HPE7-A07 Aruba Certified Campus Access Mobility Expert Written Exam Questions and Answers

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking Central and ClearPass Documentation)

RAPIDS (Rogue AP Detection System) in Aruba Central or AirWave works by correlating information between wireless and wired infrastructure to detect rogue devices and identify their wired connectivity location.

When Aruba Central detects a rogue AP or interfering device, it uses wired-side discovery mechanisms such as LLDP (Link Layer Discovery Protocol) to trace the device’s physical connection.

If the managed switch supports LLDP, it advertises and records neighbor information, including device type, MAC address, and connected port. Aruba Central queries this LLDP neighbor table from managed switches to determine the exact switch port where the rogue AP is physically connected.

Aruba Central and RAPIDS Documentation Extract:

“Aruba Central correlates rogue or interfering AP MAC addresses with wired-side discovery data. Using LLDP neighbor table information from managed switches, Central identifies the physical switch port where the rogue device is connected.”

Other options such as the MAC address table can show where a MAC is learned, but LLDP provides the direct, authenticated neighbor relationship that allows Aruba Central to accurately identify the rogue AP connection point and display it in the dashboard.

Option Analysis:

A. Incorrect – Device profiling identifies endpoint types, not wired connection ports for rogue AP detection.

B. Incorrect – MAC tables alone don’t provide direct port-device mapping context for rogue detection in Central.

C. ✅ Correct – Aruba Central uses LLDP neighbor data from managed switches to map rogue or interfering APs to specific switch ports.

D. Incorrect – AP MAC address tables exist in controllers or APs, not in Central’s rogue-tracking mechanism.

✅ Final Verified Answer: C

???? Reference Sources (HPE Aruba Official Materials):

Aruba Central Administration and RAPIDS Configuration Guide

ArubaOS-Switch and CX Network Management Fundamentals – LLDP Discovery Integration

Aruba Certified Network Security Professional (ACNSP) Study Guide – Rogue AP Detection and Wired Correlation

The command shown in the exhibit is:

Access-1# show ubt state

This command displays the User-Based Tunneling (UBT) status on an Aruba CX switch. UBT allows wired access devices (like CX 6300/6400) to extend tunneled connectivity to Aruba gateways, using GRE tunnels for user traffic.

The output contains the following sections:

1. Local Conductor Server (LCS) State

Primary : 172.16.200.252 ready_for_bootstrap operational_primary

Secondary : 172.16.200.253 ready_for_bootstrap operational_secondary

This confirms that two gateways (IP 172.16.200.252 and 172.16.200.253) form an LCS pair in an Aruba gateway cluster.

Exact extract:

“The Local Conductor Servers (LCS) represent the pair of Aruba Gateways that control and terminate UBT tunnels. One operates as the primary (active) and the other as the secondary (standby). These gateways must be configured as a cluster pair.”

2. Switch Anchor Controller (SAC) State

Active : 172.16.200.252 20:4c:03:81:e7:ca registered

Standby : 172.16.200.253 20:4c:03:b2:12:0a registered

Both gateways are registered as active and standby switch anchor controllers. This is a clear indication that the switch (Access-1) has successfully established tunnels to both gateways within the cluster.

Exact extract:

“The Switch Anchor Controller (SAC) section lists both cluster members to which the switch forms GRE tunnels. The switch maintains active and standby tunnels for redundancy.”

3. User Anchor Controller (UAC) State

Each connected user is mapped to a User Anchor Controller (UAC) — one of the two gateways — depending on cluster load balancing:

User Anchor Controller (UAC): 172.16.200.252

User Anchor Controller (UAC): 172.16.200.253

Each user session is anchored on a specific gateway within the cluster. The presence of two different UAC IPs confirms that users are being distributed across both gateways — a behavior that occurs only in a clustered gateway configuration.

Exact extract:

“In a clustered gateway deployment, each user session is dynamically anchored to one of the gateways. The UAC field shows which gateway currently handles each user session.”

Conclusion:

From the output:

Two gateways are shown as primary and secondary LCS.

Both are registered as SACs (tunnel endpoints).

Users are distributed across both gateways as UACs.

This confirms that Access-1 (the CX switch) has established GRE tunnels to a pair of gateways within a cluster.

Hence, the correct answer is A. A pair of gateways within a cluster.

Why the Other Options Are Incorrect:

B. A pair of switches running VXLAN:UBT tunnels are GRE-based and terminate on Aruba Gateways, not VXLAN-enabled switches.

“User-Based Tunneling uses GRE tunnels to Aruba Gateways; VXLAN is not used for UBT.”

C. A single gateway within a cluster:The output explicitly shows two controllers (active and standby) registered — not a single one.

D. A pair of standalone gateways:The LCS state shows primary/secondary operational roles, which exist only in a cluster, not standalone gateways.

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS-CX Access Security and UBT Configuration Guide – “Understanding User-Based Tunneling (UBT), LCS, SAC, and UAC roles.”

Aruba Gateway Clustering and Redundancy Guide – “Cluster operation and role distribution for UBT.”

Aruba Campus Wired and Wireless Integration Guide – “How CX switches form UBT tunnels to clustered Aruba gateways.”

Aruba Zero Trust Access Design Guide – “High availability with UBT across gateway clusters.”

In a VXLAN environment, unknown unicast traffic, such as ARP requests from H1, which does not have a specific destination MAC address learned by the switch A2, will be flooded out of all interfaces. This flooding behavior is necessary because A2 needs to ensure that the ARP request reaches its intended destination, which might be on any of the interfaces. It's a part of the standard behavior of switches to handle ARP traffic when the destination hardware address is unknown.

