HPE6-A90 HPE Networking Central Exam Questions and Answers

Technical explanation

The Device Health card summarizes how many access points are healthy, impaired or offline within the current site or global context. Its expanded representation can break counts down by site and by device class, helping the administrator rank incidents by blast radius. Distinguish an unreachable device from one still online but reporting degraded hardware or service health. RF Optimization is for radio planning, and topology is for connectivity relationships; aggregate health counts belong to the dedicated health view.

Topology says where APs attach; RF Optimization addresses channel/power behavior. Device Health is built to aggregate operational status and direct the engineer toward offline or degraded APs.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Enterprise mode uses the 802.1X and Extensible Authentication Protocol exchange between the supplicant and the authentication backend. Configure the primary RADIUS authentication server or server group, a shared secret or RadSec relationship as supported, and a reachable network path from the authenticating device. Certificate trust and appropriate EAP methods are equally important. VLAN assignment rules are optional authorization refinements, while WPA3 transition mode concerns compatibility and is not the component that performs enterprise identity validation.

Dynamic VLAN rules in B can follow authentication but are not a prerequisite for establishing the enterprise 802.1X session. WPA3 transition mode in C is not the RADIUS identity service. An authentication server is the missing dependency.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Select the interval matching the overnight complaint and inspect event timestamps against authentication failures, DHCP activity, uplink transitions, AP restarts and configuration pushes. Correlating several event categories avoids mistaking the symptom for its cause. For example, multiple client disconnects coinciding with a PoE switch reboot indicate a likely shared infrastructure problem, not dozens of individual WLAN faults. Remember that dashboards may aggregate or delay telemetry; use raw device logs or system audit records when minute-level ordering matters.

A neighbor count reports adjacency, not the precise start and end of an incident. Subscription expiry is useful for licensing administration but cannot explain a ten-minute night-time interruption unless associated with specific device events.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

In a Layer 3 routed Microbranch design, client source addresses remain visible end-to-end and the enterprise must advertise or otherwise route the local client subnet toward return traffic. In an L3 NATed design, the AP translates outbound sessions to a tunnel or uplink address, reducing the need to distribute a route for every branch WLAN subnet. NAT simplifies routing but can limit source-IP visibility and inbound connection behavior. Choose the mode based on enterprise identity, application reachability and route-scale requirements rather than treating both modes as equivalent forwarding. In a routed Microbranch subnet, the VPN concentrator or upstream network needs a return route toward the branch client pool. With NAT, outside services instead see the AP translated address, reducing route advertisement needs but obscuring individual client addressing.

Option A reverses source translation and route-advertisement behavior. Option C concerns gateway-client balancing, not Microbranch routing modes, and D incorrectly assumes corporate DHCP/L2 simulation is intrinsic to both L3 modes. The deciding factor is whether upstream networks see the client subnet or an AP-translated address.

Official HPE references | Layer 3 Microbranch - Validated Solution Guide • Configuring VLANs - Microbranch | Study-guide topic: Introduction to AOS-10

Technical explanation

Built-in tests run against supported Central-managed infrastructure, and available commands depend on the device type and release. APs, gateways, bridges and AOS-CX/AOS-S switches can expose appropriate ping, traceroute, DNS, cable or protocol diagnostics through their supported tools. A ClearPass appliance or arbitrary third-party firewall is not automatically a Central-managed troubleshooting endpoint. Choose the correct test origin; performing DNS resolution from an AP is not equivalent to testing client DNS access when the two paths use different policies.

Air monitors, conductors and DNS appliances are not all standard managed sources of these troubleshooting tests. Likewise, ClearPass servers and arbitrary firewalls are separate products, not automatically Central test endpoints. The capability follows supported managed device families.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

From a site dashboard, open the Network planet to display the Unified Device List. Identify the switch, AP or gateway and select its troubleshooting icon to enter the device-specific diagnostic workspace. The default Tests tab exposes appropriate sourced tests; Remote Console or Commands may be available according to device and permission. The Clients and Applications planets provide useful adjacent context but are not the direct route requested for choosing an infrastructure device and launching its diagnostics.

