Refer to Exhibit: https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/HP_HPE7-A01/page_55_img_1.jpg With Access-1, What needs to be identically configured With MSTP to load-balance VLANS?

Spanning-tree instance vlan mapppjng

Free HPE7-A01 Practice Test Questions and Answers (2026)

Last Update Check September 20, 2026

Q: 1

Which feature supported by SNMPv3 provides an advantage over SNMPv2c?

Options

17 comments in the community discussion

AmeliaM 2

Guessing B for this one

Jack O. 1

Why wouldn't A or C be seen as an "advantage" for v3? Both are available in v2c too, right?

Correct Answer:

Explanation

The primary advantage of SNMPv3 over SNMPv2c is its robust security model. SNMPv3 introduces the User-based Security Model (USM), which provides authentication, integrity, and privacy. The privacy feature is achieved through encryption (e.g., using DES, 3DES, or AES), which protects the confidentiality of SNMP messages during transit. SNMPv2c lacks this capability, transmitting all data, including the community string "password," in clear text, making it vulnerable to eavesdropping. This addition of encryption is a fundamental security enhancement in SNMPv3.

Why Incorrect

A. Transport mapping: Both SNMPv2c and SNMPv3 are designed to be transport-independent and most commonly use UDP, so this is not a unique advantage.

B. Community strings: This is the authentication mechanism for SNMPv2c. SNMPv3 replaces this less secure method with a more advanced user-based authentication system.

C. GetBulk: The GetBulk operation, which allows for the efficient retrieval of large amounts of data, was introduced in SNMPv2c, not SNMPv3.

References

1. Official Vendor Documentation: ArubaOS-CX 10.11 Security Guide

Chapter "Simple Network Management Protocol (SNMP)"

Section "SNMPv3 security levels". The guide details the authPriv security level

which "provides authentication and encryption

" contrasting it with the less secure SNMPv1 and SNMPv2c versions.

2. Peer-reviewed Academic Publications (Standards Body): IETF RFC 3414

"User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)"

Section 1.2

"Security Services". This document specifies that the USM provides "Data privacy

" defined as "the encryption of data to prevent its disclosure to unauthorized parties."

3. University Courseware: Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 9

"Network Management

" the text explicitly states

"SNMPv3 provides for encryption of transmitted data

" highlighting this as a key security feature absent in earlier versions like SNMPv2c.

Q: 2

Your customer has four (4) Aruba 7200 Series Gateways and two (2) 7000 Series Gateways. The customer wants to form a cluster with these Gateways. What design consideration would prevent you from using all of those Gateways?

Options

18 comments in the community discussion

Sofia B. 6

D. not A. Cluster limit for mixed 7200 and 7000 series is four nodes so can't use all six even if they’re on the same version. Anyone else get tripped up by that in the docs?

Neha G. 1

D imo, the issue's that mixed clusters of 7200 and 7000 series gateways in AOS 10.x cap out at four nodes. Having six like in the question just won't work, regardless of version. Pretty sure that's what the official docs and blueprint mention-anyone recall if they've seen this directly in practice or labs?

Correct Answer:

Explanation

In ArubaOS 10.x, while heterogeneous clusters are supported, there are specific limitations based on the gateway platforms being combined. A cluster composed of a mix of Aruba 7200 Series and 7000 Series gateways is restricted to a maximum of four nodes. The customer has a total of six gateways (four 7200 Series and two 7000 Series). Since this exceeds the four-node limit for this specific combination, it is not possible to form a single cluster using all six gateways. This is a fundamental design constraint for this type of mixed-platform deployment.

Why Incorrect

A. This is a general prerequisite for any cluster; all nodes must run the same software version. It is a configurable state, not a fundamental design limitation preventing the use of these specific hardware models.

B. This statement is false. Heterogeneous clusters combining 7200 and 7000 series gateways are supported in ArubaOS 10.x, but with the specific node count limitation described in the correct answer.

C. This describes a performance characteristic of a heterogeneous cluster, where the overall capacity is limited by the least capable member. It does not prevent the formation of the cluster itself.

References

1. ArubaOS 10.3.0.0 User Guide

Chapter: "Gateway Clustering"

Section: "Cluster Profile". The guide states

"A cluster can have a maximum of 12 gateways of the same platform type (all 7200 Series or all 7000 Series). A heterogeneous cluster of 7200 Series and 7000 Series gateways can have a maximum of 4 gateways." (Reference available via the Aruba Support Portal for registered users).

2. Aruba Campus Gateway Architecture and Sizing Guide

Section: "Gateway Cluster Design". This document outlines the scaling and design rules for gateway clusters

specifying that "A mixed cluster of 7000 and 7200 Series Gateways is limited to 4 members." (Page 12).

