The primary advantage of SNMPv3 over SNMPv2c is its robust security model. SNMPv3 introduces the User-based Security Model (USM), which provides authentication, integrity, and privacy. The privacy feature is achieved through encryption (e.g., using DES, 3DES, or AES), which protects the confidentiality of SNMP messages during transit. SNMPv2c lacks this capability, transmitting all data, including the community string "password," in clear text, making it vulnerable to eavesdropping. This addition of encryption is a fundamental security enhancement in SNMPv3.

A. Transport mapping: Both SNMPv2c and SNMPv3 are designed to be transport-independent and most commonly use UDP, so this is not a unique advantage.

B. Community strings: This is the authentication mechanism for SNMPv2c. SNMPv3 replaces this less secure method with a more advanced user-based authentication system.

C. GetBulk: The GetBulk operation, which allows for the efficient retrieval of large amounts of data, was introduced in SNMPv2c, not SNMPv3.

1. Official Vendor Documentation: ArubaOS-CX 10.11 Security Guide

Chapter "Simple Network Management Protocol (SNMP)"

Section "SNMPv3 security levels". The guide details the authPriv security level

which "provides authentication and encryption

" contrasting it with the less secure SNMPv1 and SNMPv2c versions.

2. Peer-reviewed Academic Publications (Standards Body): IETF RFC 3414

"User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)"

Section 1.2

"Security Services". This document specifies that the USM provides "Data privacy

" defined as "the encryption of data to prevent its disclosure to unauthorized parties."

3. University Courseware: Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 9

"Network Management

" the text explicitly states

"SNMPv3 provides for encryption of transmitted data

" highlighting this as a key security feature absent in earlier versions like SNMPv2c.

In ArubaOS 10.x, while heterogeneous clusters are supported, there are specific limitations based on the gateway platforms being combined. A cluster composed of a mix of Aruba 7200 Series and 7000 Series gateways is restricted to a maximum of four nodes. The customer has a total of six gateways (four 7200 Series and two 7000 Series). Since this exceeds the four-node limit for this specific combination, it is not possible to form a single cluster using all six gateways. This is a fundamental design constraint for this type of mixed-platform deployment.

A. This is a general prerequisite for any cluster; all nodes must run the same software version. It is a configurable state, not a fundamental design limitation preventing the use of these specific hardware models.

B. This statement is false. Heterogeneous clusters combining 7200 and 7000 series gateways are supported in ArubaOS 10.x, but with the specific node count limitation described in the correct answer.

C. This describes a performance characteristic of a heterogeneous cluster, where the overall capacity is limited by the least capable member. It does not prevent the formation of the cluster itself.

1. ArubaOS 10.3.0.0 User Guide

Chapter: "Gateway Clustering"

Section: "Cluster Profile". The guide states

"A cluster can have a maximum of 12 gateways of the same platform type (all 7200 Series or all 7000 Series). A heterogeneous cluster of 7200 Series and 7000 Series gateways can have a maximum of 4 gateways." (Reference available via the Aruba Support Portal for registered users).

2. Aruba Campus Gateway Architecture and Sizing Guide

Section: "Gateway Cluster Design". This document outlines the scaling and design rules for gateway clusters

specifying that "A mixed cluster of 7000 and 7200 Series Gateways is limited to 4 members." (Page 12).

PBR on AOS-CX is built from two components:

1. A class (or ACL) that uniquely matches the traffic you want to treat differently—in this case, packets whose source is 10.2.250.0/24 and whose destination is the default-route prefix 0.0.0.0/0 (option B).

2. A policy that references that class and sets a different next-hop (10.1.1.253) for the matched traffic (option D).

Applying this policy inbound on the SVI or access interface sends only default-destined traffic from the test subnet to 10.1.1.253; all other routes continue to follow the normal routing table, satisfying the requirement.

A. Builds an ACL but does not distinguish default-route traffic, so non-default flows would also be redirected.

C. Shows a policy without a next-hop statement; it matches traffic but does nothing.

E. Applies the policy globally instead of to the specific interface/SVI, affecting all subnets.

1. Aruba AOS-CX 10.10 Routing Configuration Guide

“Policy-based Routing”

Example 7-3 “Default-route override”

pp. 270-273.