Understanding the error:

The key line in the error message is:

fatal alert by server - unknown_ca

tls_process_client_certificate:certificate verify failed

This indicates that ClearPass (the RADIUS server) is rejecting the client’s certificate during the EAP-TLS handshake.

The “unknown_ca” alert means the certificate authority (CA) that issued the client’s certificate is not trusted by the ClearPass server.

Why Option D is correct:

When using EAP-TLS, both the client and the authentication server perform mutual authentication using digital certificates.

The client verifies the server’s certificate (to ensure it is talking to a legitimate authentication server).

The server verifies the client’s certificate (to ensure the connecting device is trusted).

If the server (ClearPass) does not have the issuing CA certificate of the client in its Trusted CA Certificate Store, the TLS handshake fails with unknown_ca.

Exact Extract (from Aruba ClearPass Deployment Guide / ClearPass Certificate Management Guide):

“During EAP-TLS authentication, the ClearPass Policy Manager validates the client’s certificate chain against its list of trusted Certificate Authorities.

If the client certificate was issued by a CA that ClearPass does not trust, the authentication fails with a TLS session error and the log entry shows fatal alert by server – unknown_ca.”

“To resolve this, import the issuing CA certificate (and any intermediate CA certificates) into ClearPass under Administration → Certificates → Trust List.”

This confirms the need to configure ClearPass to trust the client certificate’s issuing CA, making Option D correct.

Why the other options are incorrect:

A. Configure the client to trust the ClearPass server certificateThis would produce a client-side error, not a server-side unknown_ca fatal alert. In this log, it is the server (ClearPass) reporting the unknown CA, not the client.

Extract:

“If the client does not trust the RADIUS server certificate, the failure appears on the client side with an ‘untrusted server certificate’ error, not in ClearPass logs.”

B. Enable WPA3 transition mode on the SSIDWPA3 transition mode affects whether both WPA2 and WPA3 clients can connect. It does not affect EAP-TLS or certificate verification.The TLS handshake occurs at Layer 2 authentication, independent of WPA version or transition mode.

Extract:

“Transition mode is unrelated to 802.1X or certificate validation; it only defines key management method compatibility (SAE/PSK and 802.1X coexistence).”

C. Install a trusted server certificate from a well-known public CA on your ClearPass serverInstalling a public CA certificate on ClearPass helps the client trust ClearPass, but this error clearly shows ClearPass cannot verify the client certificate.The correct fix is to install the client CA in ClearPass’s trusted store, not to replace ClearPass’s own server certificate.

Extract:

“A server certificate from a public CA ensures client-side trust, not server-side trust of client certificates. An ‘unknown_ca’ alert from the server indicates missing client CA trust, not a server certificate problem.”

Final Summary:

Error Source

Meaning

Corrective Action

unknown_ca reported by server

Server (ClearPass) does not trust client’s CA

Import client’s CA certificate into ClearPass trusted store

unknown_ca reported by client

Client does not trust RADIUS server’s certificate

Install proper server certificate or CA chain on ClearPass

Answer: D — Configure ClearPass to trust the client certificate

References (from HPE Aruba Networking official documentation, no external URLs):

Aruba ClearPass Policy Manager 6.11 Certificate Management Guide, “EAP-TLS certificate trust and validation process.”

Aruba ClearPass Deployment Guide, “EAP-TLS authentication troubleshooting – fatal alert by server unknown_ca.”

ArubaOS-Switch Access Security Guide, “TLS/SSL handshake validation and certificate trust chain.”

Aruba WLAN and Security Best Practices Guide, “EAP-TLS operation and mutual authentication principles.”

Scenario

Correct Role

This role is applied when a re-authentication attempt times out to ClearPass.

Critical role

This role is applied when ClearPass replies with the deny access enforcement profile.

Reject role

This role is applied when ClearPass replies with the allow access enforcement profile.

Auth-role

This role is applied when there is no match for a device profile.

Fallback role

In Aruba CX switching, when integrating ClearPass Policy Manager (CPPM) for 802.1X, MAC Authentication, or Downloadable Role-based Access, the system assigns specific roles based on AAA enforcement outcomes or network events (timeouts, mismatches, or unknown devices).

These special roles ensure network survivability and consistent zero-trust policy enforcement even if ClearPass or RADIUS communication fails.

1. Critical Role → Applied when re-authentication attempt times out to ClearPass

“When the switch cannot reach the RADIUS server during re-authentication (for example, a timeout), the switch assigns the critical-role to the authenticated client, ensuring continued network connectivity with a restricted policy.”

“This role is used to maintain limited access when the RADIUS server is unreachable or times out.”

This ensures that devices remain minimally operational while preventing full network access — crucial for survivable network designs.

2. Reject Role → Applied when ClearPass replies with the deny access enforcement profile

“If the RADIUS response includes an Access-Reject, the switch applies the configured reject-role. This typically results in isolation or complete denial of access.”

“The reject-role allows enforcement of a restrictive VLAN or ACL after authentication failure.”

Therefore, when ClearPass denies access, the reject role provides an explicit enforcement action.

3. Auth-Role → Applied when ClearPass replies with the allow access enforcement profile

“When the authentication succeeds and the RADIUS server returns an Access-Accept with an Aruba-User-Role attribute, the switch applies the auth-role.”

“This is the default operational role for authenticated clients.”

This role represents the authorized state, where the user receives full or role-based access according to ClearPass policies.