Q: 3

You are configuring Policy Based Routing (PBR) for a subnet that will be used to test a new default route for your network Traffic originating from 10.2.250.0/24 should use a new default route to 10.1.1.253. Other non-default routes for this subnet should not be affected by this change. What are two parts of the solution for these requirements? (Select two.) A)

Options

15 comments in the community discussion

CarefulNeteng8647 1

C/E tbh, since C matches the source subnet and could catch outbound flows, and E might be the policy applying that class. If we're testing a new default for all traffic from 10.2.250.0/24, wouldn't that fit? Could be missing something subtle though.

Skyler F. 1

Had something like this in a mock. Pretty sure it's B and D, since B is the ACL/class matching both the source subnet and default route, and D applies the policy to set the next-hop. C would match too much traffic. Agree?

Q: 4

A company recently upgraded its campus switching infrastructure with Aruba 6300 CX switches. They have implemented 802.1X authentication on edge ports where laptop and loT devices typically connect An administrator has noticed that for PoE devices the pons are delivering the maximum wattage instead of what the device actually needs Upon connecting the loT devices, the devices request their specific required wattage through information exchange

Options

10 comments in the community discussion

Rowan R. 1

Its D for this. On Aruba CX, device profiles are where you actually specify what power to allocate per port, including letting LLDP negotiate requested wattage. Without those profiles, the switch just hands out the max by default. Classifier policy (E) is more traffic related, not PoE allocation. I think D is correct b

Jason N.

C isn't right here. D. Only device profiles on Aruba switches actually let you define port-specific PoE power, not classifier policy.

Q: 5

What is true regarding 802.11k?

Options

20 comments in the community discussion

RaviY 8

Option C Clear and to the point, matches what I remember from similar exam questions.

Priya S. 5

C. but if the question was worded to ask about extending management, maybe A. 802.11k really just covers measuring radio stuff.

Correct Answer:

Explanation

The IEEE 802.11k amendment, titled "Radio Resource Measurement," is specifically designed to provide a framework for clients and Access Points (APs) to exchange information about the radio environment. It defines mechanisms, such as Neighbor Reports, that allow a client to gather data about nearby APs without having to scan all channels actively. This enables both the network infrastructure and the client stations to dynamically measure radio resources like channel loading and signal strength, leading to more informed and optimized network decisions, particularly for roaming.

Why Incorrect

A. This is a correct statement about the purpose of 802.11k, but option C is a more precise description of the standard's core function, which is to provide the measurement mechanisms themselves.

B. This describes the function of IEEE 802.11r, known as Fast BSS Transition (FT), which focuses on reducing authentication delays during roaming by pre-establishing security keys.

D. This describes a proprietary feature commonly known as "band steering." While 802.11k measurements can be used as input for such a feature, the standard itself does not define the logic for steering clients between frequency bands.

References

1. IEEE Std 802.11k™-2008: IEEE Standard for Information technology—Telecommunications and information exchange between systems—Local and metropolitan area networks—Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications Amendment 1: Radio Resource Measurement of Wireless LANs.

Section 1

"Overview": The standard's purpose is stated as: "This amendment defines and exposes radio and network information to facilitate the management and maintenance of a mobile wireless LAN." This directly supports that the core function is providing measurement mechanisms (the "how") to facilitate management (the "why"). Option C describes the "how."

2. ArubaOS 8.11.0.0 User Guide:

Page 1

"802.11k" section: "The 802.11k protocol provides information to discover the best available access point. The 802.11k protocol enables APs and clients to dynamically measure the available radio resources." This text directly validates option C.

Page 1

"802.11r" section: "802.11r or fast BSS transition (FT) is a wireless standard that permits continuous connectivity for wireless devices in motion

by enabling fast and secure handoffs from one AP to another in a seamless manner." This confirms that option B describes 802.11r.

3. Aruba Mobility Conductor - ArubaOS 8.11.0.0 - Feature Guide:

Page 1

"Band Steering" section: "The band steering feature encourages dual-band capable clients to stay on the 5 GHz band on dual-band APs. This frees up the 2.4 GHz band for single-band clients." This defines band steering as a separate feature

confirming that option D is not a function of the 802.11k standard itself.

Q: 6

You are building a configuration in Central that will be used for a standardized network design for small sites for your company, you want to use GUI configuration for gateways and Aps, while template configuration for switches. You need to align with Aruba best practices. Which set of actions will satisfy these requirements?

Options

12 comments in the community discussion

Anita U.

B makes sense. Groups in Central align with config method, so APs/gateways (GUI) together, switches (template) separate. Works per Aruba docs.

Ajay P.

B , seen this layout in exam reports and it fits Aruba's best practice.