2. Aruba AOS-CX 10.10 Command-Line Interface Reference

commands class ipv4 and policy pbr

sections 17.3 & 17.4.

3. HPE ASE Campus Access V2 Courseware

Module 6 “Advanced Routing”

Lab 6-2 steps 4-7 (pp. 6-41–6-44).

On ArubaOS-CX switches the PoE parameters that are actually applied to an edge port are taken from the device-profile bound to that port.

Inside the profile you can specify max-power, priority and LLDP-based dynamic allocation. If no device profile is present the switch allocates the maximum class-based wattage, which is what the administrator is observing.

By creating a device-profile that includes the correct PoE power definition (or that enables “lldp requested-power”) and attaching it to the access ports, the switch will provision only the wattage the IoT device advertises, eliminating wasted budget and consumption.

B. AAA exemption only affects which frames bypass 802.1X; it does not change PoE budgeting.

C. QoS trust statements influence CoS/DSCP marking, not power allocation.

E. A classifier merely identifies the device; without an associated device-profile it cannot enforce PoE limits.

1. ArubaOS-CX 10.10 Management & Configuration Guide for 6300/6400

“Using device profiles for PoE settings”

p. 1677-1679

HPE-PN 5200-7725.

2. ArubaOS-CX 10.09 Device Profile and Classification Policy Guide

§3.3 “max-power and lldp-requested-power”

p. 32-34

HPE-PN 5200-7614.

3. IEEE Std 802.3-2022

Clause 33.7 “LLDP power via Type-Length-Value (TLV)”

clarifies requested-power exchange.

The IEEE 802.11k amendment, titled "Radio Resource Measurement," is specifically designed to provide a framework for clients and Access Points (APs) to exchange information about the radio environment. It defines mechanisms, such as Neighbor Reports, that allow a client to gather data about nearby APs without having to scan all channels actively. This enables both the network infrastructure and the client stations to dynamically measure radio resources like channel loading and signal strength, leading to more informed and optimized network decisions, particularly for roaming.

A. This is a correct statement about the purpose of 802.11k, but option C is a more precise description of the standard's core function, which is to provide the measurement mechanisms themselves.

B. This describes the function of IEEE 802.11r, known as Fast BSS Transition (FT), which focuses on reducing authentication delays during roaming by pre-establishing security keys.

D. This describes a proprietary feature commonly known as "band steering." While 802.11k measurements can be used as input for such a feature, the standard itself does not define the logic for steering clients between frequency bands.

1. IEEE Std 802.11k™-2008: IEEE Standard for Information technology—Telecommunications and information exchange between systems—Local and metropolitan area networks—Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications Amendment 1: Radio Resource Measurement of Wireless LANs.

Section 1

"Overview": The standard's purpose is stated as: "This amendment defines and exposes radio and network information to facilitate the management and maintenance of a mobile wireless LAN." This directly supports that the core function is providing measurement mechanisms (the "how") to facilitate management (the "why"). Option C describes the "how."

2. ArubaOS 8.11.0.0 User Guide:

Page 1

"802.11k" section: "The 802.11k protocol provides information to discover the best available access point. The 802.11k protocol enables APs and clients to dynamically measure the available radio resources." This text directly validates option C.

Page 1

"802.11r" section: "802.11r or fast BSS transition (FT) is a wireless standard that permits continuous connectivity for wireless devices in motion

by enabling fast and secure handoffs from one AP to another in a seamless manner." This confirms that option B describes 802.11r.

3. Aruba Mobility Conductor - ArubaOS 8.11.0.0 - Feature Guide:

Page 1

"Band Steering" section: "The band steering feature encourages dual-band capable clients to stay on the 5 GHz band on dual-band APs. This frees up the 2.4 GHz band for single-band clients." This defines band steering as a separate feature

confirming that option D is not a function of the 802.11k standard itself.

In Aruba Central, configuration is managed at the group level. A fundamental principle is that a group can be configured using either the Graphical User Interface (GUI) or configuration templates, but not both simultaneously. The scenario requires GUI configuration for Access Points (APs) and gateways, and template-based configuration for switches. To satisfy this, devices with different configuration methods must be placed in separate groups. Therefore, the most efficient and best-practice approach is to create one UI group for both APs and gateways, and a separate template group for the switches. Sites are used for physical location management and monitoring, so creating a unique site for each physical location is also correct.