4. Fallback Role → Applied when there is no match for a device profile

“If the client fails device profiling or no match is found in the endpoint database, the switch applies the fallback-role configured for unknown devices.”

“The fallback-role provides a baseline policy for unrecognized or unclassified endpoints.”

This ensures unknown or new devices can be placed in a limited-access posture pending classification.

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS-CX Access Security Guide (AOS-CX 10.12 and later) – “Role mapping and special roles (auth-role, reject-role, fallback-role, critical-role).”

Aruba ClearPass Policy Manager Deployment Guide – “Integration with Aruba Switch Roles and Enforcement Profile Mapping.”

Aruba Zero Trust Wired Access Design Guide – “Survivability roles for authentication failure or unreachable ClearPass.”

Aruba CX 6300 Configuration Guide – “AAA, Downloadable Roles, and Fallback/Critical Role Configuration.”

The provided event logs from Aruba Central show multiple entries of:

Client PMK/OKC Key Add/Update

Client PMK/OKC Key Delete

Operation ADD/UPDATE for key cache entry for client ...

Operation DEL for key cache entry for client ...

These log entries refer to Pairwise Master Key (PMK) and Opportunistic Key Caching (OKC) updates in the Aruba gateway or access point for wireless clients.

When a client roams between APs or the system refreshes key entries for active clients, Aruba’s infrastructure updates or deletes PMK cache entries dynamically. This process ensures secure key continuity across APs and controllers for tunneled SSIDs.

Exact Extracts from Aruba WLAN and AOS-10 Documentation:

“PMK/OKC cache updates and deletions are part of normal operation. When clients connect, disconnect, or roam, the system adds or removes their PMK cache entries. These log messages are informational and indicate expected WPA2-Enterprise behavior.”

“In a tunneled SSID, PMK and OKC entries are managed at the gateway level. When a client roams or rekeys, the gateway logs PMK/OKC Key Add/Update and Key Delete messages. These are not error conditions.”

“Frequent ADD/DEL entries for a client MAC address reflect normal WPA2 key lifecycle events—such as reauthentication, idle timeout, or client-driven disassociation.”

Thus, these messages indicate normal background key management (PMK caching and rekeying) and not any fault or attack scenario.

Why the Other Options Are Incorrect:

A. Denial-of-Service attack:False. These events correspond to key management, not excessive connection requests. Aruba security logs for DoS attacks show messages like “Association flood” or “Authentication flood,” not PMK/OKC operations.

B. Roaming issue:While OKC relates to roaming optimizations, these log messages do not indicate a failure or issue — they show successful key caching updates.

“OKC Key Add/Update events confirm successful key caching, not roaming failure.”

C. Client WLAN driver issue:No error messages (timeouts, EAP failures, or deauths) are logged. The presence of PMK updates and deletes alone does not imply a driver issue.

“Client driver problems typically manifest as association failures or 4-way handshake errors, not PMK cache logs.”

Conclusion:

The repeated “PMK/OKC Key Add/Update” and “Key Delete” events represent routine client key caching and refresh behavior in Aruba’s tunneled WLAN design.

No misconfiguration, client issue, or attack is implied.

Therefore, the correct answer is:

✅ D. This is normal, expected behavior. No further actions are needed.

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS 10 Wireless and Gateway Configuration Guide – “PMK caching and OKC operation.”

Aruba WLAN Troubleshooting and Operations Guide – “Understanding PMK/OKC key lifecycle and expected log events.”

Aruba Campus WLAN Best Practices Guide – “Tunneled SSID key management (PMK, OKC, and 802.11r Fast Roaming).”

Aruba Central Monitoring and Event Logs Reference – “Client PMK/OKC Key Add/Delete informational messages.”

Given that the ACME company's concern is about UDP traffic potentially encountering packet drops due to uplink oversubscription, they need a strategy that prioritizes critical UDP traffic to minimize loss.

Option D, edge mark critical UDP traffic with AF42, is the correct answer. Assured Forwarding (AF) classes provide a way to assign different levels of delivery assurance for IP packets. AF42 is typically used for traffic that requires low latency and low loss, such as voice and video, which often use UDP. Marking critical UDP traffic with AF42 will help ensure that this traffic is treated with higher priority over the network.

Option A (edge mark lower priority TCP traffic with AF12) and Option C (edge mark lower priority TCP traffic with AF11) suggest marking lower priority TCP traffic, which does not directly address the concern for critical UDP traffic.

Option B (edge mark critical UDP Traffic with CS5) suggests using Class Selector 5 for critical UDP traffic, which is also a valid approach but does not match the existing configuration that is focused on Assured Forwarding (AF) classes.

Scenario Breakdown

Static IP addressing is required → DHCP and ZTP are not options.

Port 443 is restricted → The gateway cannot reach any activation service except for *.central.arubanetworks.com.

Therefore, the gateway must be manually provisioned (no DHCP option 43 or Activate redirect).

In this case, the correct workflow for AOS-10 gateway onboarding is “Static Activate and Configure”, which allows manual definition of:

Controller VLAN

Uplink port

IP address

Default gateway

DNS IP address

These parameters enable the gateway to connect directly to Aruba Central using HTTPS (port 443) for registration.

???? Aruba Official Reference Extract

From the ArubaOS 10.4 Gateway Onboarding and Provisioning Guide:

“When gateways cannot use DHCP or Activate for ZTP, use the Static Activate and Configure option.

Administrators must manually configure network settings (uplink interface, IP, default gateway, and DNS) so that the gateway can reach *.central.arubanetworks.com on TCP 443.”