Correct Answer:

Explanation

In Aruba Central, configuration is managed at the group level. A fundamental principle is that a group can be configured using either the Graphical User Interface (GUI) or configuration templates, but not both simultaneously. The scenario requires GUI configuration for Access Points (APs) and gateways, and template-based configuration for switches. To satisfy this, devices with different configuration methods must be placed in separate groups. Therefore, the most efficient and best-practice approach is to create one UI group for both APs and gateways, and a separate template group for the switches. Sites are used for physical location management and monitoring, so creating a unique site for each physical location is also correct.

Why Incorrect

A: While this would work, creating separate groups for APs and gateways is less efficient, as both can be managed together within a single UI group.

C: A single group cannot support both GUI and template-based configurations. This option violates a core architectural principle of Aruba Central group management.

D: This is incorrect because a single group cannot mix configuration methods, and the concept of a "site" is for physical location, not for organizing device types.

References

1. Aruba Central User Guide - Managing Groups: "Aruba Central offers the following two types of configuration methods for device groups: Template-based configuration method... UI-based configuration method... A group can have either template-based configuration method or UI-based configuration method." This confirms that a single group cannot support both methods

invalidating options C and D. (Accessed via Aruba Networks Help Center

help.central.arubanetworks.com

under the "Managing Groups" section).

2. Aruba Central User Guide - Overview of Aruba Central: "Groups allow you to manage devices of the same type or different types together... Sites are the physical locations where the devices are installed." This documentation clarifies the distinct roles of groups (for configuration) and sites (for physical location)

highlighting the incorrect use of sites in option D. (Accessed via Aruba Networks Help Center

help.central.arubanetworks.com

under the "Getting Started" > "Overview of Aruba Central" section).

3. Aruba Validated Solution Guide - Campus Network Design for Aruba Central-Managed Switches (April 2022): Section 3.1

"Groups

" discusses the strategy of using template groups for switches to ensure configuration consistency and UI groups for APs and gateways for ease of management

aligning with the solution presented in option B.

Q: 7

Which method is used to onboard a new UXI in an existing environment with 802 1X authentication? (The sensor has no cellular connection)

Options

15 comments in the community discussion

Jordan L. 3

Option A for sure. Had something like this in a mock-Bluetooth via the UXI app is the main onboarding method, especially when there’s no cellular. D is more of a fallback if Bluetooth can’t work. Agree?

Skyler C. 2

D for me. Serial cable gives you direct access when there's no network connection at all. Pretty sure that's how you'd push the config for 802.1X if Bluetooth's not an option. Correct me if I'm off base.

Correct Answer:

Explanation

The standard method for onboarding an Aruba User Experience Insight (UXI) sensor onto a secure network, such as one using 802.1X, is via the Aruba UXI mobile application. The app connects directly to the sensor using Bluetooth, providing an out-of-band channel to securely configure network settings. Through the app, an administrator can push the necessary Wi-Fi profile, including credentials and certificates required for WPA2-Enterprise (802.1X) authentication. This process allows the sensor to authenticate and connect to the network, after which it can communicate with the cloud dashboard.

Why Incorrect

B. The Aruba Installer app is used for provisioning Aruba access points and switches into a management platform like Aruba Central, not for configuring UXI sensors.

C. UXI sensors are independent monitoring agents; they cannot be configured by connecting them to an already installed sensor. Each sensor must be onboarded individually.

D. UXI sensors are designed for simple, app-based deployment and do not feature a serial console port for Command Line Interface (CLI) configuration.

References

1. Aruba User Experience Insight (UXI) G-Series Installation Guide (Edition 1

May 2021):

Page 6

"Step 2 - Onboard the Sensor": "Download the Aruba UXI mobile app from the Apple App Store or Google Play Store. The mobile app uses Bluetooth to discover and configure nearby sensors." This section details using the app for initial configuration.

2. Aruba UXI Help Center

"How to onboard a sensor":

This official support article states

"The mobile app uses Bluetooth to discover and configure nearby sensors. You can use the mobile app to configure Wi-Fi

Ethernet

proxy settings

and install 802.1x certificates." This explicitly confirms the use of the app and Bluetooth for 802.1X setups.

3. Aruba User Experience Insight (UXI) Datasheet:

Under "Simple to Deploy and Manage

" the datasheet highlights "Zero-touch provisioning" and "Mobile app for on-site configuration

" reinforcing that the intended deployment method is app-based rather than via CLI or other means.