A: While this would work, creating separate groups for APs and gateways is less efficient, as both can be managed together within a single UI group.

C: A single group cannot support both GUI and template-based configurations. This option violates a core architectural principle of Aruba Central group management.

D: This is incorrect because a single group cannot mix configuration methods, and the concept of a "site" is for physical location, not for organizing device types.

1. Aruba Central User Guide - Managing Groups: "Aruba Central offers the following two types of configuration methods for device groups: Template-based configuration method... UI-based configuration method... A group can have either template-based configuration method or UI-based configuration method." This confirms that a single group cannot support both methods

invalidating options C and D. (Accessed via Aruba Networks Help Center

help.central.arubanetworks.com

under the "Managing Groups" section).

2. Aruba Central User Guide - Overview of Aruba Central: "Groups allow you to manage devices of the same type or different types together... Sites are the physical locations where the devices are installed." This documentation clarifies the distinct roles of groups (for configuration) and sites (for physical location)

highlighting the incorrect use of sites in option D. (Accessed via Aruba Networks Help Center

help.central.arubanetworks.com

under the "Getting Started" > "Overview of Aruba Central" section).

3. Aruba Validated Solution Guide - Campus Network Design for Aruba Central-Managed Switches (April 2022): Section 3.1

"Groups

" discusses the strategy of using template groups for switches to ensure configuration consistency and UI groups for APs and gateways for ease of management

aligning with the solution presented in option B.

The standard method for onboarding an Aruba User Experience Insight (UXI) sensor onto a secure network, such as one using 802.1X, is via the Aruba UXI mobile application. The app connects directly to the sensor using Bluetooth, providing an out-of-band channel to securely configure network settings. Through the app, an administrator can push the necessary Wi-Fi profile, including credentials and certificates required for WPA2-Enterprise (802.1X) authentication. This process allows the sensor to authenticate and connect to the network, after which it can communicate with the cloud dashboard.

B. The Aruba Installer app is used for provisioning Aruba access points and switches into a management platform like Aruba Central, not for configuring UXI sensors.

C. UXI sensors are independent monitoring agents; they cannot be configured by connecting them to an already installed sensor. Each sensor must be onboarded individually.

D. UXI sensors are designed for simple, app-based deployment and do not feature a serial console port for Command Line Interface (CLI) configuration.

1. Aruba User Experience Insight (UXI) G-Series Installation Guide (Edition 1

May 2021):

Page 6

"Step 2 - Onboard the Sensor": "Download the Aruba UXI mobile app from the Apple App Store or Google Play Store. The mobile app uses Bluetooth to discover and configure nearby sensors." This section details using the app for initial configuration.

2. Aruba UXI Help Center

"How to onboard a sensor":

This official support article states

"The mobile app uses Bluetooth to discover and configure nearby sensors. You can use the mobile app to configure Wi-Fi

Ethernet

proxy settings

and install 802.1x certificates." This explicitly confirms the use of the app and Bluetooth for 802.1X setups.

3. Aruba User Experience Insight (UXI) Datasheet:

Under "Simple to Deploy and Manage

" the datasheet highlights "Zero-touch provisioning" and "Mobile app for on-site configuration

" reinforcing that the intended deployment method is app-based rather than via CLI or other means.

Aruba APs expect the switch port to supply 802.3at/af/BT PoE, receive their own IP address on the untagged management VLAN, and deliver user traffic in tagged client / guest VLANs.

The only option that

1) makes the port a trunk with native (untagged) VLAN 100,

2) explicitly permits VLANs 100, 200 and 300 on the trunk, and

3) enables PoE for the port(s)

is option C.

Because cables are not labeled and the installer is un-trained, LLDP-based device-profile automation in the template binds the configuration automatically to any port into which an AP-515/575 is plugged, guaranteeing correct operation without manual port selection.

A – Configures the port as access VLAN 100; no trunk, so WLAN client and guest VLANs never reach the AP.

B – Trunk native 100 but omits VLAN 300 from the allowed list; guest SSID will fail.

D – Keeps native VLAN 1 and allows only VLAN 100; AP never receives management on 100 and lacks client/guest VLANs; PoE not explicitly enabled.