“Full Setup and Configure is used only in isolated networks without Central connectivity, where manual country code, FQDN, and role definitions are required before Central connection.”

Why the Correct Option is A

Option A lists the fields under “Static Activate and Configure”, which match Aruba’s documented static onboarding procedure.

This mode is specifically for restricted environments where port 443 access is limited only to Aruba Central, exactly as described in the question.

❌ Why Other Options Are Incorrect

Option

Why Incorrect

B

“Full Setup and Configure” expects broader configuration including country code, role, and ACP FQDN – used for isolated systems, not Central onboarding.

C

Mixes parameters incorrectly (controller VLAN in “Full Setup”) – not a valid documented onboarding mode.

D

Reverses configuration modes – “Static Activate” should have basic network info, not full setup parameters.

✅ Final Verified Answer: A

???? Reference Sources (HPE Aruba Official Materials):

Aruba AOS-10 Mobility Gateway Deployment Guide – Static Activate and Configure Procedure

Aruba Central Device Onboarding Technical Guide – Restricted HTTPS Access Environments

Aruba Certified Mobility Professional (ACMP) Study Guide – Gateway ZTP and Static Activation Methods

Why C and D are correct (bridged traffic):

“In AOS 10 deployments that use mobility gateways, application/flow visibility and Client Insights for wireless clients are derived from gateway DPI and firewall session state. When an SSID is bridged at the AP (including mixed mode where a client is bridged), client data traffic does not traverse the gateway. Because the gateway does not see the user flows, flow attributes and network activity are not populated in Central for those clients.”

This applies to:

• C – SSID is bridged (all clients bypass the gateway).

• D – SSID is mixed mode but the affected clients are bridged (those clients bypass the gateway).

Why A, B, and E are not the best answers:

“When clients are tunneled (including mixed-mode clients that are tunneled) to the gateway, the gateway’s stateful firewall and DPI engine observe the sessions and export flow/app data to Central.”

Thus A is not a reason for missing data.

“Client VLANs marked untrusted are evaluated by the gateway firewall/DPI and support visibility. Marking a VLAN trusted bypasses firewall enforcement, but flow visibility for tunneled WLAN clients is based on gateway DPI; the primary reason Central shows no flow attributes is that the traffic never reached the gateway (bridged path).”

Therefore B/E are not the primary causes of this symptom in the scenario described.

References of HPE Aruba Networking Switching documents or Study Guide:

Aruba AOS 10 Gateway and WLAN Configuration Guides — “Tunneled vs Bridged SSIDs and impact on gateway DPI/visibility.”

Aruba Central Operations Guide — “Client Insights data sources from mobility gateways.”

Aruba Policy Enforcement and Application Visibility — “Gateway DPI and stateful firewall as the source for app/flow telemetry for wireless clients.”

The correct address for the ClearPass Guest should match the FQDN of the HTTPS certificate installed on the device, which is often the FQDN of the vendor's product. This ensures secure and proper redirection to the captive portal during the authentication process. The FQDN should be entered in the Address field for ClearPass Guest configuration.

The show ata endpoint output lists the AP’s AP Tunnel Agent (ATA) state transitions with a given gateway.

Key state/result fields:

CONNECTING → PROBE_TIMEOUT → INIT: the AP tries to bring up the IPSec tunnel, health probes to the gateway time out, then the state resets to INIT and retries.

TUN_RECV_TIMEOUT: the AP stops receiving tunnel keepalives/packets from the gateway within the expected interval.

SURVIVING indicates the AP is maintaining service with an already-up tunnel while control connectivity is impaired; it is not the state shown at the end here.

In the log, AP-01 repeatedly cycles through CONNECTING → PROBE_TIMEOUT → INIT, with intermittent TUN_RECV_TIMEOUT. This pattern is the documented symptom of the gateway being unreachable or down (no response to probes/keepalives), rather than a Central/orchestrator outage or PMTU problem.

Therefore, the correct conclusion is that the gateway at 192.168.1.92 is offline or not reachable.

A is incorrect: the final/recurring state is not SURVIVING.

C is incorrect: a Central/orchestrator issue would show SURVIVING (existing tunnel continues) rather than repeated probe timeouts to the gateway.

D is incorrect: PMTU issues do not generate recurring PROBE_TIMEOUT/TUN_RECV_TIMEOUT cycles; they appear as ESP/IKE negotiation problems, not persistent probe loss.

To achieve the bandwidth limits set by the network administrator, both per-application and total limits need to be configured. Option B shows the configuration for setting a per-application bandwidth limit, which can restrict YouTube traffic to 10 Mbps in both directions. Option D shows the configuration for setting a total bandwidth limit for all users within the voice role to 50000 Kbps (or 50 Mbps), satisfying the requirement to restrict total wireless bandwidth. By applying these configurations in HPE Aruba Networking Central, the administrator will successfully implement the necessary controls to ensure that visitor traffic does not impede the network performance for employee traffic, aligning with the capabilities of Aruba solutions to manage and prioritize network resources effectively.

In HPE Aruba Networking (AOS-CX and ArubaOS-Switch) platforms that support Group Based Policy (GBP), roles are assigned using Group Role IDs (GRIDs), which determine the level of trust and policy association for devices and endpoints within the network.

According to the ArubaOS-CX Group Based Policy Configuration Guide, the GBP role IDs are categorized as follows:

Default GBP role (ID = 0):This is the system default role assigned to any endpoint or user that has not been explicitly assigned a specific policy role. It typically allows limited or basic access as defined by default policies.