Q: 8

A system engineer needs to preconfigure several Aruba CX 6300 switches that will be sent to a remote office An untrained local field technician will do the rollout of the switches and the mounting of several AP-515s and AP-575S. Cables running to theAPs are not labeled. The VLANs are already preconfigured to VLAN 100 (mgmt), VLAN 200 (clients), and VLAN 300 (guests) What is the correct configuration to ensure that APs will work properly? A)

Options

19 comments in the community discussion

Owen 5

Option C is the right config for this scenario. Trunk mode lets the APs handle tagged client and guest VLANs as well as untagged management, which is what Aruba expects. D looks tempting but that one’s access mode so it’d break multi-VLAN support. Pretty sure C is the only one that works here, unless I’m missing som

Jamie 5

Option C B is a trap since it doesn't cover all VLANs correctly for AP traffic.

Q: 9

Refer to Exhibit:

With Access-1, What needs to be identically configured With MSTP to load-balance VLANS?

Options

13 comments in the community discussion

Chris I. 2

Probably B, that's the VLAN-to-instance mapping. That config has to be identical for MSTP load balancing to work right. The other options are more about protection, not splitting traffic across instances. Pretty sure but always good to double check.

Robin 2

Option B. kind of guessing here. Pretty sure the vlan mapping must match so MSTP can load-balance right? Anyone else confirm?

Correct Answer:

Explanation

For switches to participate in the same Multiple Spanning Tree Protocol (MSTP) region and achieve load balancing, they must share an identical MSTP configuration. A critical component of this configuration is the VLAN-to-instance mapping table. This table defines which VLANs belong to which Spanning Tree Instance (MSTI). By creating different instances and assigning different root bridges to each, traffic for different VLANs can be forced to take different paths. All switches in the region must have the exact same VLAN-to-instance mapping to ensure a consistent and loop-free topology for each instance, which is the fundamental requirement for load balancing.

Why Incorrect

A. Spanning-tree bpdu-guard setting: This is a port-level security feature to prevent rogue switches and is not a parameter for defining an MSTP region or enabling load balancing.

C. spanning-tree Cist mapping: The CIST (Common and Internal Spanning Tree, or Instance 0) is the default instance. The key to load balancing is the specific mapping of VLANs to multiple different instances (MSTI 1, MSTI 2, etc.), not just the CIST.

D. Spanning-tree root-guard setting: This is a port-level security feature to enforce the root bridge placement in the network; it does not need to be identical across switches for region formation.

References

1. ArubaOS-CX 10.12 Spanning Tree Protocol Guide

Page 21

"MSTP regions" section: "An MSTP region is a group of interconnected switches that have the same MSTP configuration. The MSTP configuration consists of the following attributes: ... VLAN-to-instance mapping table." The document further states

"To be in the same MSTP region

switches must have the same configuration for all of these attributes."

2. ArubaOS-CX 10.12 Spanning Tree Protocol Guide

Page 20

"Multiple Spanning Tree Protocol (MSTP)" section: "MSTP provides for load balancing of traffic for different VLANs by assigning different VLANs to different MSTP instances (MSTIs). Each MSTI can have a different root switch and a different topology." This directly links the concept of VLAN-to-instance mapping to the goal of load balancing.

Q: 10

DRAG DROP List the WPA 4-Way Handshake functions in the correct order.

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

Distributes an encrypted GTK to the client
Exchanges messages for generating PTK
Proves knowledge of the PMK
Sets first initialization vector (IV)

9 comments in the community discussion

Ava I. 7

Exchanges messages for generating PTK, then proves knowledge of the PMK, distributes encrypted GTK, sets first IV.

Morgan K. 2

PTK exchange, then prove PMK, send encrypted GTK, finally set IV. Jason's order mixes up steps-GTK is after PMK proof.

Correct Answer:

Order Bucket 1: B. Exchanges messages for generating PTK Bucket 2: C. Proves knowledge of the PMK Bucket 3: A. Distributes an encrypted GTK to the client Bucket 4: D. Sets first initialization vector (IV)

Explanation

The WPA 4-Way Handshake follows this precise functional sequence:

Exchanges messages for generating PTK: The Authenticator sends an ANonce (Msg 1), and the Supplicant sends an SNonce (Msg 2). These random values are required to mathematically derive the Pairwise Transient Key (PTK).
Proves knowledge of the PMK: The Supplicant includes a Message Integrity Code (MIC) in Msg 2. The Authenticator verifies this MIC to confirm the Supplicant possesses the correct Pairwise Master Key (PMK) before proceeding.
Distributes an encrypted GTK to the client: Once the unicast link is authenticated, the Authenticator sends the Group Transient Key (GTK) to the client in Msg 3, encrypted using the Key Encryption Key (KEK) portion of the PTK.
Sets first initialization vector (IV): Upon completion (Msg 4), both sides install the keys and initialize their encryption counters (Packet Numbers or Initialization Vectors) to begin encrypted data transmission.