1. ArubaOS-CX 10.10 Management and Configuration Guide for Aruba CX 6300 Switches

“Device Profile for Aruba-AP”

pp. 851-853.

2. Aruba Campus Access Design Fundamentals (HPE Part #: 5200-7777)

Section 7.2 “Trunk requirements for APs”

p. 132-133.

3. HPE Aruba Networking CX 6300 Installation and Getting Started Guide

“PoE power classes and port configuration”

pp. 48-50.

4. Hewlett Packard Enterprise

Best Practices for Deploying Aruba 500-Series and 570-Series APs

Rev. 5.0

p. 9.

For switches to participate in the same Multiple Spanning Tree Protocol (MSTP) region and achieve load balancing, they must share an identical MSTP configuration. A critical component of this configuration is the VLAN-to-instance mapping table. This table defines which VLANs belong to which Spanning Tree Instance (MSTI). By creating different instances and assigning different root bridges to each, traffic for different VLANs can be forced to take different paths. All switches in the region must have the exact same VLAN-to-instance mapping to ensure a consistent and loop-free topology for each instance, which is the fundamental requirement for load balancing.

A. Spanning-tree bpdu-guard setting: This is a port-level security feature to prevent rogue switches and is not a parameter for defining an MSTP region or enabling load balancing.

C. spanning-tree Cist mapping: The CIST (Common and Internal Spanning Tree, or Instance 0) is the default instance. The key to load balancing is the specific mapping of VLANs to multiple different instances (MSTI 1, MSTI 2, etc.), not just the CIST.

D. Spanning-tree root-guard setting: This is a port-level security feature to enforce the root bridge placement in the network; it does not need to be identical across switches for region formation.

1. ArubaOS-CX 10.12 Spanning Tree Protocol Guide

Page 21

"MSTP regions" section: "An MSTP region is a group of interconnected switches that have the same MSTP configuration. The MSTP configuration consists of the following attributes: ... VLAN-to-instance mapping table." The document further states

"To be in the same MSTP region

switches must have the same configuration for all of these attributes."

2. ArubaOS-CX 10.12 Spanning Tree Protocol Guide

Page 20

"Multiple Spanning Tree Protocol (MSTP)" section: "MSTP provides for load balancing of traffic for different VLANs by assigning different VLANs to different MSTP instances (MSTIs). Each MSTI can have a different root switch and a different topology." This directly links the concept of VLAN-to-instance mapping to the goal of load balancing.

The WPA 4-Way Handshake follows this precise functional sequence:

1. Exchanges messages for generating PTK: The Authenticator sends an ANonce (Msg 1), and the Supplicant sends an SNonce (Msg 2). These random values are required to mathematically derive the Pairwise Transient Key (PTK).
2. Proves knowledge of the PMK: The Supplicant includes a Message Integrity Code (MIC) in Msg 2. The Authenticator verifies this MIC to confirm the Supplicant possesses the correct Pairwise Master Key (PMK) before proceeding.
3. Distributes an encrypted GTK to the client: Once the unicast link is authenticated, the Authenticator sends the Group Transient Key (GTK) to the client in Msg 3, encrypted using the Key Encryption Key (KEK) portion of the PTK.
4. Sets first initialization vector (IV): Upon completion (Msg 4), both sides install the keys and initialize their encryption counters (Packet Numbers or Initialization Vectors) to begin encrypted data transmission.

IEEE Standard 802.11i-2004, Amendment 6: Medium Access Control (MAC) Security Enhancements, Section 8.5.3 "4-Way Handshake", Steps 1-4 (outlining Nonce exchange, MIC verification, and GTK transport).

CWSP-206 Official Study Guide (Certified Wireless Security Professional), Chapter: Secure Roaming and the 4-Way Handshake, Section: "The 4-Way Handshake Process" (Details the Exchange -> Verify -> Install order).

HPE7-A01 Aruba Certified Campus Access Professional Exam Guide, Module: WLAN Security, Topic: WPA3/WPA2 Handshake flows.

Cisco Wireless LAN Security White Paper, Section: WPA2 4-Way Handshake (Confirms GTK is sent in Message 3 and Key Installation is the final step).