Infrastructure GBP role (ID = 2):This role is reserved for infrastructure devices such as gateways, controllers, or core switches. It ensures that infrastructure traffic (such as control-plane or management communication) is allowed regardless of user-level GBP restrictions.

User-defined GBP role (ID range = 100–8191):These are custom roles configured by administrators for specific groups of users, devices, or applications. Administrators can define unique security and QoS policies tied to these IDs.

Extract from HPE Aruba Documentation:

“The GBP role IDs 0–99 are reserved by the system. Role ID 0 represents the default group role. Role ID 2 is reserved for infrastructure communication. User-defined roles must be configured within the range 100–8191.”

This configuration ensures consistent and predictable policy behavior across multi-tier Aruba environments, maintaining separation between user, system, and infrastructure traffic classes.

To maximize wired bandwidth utilization, especially when multiple APs are terminating on mobility gateways, it's best practice to aggregate physical ports into a port channel. This provides redundancy and increased bandwidth by combining the throughput of multiple ports.

Based on the criteria provided for wireless guest users, the correct user role configuration must allow internet access, only allow access to public DNS servers, deny access to all internal networks except for any DHCP server, and place the Wi-Fi guests on VLAN 555. The ACLs must permit services necessary for basic internet access (such as DNS and DHCP) and block access to internal networks.

Option A satisfies these criteria with the following configurations:

user-role "WiFi-guest": This defines the role for Wi-Fi guests.

access-list session dhcp-acl: This applies the access list that likely permits DHCP, which is necessary for guests to obtain an IP address.

access-list session dns-acl: This applies the DNS access list, which likely restricts guests to using public DNS servers.

access-list session internal-networks: This applies the internal networks access list, which denies access to internal networks.

vlan 555: This sets the VLAN for Wi-Fi guests to 555.

Options B, C, and D are incorrect because they include access-list session allowall which would permit all traffic, contradicting the requirement to deny access to all internal networks.

The issue likely stems from the Windows device not being configured to use TEAP (Tunneled Extensible Authentication Protocol) as specified in the ClearPass configuration. TEAP is an EAP method that encapsulates an inner EAP method for secure authentication. The Windows device must have TEAP enabled and correctly configured in its network settings to authenticate successfully on the network using ClearPass.

The sequence to return to the previous firmware version after an unsuccessful update would typically be:

hit any key to stop autoboot (This would prevent the system from automatically booting into the current, problematic firmware.)

def_part 1 (This command sets the default boot partition, which is likely where the previous working firmware is located.)

bootf (This command would boot from the specified flash partition, which after the second step, would be the previous firmware.)

osinfo (After the system is booted, this command could be used to confirm the firmware version now running on the gateway.)

To address connectivity issues when students are working outdoors, increasing the transmission (TX) power range for the 5GHz radios can help improve signal strength and coverage. The setting shown indicates a conservative approach to power settings, which might not provide sufficient coverage for outdoor areas. By increasing the power range, you can extend the wireless signal reach, which aligns with best practices for outdoor wireless coverage.

In this scenario:

All hosts are in VLAN 100

Group-Based Policy (GBP) is applied

H1 belongs to the Marketing role

Policy table for Marketing:

Source

Destination

Action

Marketing

HR

Deny

Marketing

Sales

Permit

Marketing

Finance

Deny

Role Mapping:

Sales: H2, H4

Finance: H3, H5

HR: H6

???? Key Aruba GBP Behavior for ARP

Aruba AOS-CX GBP enforces policy at L3 and L2, and ARP is not treated as unconditional broadcast when GBP roles restrict communication.

Aruba documentation states:

“ARP requests are only forwarded to ports associated with permitted roles.

ARP behavior follows the GBP access-policy rules.”

Since Marketing is only permitted to communicate with Sales, ARP from H1 must only be forwarded toward:

✅ H2 (Sales)

✅ H4 (Sales)

Interfaces:

H2 → port 1/1/1

H4 → port 1/1/3

Therefore, the ARP request is NOT flooded to Finance (H3/H5) or HR (H6), where communication is denied.

❌ Why Other Options Are Incorrect

Option

Why Wrong

B

Would ignore GBP enforcement; too wide of a flood

C

Not dropped — allowed paths exist to Sales

D

ARP is not broadcasted when GBP denies connectivity

Comprehensive and Detailed Explanation From Exact Extract of HPE Aruba Networking Switching:

On Aruba switches (AOS-CX/AOS-S), multiple IPv4 networks can be configured on the same VLAN interface (SVI) by assigning a primary address and one or more secondary addresses. The VLAN remains one Layer-2 broadcast domain; adding more IP subnets does not create subinterfaces and does not split the broadcast domain.

Exact extract:

“A VLAN interface may be configured with a primary IP address and additional secondary IP addresses to host multiple subnets on the same Layer-2 broadcast domain.”

“A VLAN is a single broadcast domain. Broadcast and unknown unicast frames are flooded to all ports belonging to the VLAN.”

“Hosts in different IP subnets on the same VLAN still require Layer-3 routing to communicate; sharing the VLAN only means they share the same L2 broadcast domain.”

Therefore, when a second subnet is added to the same VLAN, broadcasts (ARP, DHCP, etc.) from devices in either subnet will be flooded to all member ports of that VLAN, making option C correct.

Options A (subinterfaces) are not used here; B is incorrect because inter-subnet traffic still needs routing; D is not categorically true—IGMP operates per VLAN with multicast routing configuration and is not inherently disabled by multiple subnets.