References

IEEE Standard 802.11i-2004, Amendment 6: Medium Access Control (MAC) Security Enhancements, Section 8.5.3 "4-Way Handshake", Steps 1-4 (outlining Nonce exchange, MIC verification, and GTK transport).

CWSP-206 Official Study Guide (Certified Wireless Security Professional), Chapter: Secure Roaming and the 4-Way Handshake, Section: "The 4-Way Handshake Process" (Details the Exchange -> Verify -> Install order).

HPE7-A01 Aruba Certified Campus Access Professional Exam Guide, Module: WLAN Security, Topic: WPA3/WPA2 Handshake flows.

Cisco Wireless LAN Security White Paper, Section: WPA2 4-Way Handshake (Confirms GTK is sent in Message 3 and Key Installation is the final step).

Q: 11

DRAG DROP Match the appropriate QoS concept with its definition. (Options may be used more than once or not at all.)

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

Best Effort Service
Class of Service
Differentiated Services
WMM

3 comments in the community discussion

Noah 1

Best Effort Service maps to first-come, first-served, Class of Service goes with the 802.1Q VLAN L2 marking, Differentiated Services matches layer-3 with 64 classes (DSCP), and WMM is for the Wi-Fi ACs under 802.11e.I see people mix up CoS and DiffServ a lot-easy trap since both deal with prioritizing packets,

Ivy W. 1

Best Effort Service → first-come, first-served, Class of Service → 802.1Q L2 marking, Differentiated Services → L3 64 classes, WMM → 802.11e access categories

Correct Answer:

Answer Area A method for classifying network traffic at layer-2 by marking 802.1Q VLAN Ethernet frames with one of eight service classes: B. Class of Service A method for classifying network traffic at layer-3 by marking packets with one of 64 different service classes: C. Differentiated Services A method where traffic is treated equally in a first-come, first-served manner: A. Best Effort Service A method for classifying network traffic using access categories based on the IEEE 802.11e QoS standard: D. WMM

Explanation

Class of Service (CoS) operates at Layer 2, utilizing the 3-bit Priority Code Point (PCP) field within the 802.1Q Ethernet header to define 8 priority levels (0–7). Differentiated Services (DiffServ) functions at Layer 3. It re-purposes the ToS byte in the IPv4 header (or Traffic Class in IPv6) to use the 6-bit Differentiated Services Code Point (DSCP), allowing for 2^6 = 64 distinct traffic classifications. Best Effort Service is the default behavior where no QoS mechanisms are applied. Network devices forward packets in the order they arrive (First-In, First-Out) without guarantees for bandwidth or latency.

WMM (Wi-Fi Multimedia) is a subset of the IEEE 802.11e standard adapted by the Wi-Fi Alliance. It prioritizes wireless traffic into four Access Categories (AC): Voice, Video, Best Effort, and Background.

References

RFC 2474, "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers," Internet Engineering Task Force (IETF), December 1998. (Defines Layer 3 DiffServ and the 6-bit DSCP field).

IEEE Std 802.1Q-2018, "IEEE Standard for Local and Metropolitan Area Networks—Bridges and Bridged Networks," IEEE Computer Society, Section 6.9.3 "Priority Code Point (PCP) encoding". (Defines Layer 2 classification using the 3-bit field for 8 priority levels).

Cisco Systems, "Quality of Service (QoS) Configuration Guide, Cisco IOS XE 17.x," Chapter: "QoS Overview," Section: "QoS Models." (Details Best Effort, IntServ, and DiffServ models).

Wi-Fi Alliance, "WMM (Wi-Fi Multimedia) Specification," Version 1.2.0. (Defines the implementation of IEEE 802.11e QoS and Access Categories).

Aruba (HPE), "ArubaOS 8.6.0.0 User Guide," Chapter: "Quality of Service," Section: "Wi-Fi Multimedia." (Explains WMM and its relation to 802.11e Access Categories).

Q: 12

DRAG DROP Match the terms below to their characteristics (Options may be used more than once or not at all.)

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

A device with IP address 10.1.3.7 in a network wants to send the traffic stream to a device with IP address 10.13.4.2 in the other network
One/more senders and one/more recipients participate in data transfer traffic
Sent to all hosts on a remote network
Sent to all NICs on the same network segment as the source NIC

6 comments in the community discussion

Vikram Q. 5

Broadcast → Sent to all NICs on the same network segment, IP Directed Broadcast → Sent to all hosts on a remote network, Multicast → One/more senders and one/more recipients participate, Unicast → Device 10.1.3.7 sends to 10.13.4.2. Pretty sure that's how it lines up per networking basics, but open if you have a differ

Aisha S. 1

A device with IP 10.1.3.7 sending to 10.13.4.2 → Broadcast; One or more senders and recipients → Unicast; Sent to all hosts on remote network → Multicast; Sent to all NICs same segment → IP Directed Broadcast.But is it looking for the best fit or could partial overlaps be correct too?