The topology sunburst changes visual focus rather than invoking a device’s diagnostic tools. Clients and Applications planets concern endpoints or flows. The site Network planet exposes the device list and its Troubleshoot control. The documented route is Sites > [site] > Network > Unified Device List > troubleshooting icon; Tests opens by default.

Official HPE references | Viewing the Troubleshooting Page • Troubleshooting Tools | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The Connections card provides connection and session context for the selected clients, including whether attempts progressed through authentication and association. Group the failures by WLAN, radio, endpoint operating system and identity backend; a common failure stage often identifies the shared dependency. When an error appears as an authentication timeout, validate AAA transport and RADIUS responsiveness rather than assuming the passwords are incorrect. The RF Health and connectivity path cards answer different questions: spectrum condition and traffic path, respectively.

RF Health may explain weak links, while Connectivity Path is primarily a network-path view. Neither is as direct as the Connections card for linking unsuccessful authentication and connection status to actual client sessions.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A tunneled SSID sends the relevant wireless user traffic to a gateway cluster, where the gateway can evaluate its stateful role-based policies. Confirm that the client's role is assigned at authentication, that the correct rules are installed at the gateway, and that user VLANs terminate on the cluster. Bridged forwarding keeps the datapath local, so policies on a remote gateway cannot inspect those frames. Mixed mode may tunnel selected VLANs, but the simple and unambiguous choice for all affected users is tunneled forwarding. If gateway inspection is mandatory for every client in the given role, mixed forwarding introduces an avoidable bypass condition because a locally bridged VLAN can avoid the gateway datapath.

Microbranch patterns provide selective site forwarding but do not automatically place every target session in the gateway datapath. Mixed mode can bridge some clients locally, bypassing centralized inspection. Tunnel mode makes gateway-side enforcement the explicit default path.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The AP's connectivity performance data should be read alongside its current associated-client population so an apparent throughput drop is not mistaken for reduced demand. Compare upstream and downstream rates, concurrent user count, radio-band split and temporal trends. High association count does not necessarily equal saturation; airtime consumption and retries matter more than device count alone. The health overview aggregates fault indicators, while radio optimization shows RF planning rather than the immediate per-device operational throughput requested.

The global health view is useful for finding unhealthy APs but not monitoring one radio’s live load. RF Optimization focuses on channel/power optimization. Open the individual AP context for real-time performance and client-count telemetry.

Official HPE references | AirMatch • Planets in Global Monitoring Page | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Create a VSX pair in the aggregation tier and a VSX LAG/MC-LAG extending to each aggregation member, while the access stack uses LACP toward the two peers. The access device sees a single logical bundle even though the links terminate on different chassis. Correct ISL, peer keepalive, VLAN membership and LACP settings are essential for deterministic failover. Separate unaffiliated access ports force spanning-tree or routed-design considerations and do not deliver the same active-active link aggregation behavior.

Two independent access ports are not an LACP bundle across two chassis. Making a separate VRF for each link only isolates routing state. VSX with a multi-chassis LAG supports forwarding on both uplinks while preserving peer independence. For acceptance, disconnect each upstream aggregation peer in turn and confirm the LACP bundle remains up on the other peer. An undersized VSX ISL or incorrectly routed keepalive can defeat the intended resilience.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Anomaly detection compares observed telemetry against baselines rather than relying exclusively on static thresholds. Recurrent association failures, unusual RF retries, interface errors and abnormal device restarts can then be surfaced before incident volume grows. AI Insights should be treated as a prioritized diagnostic hypothesis: verify affected sites and devices, inspect contributing evidence, and implement a controlled corrective change. Not every recommendation is executed automatically; change control and operational ownership remain with administrators.