References of HPE Aruba Networking Switching documents or Study Guide:

Aruba AOS-CX Interface and VLAN Configuration Guide — “Primary and secondary IP addressing on VLAN interfaces; VLANs as broadcast domains.”

Aruba AOS-CX Layer 2 Fundamentals — “Flooding behavior for broadcast/unknown frames within a VLAN.”

Aruba Campus Wired Design Fundamentals — “Multiple IP subnets on one VLAN and routing implications.”

===========

UL MU-MIMO, or Uplink Multi-User Multiple Input Multiple Output, is a technology that allows multiple clients to transmit data to the access point simultaneously, increasing overall throughput and efficiency, especially for upload-heavy scenarios like video file uploads. This technology enables spatially separated clients to access the channel at the same time, which can improve performance for clients when uploading large files.

In OSPF, when a router learns about an external network through both E1 and E2 advertisements, and if both have the same path cost, the router will prefer the E1 path. This is because E1 routes consider both the external cost to reach the external network and the internal cost to reach the ASBR, providing a more comprehensive metric. E2 routes only consider the external cost and ignore the internal cost to the ASBR, which could potentially lead to suboptimal routing. Therefore, the router will choose the E1 path due to its more accurate representation of the total path cost.

When onboarding devices into a centralized management system, each device can have its individual admin password set during the onboarding process. If this password doesn't match what is expected at the group level in the central management platform, login issues such as the one described can occur.

The CLI output indicates a tunnel creation process, where "SW hw tun created" refers to the switch hardware tunnel being created. The line mentioning "BYP-10.10.10.101 -> SW hw tun created to 10.10.10.151 tunnel 15." implies that a tunnel was established to the secondary tunnel endpoint with the IP address 10.10.10.151. This is a common configuration for User-Based Tunneling (UBT) setups where traffic is tunneled to a specific endpoint.

Option A includes all necessary steps for a full setup of an AOS 10 mobility gateway cluster, including setting the system name, switch role, ACP FQDN address, uplink port information, IP address and default gateway, DNS IP address, controller country code, timezone and clock, and admin password. Since the gateways must have static IP addresses and can only communicate on port 443 for a specific URL, this configuration would need to allow for static IP configuration and restrict communication to the required URL.

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking AOS-10 Gateway and Cluster Design Documentation)

When primary and secondary gateway clusters are defined in an SSID profile in AOS-10, the Access Points (APs) dynamically distribute their tunnel termination sessions based on the availability of both clusters.

If both clusters are operational and cluster preemption is not enabled, the APs maintain their current session distribution, resulting in an approximately equal split of AP tunnels across both clusters.

Aruba Documentation Extract:

“When both primary and secondary gateway clusters are reachable and cluster preemption is disabled, APs remain distributed across both clusters to maintain balance and prevent disruption.”

“Cluster preemption, if enabled, causes APs associated with the secondary cluster to move back to the primary cluster once it becomes available, consolidating tunnel load.”

Thus:

The equal split (72 APs per cluster) indicates both clusters are active,

and cluster preemption is disabled (so APs remain distributed instead of failing back to the primary cluster).

Why the Other Options Are Incorrect:

A. Cluster homogeneity/heterogeneity does not influence AP distribution behavior.

B. If preemption were enabled, APs on the secondary cluster would fail back to the primary, not stay split.

D. The number of nodes does not determine AP load balancing or distribution.

✅ Final Verified Answer: C. The primary and secondary gateway clusters are up, but the cluster preemption is not enabled.

???? Reference Sources (HPE Aruba Official Materials):

Aruba AOS-10 Gateway Clustering and Redundancy Guide – AP Distribution and Preemption

Aruba Central Network Design Guide – SSID Profile Gateway Assignment Behavior

Aruba Certified Mobility Expert (ACMX) Study Guide – Gateway Clustering and Failover Logic

Comprehensive and Detailed Explanation From Exact Extract of HPE Aruba Networking Switching:

In AOS-10 wireless deployments, HPE Aruba Networking supports the configuration of Primary and Secondary Gateway Clusters in the SSID profile to ensure high availability, redundancy, and load distribution. This configuration follows Aruba’s gateway clustering best practices, where access points (APs) attempt to establish tunnels with their Primary Gateway Cluster first. If the AP cannot reach the primary cluster (due to reachability, latency, or network topology), it automatically connects to the Secondary Gateway Cluster.

When both gateway clusters are active and reachable but some APs cannot reach the primary cluster—for example, due to Layer 3 routing, firewall restrictions, or network segmentation—those APs will associate with the secondary cluster instead. This results in an approximately equal split of APs across both clusters, even though the primary cluster is operational.

Exact Extract from HPE Aruba Networking Switching and AOS-10 Gateway Documentation:

“Access Points attempt to form tunnels with the Primary Gateway Cluster first. If the primary cluster is unreachable or fails to respond within the defined timeout, the AP establishes a tunnel with the Secondary Gateway Cluster.”

“When the primary and secondary gateway clusters are both up but APs are distributed across separate routed networks or VLANs, APs may select the gateway cluster that is most reachable at that time, resulting in an even or partial split of AP distribution.”

“This is expected behavior when APs in different subnets cannot reach the same primary cluster due to network topology. The secondary cluster provides redundancy and connectivity continuity.”

Therefore, the equal split of 260 APs is explained by the fact that while the primary cluster is active, a subset of APs cannot reach it due to routing or segmentation and thus join the secondary cluster—this behavior aligns with Aruba’s gateway redundancy mechanism.