Correct Answer:

Term Broadcast: D. Sent to all NICs on the same network segment as the source NIC IP Directed Broadcast: C. Sent to all hosts on a remote network Multicast: B. One/more senders and one/more recipients participate in data transfer traffic Unicast: A. A device with IP address 10.1.3.7 in a network wants to send the traffic stream to a device with IP address 10.13.4.2 in the other network

Explanation

Unicast is a one-to-one transmission between a specific source and a specific destination IP (e.g., 10.1.3.7 to 10.13.4.2). Multicast enables efficient one-to-many or many-to-many communication where traffic is sent to a specific group of interested receivers (class D addresses), allowing multiple senders and recipients. IP Directed Broadcast targets all hosts on a specific remote subnet; the packet is routed as unicast until it reaches the destination router, which then broadcasts it locally. Broadcast (specifically limited broadcast, 255.255.255.255) is sent to all network interface cards (NICs) on the same local Layer 2 segment as the sender and is not forwarded by routers.

References

RFC 919, "Broadcasting Internet Datagrams," Section 6 (Gateways and Broadcasts), defining the distinction between local and directed broadcasts.

RFC 1112, "Host Extensions for IP Multicasting," Section 1, defining multicast as the delivery of datagrams to a "host group" (zero or more hosts).

Cisco Systems, "IP Addressing: IPv4 Addressing Configuration Guide," Configuring IP Directed Broadcasts, which defines directed broadcasts as packets sent to the broadcast address of a subnet to which the sender is not directly attached.

RFC 1812, "Requirements for IP Version 4 Routers," Section 4.2.2.11, discussing the requirements for forwarding directed broadcasts versus limited broadcasts.

Q: 13

DRAG DROP Match each PoE power class to Its corresponding 802.3 standard. (Options may he used more than once or not at all)

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

802.3at
802.3bt
802.3af

6 comments in the community discussion

JackJ 7

802.3af -> Class 3 (15.4W), 802.3at -> Class 4 (30W), 802.3bt -> Class 6 (60W) and Class 8 (90W).

QuietLearner1371 6

This drag and drop again? 802.3af to Class 3, 802.3at to Class 4, 802.3bt goes with both Class 6 and Class 8.

Q: 14

DRAG DROP Match the topics with the underlying technologies (Options may be used more than once or not at all.)

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

EVPN-VXLAN
User Based Tunneling (UBT)

6 comments in the community discussion

Meera W. 6

EVPN-VXLAN: Distributed Overlay, Encapsulated in UDP. UBT: Centralized Overlay, GRE. Pretty sure that matches HPE docs.

Sanjay 5

EVPN-VXLAN to Distributed Overlay, Encapsulated in UDP. UBT to Centralized Overlay, GRE. Saw this same mapping on recent exam reports.

Q: 15

DRAG DROP Match the topics of an AOS10 Tunneled mode setup between an AP and a Gateway. (Options may be used more than once or not at all.)

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

Authenticator
Negotiate IPsec Phase1
Negotiate IPsec Phase 2
RADIUS proxy

9 comments in the community discussion

Chris Z. 6

Authenticator → Access Point, Negotiate IPsec Phase 2 → Access Point and Gateway, RADIUS proxy → Device Designated Gateway, Negotiate IPsec Phase1 → Overlay Tunnel Orchestrator. Not seeing why you'd put RADIUS proxy with OTO, that's a common trap.

Luna K. 5

This lines up as Authenticator to Access Point, Phase 1 to Overlay Tunnel Orchestrator, Phase 2 to Access Point and Gateway, RADIUS proxy to Device Designated Gateway. I think that fits Aruba AOS10 tunneling flow, but correct me if I'm off.

Q: 16

DRAG DROP List the firewall role derivation flow in the correct order

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

Authentication default role
Initial role assigned
Server derived role
User derived role

5 comments in the community discussion

Olivia N. 4

Yeah, the flow should be: Initial role assigned, then Authentication default role, next User derived role, and finally Server derived role. Server VSA always trumps everything else from what I've seen. Pretty sure this matches Aruba docs.

Anita Z.

Close but I'd put Authentication default role before Initial role assigned, then Server derived role, then User derived role.