B reduces the platform to ticket creation, ignoring telemetry correlation and recommendations. C incorrectly portrays hardware replacement as a standard autonomous step. Engineers still assess whether an insight points to RF conditions, authentication, software, or failing hardware.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Launch the Tests tab for the affected switch, select Cable Test and target the reported downlink interface. Interpret pair status and estimated distance in conjunction with switch port logs and NIC/transceiver behavior. A cable test is most useful for compatible copper media; optical links require optics diagnostics and error counters instead. Changing speed/duplex blindly can introduce mismatches, and administrative shutdown destroys evidence of intermittent negotiation problems. Schedule potentially disruptive cable diagnostics around user impact.

Changing port speed and duplex before testing can create a new negotiation mismatch. Disabling a port via remote console only proves it stops forwarding. The purpose of the cable test is to interrogate the suspect copper pair while preserving diagnostic evidence. Use the affected device’s Troubleshoot > Tests workflow and choose Cable Test where the port and platform support it.

Official HPE references | Troubleshooting Tools • Wired Interfaces Card for Switches | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

AI-derived RF recommendations should be assessed against channel quality, neighboring AP assignments, regulatory limits and the operational change window. AirMatch computes channel, bandwidth and power plans from aggregated AP telemetry, rather than assuming every AP requires a manual static channel. Confirm the recommendation fits the affected site's survey and any reserved channels before permitting changes. Disabling AirMatch eliminates the automation that normally manages RF resource reuse and is not a logical response to detected overlap.

Manually rebuilding every AP channel plan discards the fleet-wide context of AirMatch. Disabling AirMatch removes the optimization mechanism that can correct overlap. Check the recommendation’s assumptions and scope before applying it.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

If the WLAN uses EAP-TLS, validate certificate issuance, identity mapping, chain of trust, validity dates and the server certificate's extended key usage. Also verify that clients trust the RADIUS server and that the authentication backend permits the negotiated TLS version and cipher suites. WPA3-Enterprise does not inherently require EAP-TLS in every deployment; the first check depends on the actual EAP method selected. A personal-mode preshared key and captive portal are not substitutes for an enterprise 802.1X authentication exchange. A server presenting an expired leaf certificate or an intermediate CA missing from the client trust store can fail even when RADIUS reachability is healthy. Compare the EAP method negotiated by the supplicant with the authentication server policy.

A PSK is irrelevant to 802.1X enterprise key exchange. Captive portal is a web authorization stage, not an EAP-TLS handshake repair. Certificate checks are decisive only when this SSID actually uses EAP-TLS; with PEAP or another EAP method, inspect that method instead.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

A sourced ping confirms IP reachability between the selected AP and destination gateway interface if ICMP is permitted. Examine packet loss, round-trip time and response patterns while validating that the source VRF or interface is correct. A successful ICMP exchange establishes basic Layer 3 reachability but does not prove that user tunnels, RADIUS exchanges or application ports are functional. Where ping is filtered, traceroute or a protocol-specific test is more informative than treating silence as conclusive path failure.

A throughput or speed test addresses capacity, not necessarily basic L3 reachability. The Connectivity card is observational and may aggregate several paths. Source a ping from the AP to its gateway and inspect packet loss and response time.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

In the global or site context, Device Health counts APs, switches, gateways and bridges by health classification. Expand the card to compare the same metrics by site and select the affected location for a closer device list. Health aggregation helps prioritize teams and incidents by location but should not be interpreted as identifying the underlying fault. Inventory primarily lists assets and assignment, while AI Insights investigates patterns and anomalies; the health card is the direct summary requested.

Inventory can count devices but is not organized around their assessed health; AI Insights explains anomalies rather than serving as the core device-count summary. The Device Health card answers the operational question directly.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A static route is entered deliberately by an administrator. Its next hop and destination do not update through routing-protocol advertisements. If the interface disappears, the route may become inactive, but it has not learned an alternative path the way OSPF or BGP can. Static routes do not learn topology changes from protocol updates. Their administrative overhead is not universally greater than a dynamic protocol’s, and multicast capability is irrelevant. Static entries are intentionally configured and changed by administrators.

Official HPE references | Creating a VLAN Profile • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

NSLookup from the AP's troubleshooting context checks whether that network device can reach its configured resolver and translate the requested hostname. Use an internal and external test name to distinguish local-zone problems from general DNS reachability. Record the query result, resolver address, timeout behavior and source network. A successful AP DNS test does not guarantee client DNS works if clients use a different VLAN, resolver, ACL or captive-portal role; test the client path independently when symptoms remain.