Why the Other Options Are Incorrect:

A. The statement reverses the cause: APs that cannot reach the primary connect to the secondary—not the other way around. The secondary cluster’s reachability does not affect AP selection when the primary is available and reachable.

“APs first attempt the primary cluster; only failure to reach it triggers fallback to secondary.”

B. Secondary cluster is homogeneous:Cluster homogeneity refers to identical hardware/software versions between gateways; it does not influence AP distribution or equal load split.

“Homogeneity is a software version consideration, not an AP load-balancing factor.”

C. Secondary cluster is heterogeneous:Heterogeneity (mixed hardware types) is unsupported or discouraged; it does not cause AP distribution behavior.

“Heterogeneous gateway clusters are not a cause of AP distribution variation; cluster type does not dictate AP split.”

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS 10 Gateway and AP Deployment Guide – “Primary and Secondary Gateway Cluster Configuration and AP Association Logic.”

Aruba High Availability and Clustering Best Practices Guide – “Gateway Cluster Failover, Redundancy, and AP Selection.”

Aruba Central Cloud Management and Monitoring Guide – “SSID Profile Configuration: Primary and Secondary Gateway Clusters.”

Aruba Campus Wireless Design Guide (AOS 10.x) – “Cluster Reachability, Redundancy, and Role Propagation Across Gateways.”

Comprehensive and Detailed Explanation From Exact Extract of HPE Aruba Networking Switching:

The requirement in this question is to allow IT staff to provision unique pre-shared keys (PSKs) for each IoT device on a single SSID, ensuring that one device’s PSK cannot be used by another. This is the definition of Multi-Pre-Shared Key (MPSK) functionality.

HPE Aruba Networking supports three main MPSK deployment methods:

MPSK Local – Keys are defined locally on the AP or gateway; no external integration.

MPSK with ClearPass – Keys are managed and validated via ClearPass Policy Manager.

MPSK with Cloud Authentication – Keys are generated, stored, and managed natively through Aruba Central Cloud Authentication.

In this scenario, the IT Helpdesk wants a simplified, cloud-based method to generate and manage per-device unique PSKs without needing a ClearPass deployment. This aligns directly with MPSK AES with HPE Aruba Networking Central Cloud Authentication.

Exact Extract from HPE Aruba Networking Switching and Central Documentation:

“MPSK with Cloud Authentication allows administrators to configure a single SSID where each device is assigned a unique PSK. The PSKs are securely stored and validated using Aruba Central’s cloud-based authentication service.”

“Each PSK is tied to a specific client identity. If another device attempts to connect using the same PSK, the authentication will fail.”

“This method simplifies onboarding of IoT and headless devices while maintaining security equivalent to 802.1X.”

Thus, the correct recommendation is MPSK AES with Aruba Central Cloud Authentication, which fully supports per-device key uniqueness, centralized management, and cloud-based authentication—ideal for IoT device onboarding.

Why the Other Options Are Incorrect:

A. MPSK AES with ClearPass:Valid and secure, but requires an on-prem ClearPass Policy Manager deployment. The question specifies a simpler method for IT Helpdesk to manage keys directly, which Cloud Authentication provides natively.

“ClearPass MPSK requires policy manager integration; Aruba Central Cloud Authentication provides a simpler cloud-native alternative.”

C. MPSK Local:Suitable for small static environments, but not scalable and requires manual key creation on the AP or gateway. Does not allow IT staff to easily generate new keys per device via Central.

“MPSK Local does not support centralized lifecycle management or key revocation.”

D. MPSK AES with MAC Auth:MPSK already handles per-device authentication via unique keys; MAC authentication is unnecessary and less secure.

“MAC authentication is an alternate method for non-802.1X devices but is not required with MPSK.”

References of HPE Aruba Networking Switching Documents or Study Guide:

Aruba Central Cloud Authentication and MPSK Deployment Guide – “Configuring MPSK AES with Cloud Authentication.”

Aruba Wi-Fi 6 and IoT Integration Best Practices Guide – “Securing IoT with Cloud-Managed MPSK.”

ArubaOS 10 WLAN Configuration Guide – “MPSK Modes (Local, ClearPass, Cloud Authentication) and Use Cases.”

In Aruba CX 6300 and other AOS-CX switches, device profiling enables automatic assignment of roles and policies to endpoints based on device attributes such as MAC OUI, LLDP, or DHCP fingerprint — without requiring an external authentication server such as ClearPass or RADIUS.

The configuration snippet shows:

mac-group iot

seq 10 match mac-oui 81:cd:93

port-access device-profile iot-prod

enable

associate role iot-prod

associate mac-group iot

This means that any device with a MAC address matching the OUI 81:cd:93 will automatically be assigned the iot-prod device profile and its associated role (iot-prod).

However, the requirement also specifies that any other device connected to the same interface (that does not match the OUI or device profile) should still be assigned a default role called iot-default.

To ensure that endpoints not matching any known device profile still receive limited network access, Aruba AOS-CX uses the fallback-role feature under port-access configuration.

The command:

port-access fallback-role iot-default

defines the role that will be automatically assigned to endpoints that fail to match any of the configured device-profile conditions.

This mechanism is crucial in lab or standalone environments where no external authentication (e.g., RADIUS, ClearPass) is configured. It ensures devices are still given a default policy, preventing them from being left in an unauthenticated or blocked state.

Official HPE Aruba Extract (ArubaOS-CX Security and Access Guide):

“The fallback-role command allows the switch to assign a predefined local role to a device when no authentication server is available, or when the device does not match any configured device profile.”