Correct Answer:

Order Bucket 1: B. Initial role assigned Bucket 2: A. Authentication default role Bucket 3: D. User derived role Bucket 4: C. Server derived role

Explanation

The Aruba controller assigns user roles based on a specific hierarchy of precedence. The process flows from the base configuration to specific overrides:

Initial role assigned: This is the starting point. When a user first associates with the SSID (before authentication completes), they are assigned the "Initial Role" configured in the AAA profile.
Authentication default role: Upon successful authentication, the system applies the default role specified in the authentication profile (e.g., 802.1X or MAC authentication profile). This overrides the initial role.
User derived role: The controller then checks for User Derivation Rules (UDRs) configured locally on the controller (based on attributes like SSID, VLAN, or MAC OUI). If a match is found, this role takes precedence over the authentication default role.
Server derived role: Finally, if the authentication server (RADIUS) returns a Vendor Specific Attribute (VSA) specifying a role, this Server Derived Role takes the highest precedence and overrides all previous roles.

References

Aruba Networks (HPE), ArubaOS 8.6.0.0 User Guide, "User Roles" section, subsection "Role Derivation." This section explicitly states: "The following is the order of precedence for role assignment (from highest to lowest): 1. Server-derived role 2. User-derived role 3. Default role 4. Initial role."

Aruba Networks (HPE), Aruba Certified Mobility Associate (ACMA) Study Guide, Chapter on "Firewall Roles and Policies," describing the hierarchy of role assignment where Server Derived roles override User Derived rules, which in turn override Default roles.

Q: 17

DRAG DROP Select the Aruba stacking technology matching each option (Options may be used more than once or not at all.)

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

5 comments in the community discussion

Quinn T. 6

Looks solid to me, the mapping lines up with Aruba docs: VSF matches with up to 10 devices, up to 50G ISL, and max 200G aggregate. VSX is only for two devices and supports those 400G ISLs. I think this is right but let me know if you see something off.

Grace J. 6

VSF → Supports up to 10 devices per stack, individual ISL links up to 50G, max aggregate ISL bandwidth of 200G. VSX → Supports two devices per stack, individual ISL links up to 400G.Not seeing any mistakes in that mapping. Easy to mix up VSF/VSX on bandwidth but this matches Aruba docs.

Correct Answer:

Answer Areas Supports up to 10 devices per stack: A. VSF Supports two devices per stack: B. VSX Individual ISL links up to 400G are supported: B. VSX Individual ISL links up to 50G are supported: A. VSF A maximum aggregate ISL bandwidth of 200G is supported: A. VSF

Explanation

VSF (Virtual Switching Framework) is a front-plane stacking technology used primarily in the access and aggregation layers (e.g., Aruba CX 6300 series).

Stack Size: It supports stacking up to 10 member switches (specifically on the CX 6300).
Bandwidth: The CX 6300 allows the use of SFP56 ports for VSF links. These ports support speeds up to 50G individually. With up to 4 ports configured for stacking, the maximum aggregate stacking bandwidth is 200 Gbps (unidirectional) or quoted as 400 Gbps bidirectional in some marketing, but the "200G" and "50G" figures specifically define the VSF limits in this context.

VSX (Virtual Switching Extension) is a high-availability clustering technology used in the core and data center (e.g., Aruba CX 6400, 8325, 9300).

Cluster Size: VSX always pairs exactly two devices (peers) to form a cluster with synchronized control planes.
Bandwidth: VSX uses standard Ethernet links for the Inter-Switch Link (ISL). On high-end platforms like the Aruba CX 9300, which features native 400G ports, an individual ISL link can operate at 400G.

References

HPE Aruba Networking, "Aruba CX 6300 Switch Series Data Sheet," Performance and Power, (Confirming VSF stacking up to 10 members and 50G/200G bandwidth limits).

Quote: "VSF allows for stacking of up to 10 switches... Four built-in uplinks support speeds of up to 10, 25, 50, and 100 GbE for a total of 200 to 400 Gbps of stacking throughput."

HPE Aruba Networking, "AOS-CX 10.07 Virtual Switching Framework (VSF) Guide," Chapter 1, Introduction.

Quote: "6300: VSF allows stacks to be formed... Up to 10 member switches will be allowed. Connections between the switches must use 10G, 25G, or 50G links."

HPE Aruba Networking, "AOS-CX 10.10 Virtual Switching Extension (VSX) Guide," VSX Overview.

Quote: "VSX binds two AOS-CX switches of the same model type to operate as one device for layer 2."

HPE Aruba Networking, "Aruba CX 9300 Switch Series Data Sheet."

Context: Verifies support for 400G interfaces on VSX-capable Data Center switches, enabling 400G ISL links.

Q: 18

How is Dynamic Multicast Optimization (DMO) implemented in an HPE Aruba wireless network? DMO is configured individually tor each SSID in use in the network. The AP uses OOS to provide equal air time for multicast traffic, DMO is configured globally for each SSID in use in the network. The controller converts multicast streams into unicast streams.

Your Answer

3 comments in the community discussion

Anita H. 5

Makes sense, it's set per SSID and the controller handles unicast conversion.