Event logs might suggest a DNS timeout but do not execute an actual lookup, and firmware compliance is unrelated to resolver behavior. AP-based NSLookup tests the AP’s DNS context; client VLANs and resolvers still require their own verification.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A VLAN profile allows DHCP helper-address configuration to follow the VLAN's Layer 3 interface requirements rather than attaching IP relay settings to an unrelated physical access port. Ensure that an SVI exists and has Layer 3 reachability to the DHCP server; DHCP relay is meaningful on the routing device that receives the broadcast. Scope the VLAN profile to the intended site and device functions and check whether any switch needs a unique local SVI address. Validate that both request and reply traffic can traverse the VRF and ACL policies. The VLAN profile workflow starts at Configuration > VLANs & Networks > VLAN > Create Profile, with the desired scope and switch function selected.

A port profile describes physical or logical interface attributes, not VLAN-specific relay across all switches. A generic System profile does not replace the VLAN/SVI-facing helper relationship; tie the helper to the routed VLAN at the intended scope. Be precise about the Layer 3 termination: DHCP relay runs where the client VLAN broadcast reaches a routed VLAN interface. Defining a helper on a switch that only transports the VLAN at Layer 2 will not relay those broadcasts.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Central's Key Management Service distributes an authenticated station record to neighboring APs. For supported fast-roaming methods, this can include the Pairwise Master Key or derived 802.11r keys, alongside the client's VLAN, role and authentication state. AirMatch supplies RF-neighbor information used to target synchronization. The destination AP can therefore complete a shortened key exchange without repeating the entire initial 802.1X transaction. The mechanism depends on supported clients and configured roaming behavior; it does not mean that all station keys are indiscriminately replicated throughout the entire enterprise. The initial 802.1X authentication establishes a cached key context; KMS distributes PMK or 802.11r-derived material plus VLAN/role information to neighbors selected using AirMatch adjacency. Clients still perform a four-way exchange during the roam.

Forcing full 802.1X authentication on every roam increases latency, and keys stored only on the old AP provide no fast key material at the new radio. KMS shares cached keying and station context with neighbors, though clients still complete the applicable handshake. The WLAN Security settings control 802.11r and related fast-roaming features; KMS supplies the station record and key material to eligible neighboring APs.

Official HPE references | Roaming and the Key Management Service • AirMatch | Study-guide topic: Introduction to AOS-10

Technical explanation

For supported live upgrade, the gateways stage their software images and restart sequentially rather than taking every tunnel termination point offline together. Cluster-state synchronization and surviving forwarding capacity let clients continue through another member during each transition. Monitor tunnel health, role state and datapath recovery between restarts; a healthy cluster is a prerequisite for claiming minimal disruption. Buffering all client traffic on APs or pausing AAA for the entire maintenance interval is not an equivalent continuity strategy and may cause application-level failure. Stateful failover depends on supported cluster topology, synchronization health and firmware compatibility. It minimizes service interruption rather than guaranteeing that every individual packet survives a gateway reboot.

Simultaneous gateway reboot would break the cluster’s availability benefit. Authentication pauses and AP traffic buffering are not a substitute for an active peer holding client sessions. The peer state must be synchronized before taking each gateway offline.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

Troubleshooting History preserves the session identifier, device context, executed test and results so a diagnostic run can be compared with earlier observations. Operators can export relevant records for incident notes or maintenance evidence. Historical tests reveal changes in latency, reachability or cable status, whereas an audit trail primarily records who performed an action and when. Retention is version-dependent, so export sessions that must survive the platform's history window and record the requested time range in the incident ticket. From a site, open Network, select the device, launch Troubleshoot, then choose History to reopen earlier sessions.

