check physical cabling and generate show tech when opening a TAC case. The purpose of show tech output is to collect a broad set of switch operational details, including configuration, system status, interface information, logs, and other diagnostic data that can help TAC understand the condition of the device at the time of the issue. Option B is incorrect because “generated support keys” are not the standard required item from the listed choices for opening a CX switch TAC case. Option C is incorrect because TAC does not normally require open SSH access over the Internet, and exposing management access publicly would be poor security practice. Option D is incorrect because TAC may ask for software version information, but a copy of the running firmware image itself is not the first diagnostic item to prepare. The best initial evidence is the show tech output.

The correct answer is C. auditors. HPE Aruba Networking AOS-CX documentation for the 6200, 6300, and 6400 switch series identifies three built-in user groups: administrators, operators, and auditors. These built-in groups have fixed privileges. The administrators group has full privileges, including full CLI access, firmware upgrades, configuration viewing, configuration changes, and user account management. The operators group has no switch configuration privileges and is mainly limited to basic display-only access and viewing nonsensitive configuration information. The auditors group is restricted to audit-related functions. Since the question asks which user group exists by default on a CX 6400 Series switch, “auditors” is the only listed option that matches the HPE Aruba Networking AOS-CX built-in groups. The other options—read-only, restricted, and reporting—are not listed as default built-in AOS-CX user groups for the CX 6400 platform. This makes option C the verified answer.

The correct matches are 802.3af for 15.4W, 802.3at for 30W, 802.3bt Type 3 for 60W, and 802.3bt Type 4 for 90W. HPE Aruba Networking AOS-CX PoE documentation explains that PoE powered devices are divided into different types and classes according to their power requirements. It identifies Type 1 as supplying a maximum of 15.4W from the power sourcing equipment, which corresponds to IEEE 802.3af. Type 2 supplies a maximum of 30W, which corresponds to IEEE 802.3at. Type 3 supplies a maximum of 60W and Type 4 supplies a maximum of 90W, both under IEEE 802.3bt. These values are important when selecting switch PoE capability for devices such as access points, cameras, sensors, phones, and other powered devices. The switch must have both the per-port PoE capability and enough total PoE power budget to support the connected devices.

The correct answer is C. Customers that do not allow cloud connectivity. HPE Aruba Networking Central On-Premises is intended for organizations that need Aruba Central-style management capabilities but cannot or do not want to place management data in the public cloud. Official HPE Aruba Networking Central On-Premises documentation describes it as a variant of HPE Aruba Networking Central that is deployed in the customer’s own environment, while the Validated Solution Guide states that Central On-Premises is appropriate when security requirements disallow Internet connectivity. This makes it suitable for organizations with strict regulatory, security, data sovereignty, or internal policy requirements that prevent cloud-managed network infrastructure. Option A is incorrect because using hyperscaler-hosted server resources does not, by itself, require Central On-Premises. Option B is incorrect because a SaaS-maintained management platform describes the cloud version of HPE Aruba Networking Central, not the on-premises deployment. Option D is not the best answer because geographical redundancy is not the primary use case described for choosing Central On-Premises.

The correct answer is D. Create VSF on the CX 6200 switches and a LAG between the CX 6200 and 2530 switches. HPE Aruba Networking documentation explains that VSF allows multiple individual switches to operate as a single logical device using standard Ethernet links. The CX 6200 supports VSF stacking, so two CX 6200 aggregation switches can be combined into a single logical aggregation switch. HPE Aruba Networking Layer 2 documentation also describes link aggregation as grouping individual physical interfaces into a single logical link, increasing bandwidth and providing resiliency when links fail. In this design, the 2530 access switch can use two uplink ports in a trunk/LAG toward the aggregation layer, while the CX 6200 side operates as one logical switch because of VSF. Option A is incorrect because a CX 6200 and a 2530 cannot be placed into one common VSF stack. Option B is incorrect for the same reason: the 2530 is not stacked with the CX 6200. Option C is incomplete because a LAG from one access switch to two separate aggregation switches requires the aggregation side to act as one logical switch, which is provided by VSF in option D.

The correct matches are based on how SNMP monitoring works in an HPE Aruba Networking environment. A managed device is the network device being monitored, such as a switch, router, firewall, controller, or access point. HPE Aruba Networking documentation describes SNMP as a protocol used by network management systems to monitor network-attached devices. The SNMP agent is the software function on the managed device that collects local device information and communicates status, statistics, and configuration-related information to the management system. The SNMP manager is the network management system that queries devices, receives information, and may modify supported device parameters. The Management Information Base, or MIB, is the structured database of object identifiers used to represent device status, counters, statistics, and configuration information. HPE Aruba Networking AOS-CX monitoring documentation points administrators to the SNMP/MIB Guide for configuring SNMP so a device can be monitored from a network management system.

The correct answer is A. Must be manually configured. HPE Aruba Networking AOS-CX documentation states that static routes are manually configured in the routing table. A static route defines a destination network and the next-hop address or exit interface that the switch should use to forward traffic. Static routes are useful in small, simple, or predictable networks because they are straightforward and do not require a dynamic routing protocol to exchange route information. Option B is incorrect because automatically learned routes are associated with dynamic routing protocols, such as OSPF or BGP, not static routing. Option C is incorrect because static routes usually have low processing overhead compared to dynamic routing protocols, since the switch does not need to run neighbor discovery, exchange routing updates, or calculate topology changes. Option D is incorrect because static routes do not automatically respond to network topology changes unless supported by an additional tracking mechanism or manually changed by an administrator. Therefore, the defining characteristic of a static route is manual configuration.

The correct answer is A. SNMP v3. HPE Aruba Networking AOS-CX hardening documentation recommends using SNMPv3 instead of older SNMP versions. Older SNMP versions are unauthenticated and unencrypted, and the community string is transmitted in plaintext. SNMPv3 supports users, authentication, and strong encryption, including stronger authentication and privacy protocols. This makes SNMPv3 the correct version when the requirement is to monitor switches with encrypted SNMP data. Option B and option C are incorrect because SNMPv2 and SNMPv2c do not provide the same authentication and encryption protections required by the question. Option D is incorrect because SNMPv4 is not a valid SNMP version used for this purpose on HPE Aruba Networking CX switches. Therefore, the secure SNMP monitoring choice is SNMPv3.