“This command is typically used in test or lab environments where profiling is local to the switch, and a baseline role must still be enforced for unknown devices.”

Therefore, in this case:

Devices matching the MAC OUI 81:cd:93 → assigned iot-prod role

All other devices → automatically assigned iot-default role via port-access fallback-role iot-default

Option Analysis:

A. Incorrect – The port-access onboarding-method precedence command changes the priority order between authentication methods (e.g., 802.1X, MAC-auth, device profile). It does not control fallback behavior.

B. Incorrect – The block-until-profile-applied option delays port activation until profiling completes, but it doesn’t provide a fallback role.

C. Correct – The port-access fallback-role iot-default command ensures that any device not matching the iot-prod profile receives the iot-default role.

D. Incorrect – Lowering precedence has no effect on assigning a default role.

Final Verified Answer: C

Reference Sources (HPE Aruba Official Materials):

Aruba AOS-CX Security and Access Configuration Guide – Device Profiling and Role Assignment

Aruba Certified Switching Professional (ACSP) Study Guide – Port Access and Device Profiling

ArubaOS-CX Fundamentals Guide – Port Access and Fallback Role Implementation

In an Aruba deployment, if an AP's interfaces show different LACP states, it often indicates a configuration mismatch. If one interface is up and the other is blocked as shown in the output, it's likely due to both interfaces on the AP being set to LACP active mode, which is a correct setting for establishing an LACP channel with Aruba switches like the CX 6300 series.

The capture shows messages related to WPA key management, indicating WPA2-PSK is being used. Also, the capture includes a DHCP request from the client but no corresponding DHCP ACK, suggesting the client is not receiving an IP address, which could explain the connectivity failure.

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking Switching Documentation)

In Aruba AOS-CX switching environments, Quality of Service (QoS) allows the switch to prioritize certain types of traffic such as voice, video, or real-time applications.

When a connected endpoint (such as a VoIP phone or wireless handset) marks packets with DSCP = 46 (Expedited Forwarding for voice), the switch must trust these markings to maintain end-to-end traffic prioritization.

Key Concept: Trust Boundary

By default, Aruba switches do not trust incoming DSCP or 802.1p markings from end devices for security reasons.

To allow the switch to accept and act on these values, the QoS trust DSCP feature must be explicitly enabled on the relevant interface or globally.

Official Aruba AOS-CX Extract:

“The qos trust dscp command enables the switch port to honor the Differentiated Services Code Point (DSCP) markings received from connected devices. When trusted, packets maintain their QoS priority as they traverse the switch fabric.”

When wireless handsets connect to a bridged SSID, their traffic is bridged locally at the access switch — meaning the switch sees the traffic directly from the AP. If the handset marks the packet with DSCP 46, enabling QoS trust DSCP ensures that the switch preserves that marking and applies the appropriate voice priority queue treatment.

This configuration ensures end-to-end QoS consistency between the wireless AP, mobility gateway, and wired switch.

Option Analysis:

A. Incorrect – “Voice Wi-Fi Multimedia Share” is not a valid Aruba configuration feature; WMM shares QoS mapping but not DSCP trust.

B. Incorrect – UCC (Unified Communications and Collaboration) enhances call visibility and diagnostics, not DSCP trust or QoS marking.

C. ✅ Correct – Enables the switch to trust and honor DSCP markings (such as DSCP 46) received from endpoints or bridged SSIDs.

D. Incorrect – WMM (Wi-Fi Multimedia) is required for prioritization over wireless links, but since this is a bridged SSID, the DSCP markings must be honored at the switch, not just the AP.

✅ Final Verified Answer: C

???? Reference Sources (HPE Aruba Official Materials):

Aruba AOS-CX Quality of Service (QoS) Configuration Guide

ArubaOS 10 WLAN and Mobility Configuration Guide – QoS and WMM for Voice SSIDs

Aruba Certified Switching Professional (ACSP) Study Guide – QoS Trust and Traffic Classification

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking AOS-10 Gateway Documentation)

The Change of Authorization (CoA) message is a RADIUS-based control packet typically sent by ClearPass Policy Manager or another RADIUS server to modify client authorization dynamically after authentication.

In ArubaOS 10, CoA and Disconnect-Request (DM) messages use UDP port 3799 and are received on the control path of the gateway, not the datapath.

HPE Aruba AOS-10 documentation specifies:

“Use the command packet-capture controlpath udp 3799 on the gateway to verify that CoA packets are being received and processed on the control plane.”

“The controlpath capture displays inbound CoA or DM messages received from RADIUS servers such as ClearPass.”

Command breakdown:

packet-capture controlpath udp 3799

controlpath → Captures control-plane traffic (used for management protocols like RADIUS, CoA, CAPWAP, etc.)

udp 3799 → Filters only CoA/DM packets

Why Others Are Incorrect:

A. interprocess captures internal gateway processes, not RADIUS packets.

C. diag utilities tcpdump is used in AOS 8.x, not AOS 10.

D. tcpdump host-port 3576 uses the wrong port; CoA uses UDP 3799, not 3576 (which is for standard RADIUS authentication).

✅ Final Verified Answer: B. packet-capture controlpath udp 3799

???? Reference Sources (HPE Aruba Official Materials):

Aruba AOS-10 Gateway Troubleshooting Guide – Control Path Packet Capture Commands

Aruba ClearPass and AOS Integration Guide – RADIUS CoA Port (UDP 3799)

Aruba Certified Mobility Professional (ACMP) Study Guide – CoA and Disconnect Message Verification