Audit Trail answers who changed configuration; it is not the archive of test output. A Network overview Events card records network events, not earlier diagnostic command results. History in Troubleshoot is where a second engineer retrieves a prior session.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The licensing distinction must be read against the actual entitlement matrix, not assumed from feature names. HPE lists base AI Insights under Foundation, while its official Classic Central AP license table lists Unified Communications and Collaboration (UCC) and Live Upgrades under Advanced. UCC visibility concerns voice/video collaboration experience; Live Upgrade is a firmware-maintenance orchestration capability. The test’s answer key singles out UCC, but the wording admits another Advanced-only selection in that documented matrix.

The Foundation license includes AI Insights, making C ineligible as an Advanced-only distinction. However, HPE’s official Classic Central license table places both UCC and Live Upgrades in the Advanced column. Accordingly, A is the supplied key but B also satisfies the literal wording; the question is not unambiguous as a single-choice item.

Source-specific qualification: HPE’s AP Foundation and Advanced License table places both UCC and Live Upgrades under Advanced. A single-answer interpretation of this question therefore requires the intended curriculum/release context.

Official HPE references | AP Foundation and Advanced License – HPE Aruba Networking Central • Dynamic Application Prioritization Profile | Study-guide topic: Introduction to AOS-10

Technical explanation

Open the affected client context and use its event history to align 802.11 association, EAP exchange, RADIUS responses, role assignment and disconnect causes. Distinguish an authentication reject from a timeout or radio-layer disassociation: each leads to a different diagnostic path. Confirm client MAC, username, SSID, AP and timestamps because roaming can transfer the same session across radios. AP-load insights help diagnose capacity, whereas a topology drawing does not capture the per-attempt authentication failure sequence.

An overloaded AP can certainly degrade experience, but AP-load analytics do not supply EAP rejects or server-response timings. Topology traces device relationships rather than the client’s authentication exchange. The event record is the evidence to start with.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Strong RSSI only describes received power, not usable airtime or signal quality. A busy 5 GHz channel can produce high frame retries and low throughput even with a strong signal. Compare SNR, channel occupancy, neighboring BSSs, airtime consumption, client transmit rates and upstream interface errors. Increasing every AP's EIRP creates additional co-channel overlap and can produce asymmetric uplink performance because client radios transmit at lower power. Lowering minimum data rates is likewise a design intervention, not an evidence-based first diagnostic action.

Reducing the minimum data rate can increase the airtime consumed by slower frames. Blanket power increases expand contention cells and may worsen interference. Strong RSSI paired with poor throughput is a reason to inspect airtime, retries, and neighboring radios first.

Official HPE references | AirMatch • Planets in Global Monitoring Page | Study-guide topic: Introduction to AOS-10

Technical explanation

Loop protection can emit and detect dedicated loop-detection frames on ports where spanning-tree participation is unavailable or inappropriate. When the device sees its loop-detection traffic return, it can disable or otherwise isolate the problem interface according to configured action and recovery behavior. BPDU Guard requires reception of spanning-tree BPDUs; a loop formed between two ordinary edge ports or through a device that does not emit BPDUs can evade that trigger. Define recovery policy to avoid repeated flapping into an unresolved loop.

LACP bundles links but is not a general defense against accidental edge patch loops. BPDU Guard reacts to received BPDUs; a silent loop can bypass it. Loop protection tests for loopback behavior itself.

Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The switch faceplate condenses a large port table into physical positions that resemble the chassis. Link coloring distinguishes connected, down, and disabled interfaces; selecting a port exposes negotiated speed/duplex, neighboring devices and other relevant interface diagnostics. If a port unexpectedly negotiates at a lower speed, check transceiver type, auto-negotiation, cabling and peer settings. Hardware health reports CPU, fans, temperature and power supplies, which are important but do not substitute for per-interface link visibility.

The Hardware card addresses chassis components, and Device Health summarizes operational condition. Neither presents the port-by-port speed/status layout needed by operations. On AOS-CX the card also separates RJ45 and QSFP port groups. In Central, open the managed switch’s Network dashboard and expand Wired Interfaces; the faceplate hover fields include speed/duplex and PoE status.

Official HPE references | Wired Interfaces Card for Switches • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central