Chris T. 2

Nah, it's not a global setting. Configured per SSID and the controller turns multicast into unicast. Some confuse it with AP-level settings.

Q: 19

When configuring UBT on a switch what will happen when a gateway role is not specified?

Options

2 comments in the community discussion

Emma 2

Sean B.

Probably A, but does the question specify if there’s a deny-all fallback configured on the switch? If so, that might change it to C. The keyword here is what the default behavior is without a custom role set.

Correct Answer:

Explanation

In an Aruba User-Based Tunneling (UBT) environment, the switch relies on an authentication server (e.g., ClearPass) to provide the Aruba-User-Role attribute for an authenticated client. This attribute specifies the role to be applied by the gateway (Mobility Controller). If the authentication server successfully authenticates a client but fails to return this specific gateway role, the switch cannot establish the tunnel for that client. The switch's default fallback behavior in this scenario is to place the client on the port's configured access VLAN and forward its traffic locally, as if it were a standard, non-tunneled client.

Why Incorrect

B. The gateway will assign a default role to the client.

This is incorrect because the premise is that the gateway did not receive a role; therefore, it cannot take any action, including assigning a default one.

C. The switch will assign the default deny role to the client.

This is incorrect. The switch's default action is to revert to local forwarding on the access VLAN, not to apply a specific named "deny role".

D. The gateway will send back the deny role to the client.

This is incorrect as it contradicts the question's scenario where the gateway does not specify any role for the client.

References

1. ArubaOS-Switch Advanced Traffic Management Guide K.16.03

Chapter 7: "Per-User Tunneled Node"

Page 161

"Operation notes": "If the authentication server does not return a gateway role for an authenticated client

the switch places the client in the access VLAN and forwards its traffic locally."

2. ArubaOS-Switch Access Security Guide for 16.10

Chapter 11: "Tunneled Node"

Page 301

"RADIUS attributes for tunneled node": This section details the necessity of the Aruba-User-Role Vendor-Specific Attribute (VSA) for the gateway to assign a policy. Its absence leads to the failure condition described in the question.

Q: 20

You are doing tests in your lab and with the following equipment specifications • AP1 has a radio that generates a 10 dBm signal • AP2 has a radio that generates a 11 dBm signal • AP1 has an antenna with a gain of 9 dBi • AP2 has an antenna with a gain of 12 dBi. • The antenna cable for AP1 has a 2 dB loss • The antenna cable for AP2 has a 3 dB loss What would be the calculated Equivalent Isotropic Radiated Power (EIRP) for APT?

Options

8 comments in the community discussion

Sean Y. 7

Option C similar question came up in practice labs. Official guide has good EIRP calculation examples.

Piya M. 1

C , because for AP1 you just add up the radio power (10 dBm) and antenna gain (9 dBi) then subtract cable loss (2 dB), so 10 + 9 - 2 = 17 dBm. Pretty sure that's the EIRP formula, correct me if I missed something.

Correct Answer:

Explanation

Equivalent Isotropic Radiated Power (EIRP) is the total power radiated from a theoretical isotropic antenna. It is calculated by adding the transmitter power to the antenna gain and subtracting any signal loss that occurs in the transmission line (e.g., antenna cable).

The formula is:

EIRP = Transmitter Power (dBm) + Antenna Gain (dBi) – Cable Loss (dB)

For AP1, the values are:

Transmitter Power = 10 dBm

Antenna Gain = 9 dBi

Cable Loss = 2 dB

Calculation: EIRP = 10 dBm + 9 dBi - 2 dB = 17 dBm.

Why Incorrect

A. 26 dBm: This value is an incorrect calculation and does not correspond to the specifications provided for either AP1 or AP2.

B. 30 dBm: This is a common regulatory EIRP limit in some regions (e.g., for UNII-1 and UNII-3 bands in the US), not the calculated value for AP1's specific hardware.

D. -12 dBm: This result would be derived from an incorrect application of the EIRP formula, such as improperly subtracting gain or adding loss.

References

1. Aruba Networks

an HPE Company. ArubaOS 8.6.0.0 User Guide. (2019). In the section on RF Management (ARM)

the concept of EIRP is discussed as the basis for power level management. The guide implicitly uses the standard formula (Transmit Power + Antenna Gain - Cable Loss) to determine the final radiated power. See Chapter: "RF Management (ARM)"

Section: "Power Management".

2. HPE Press. Aruba Certified Mobility Associate (ACMA) Official Certification Study Guide. (2020). The guide covers fundamental RF concepts

including the calculation of EIRP. Chapter 2

"RF Fundamentals

" details the components of an RF system and explains how to calculate link budgets and radiated power using dBm

dBi

and dB loss values. The formula EIRP = Tx Power + Antenna Gain – Cable Loss is a core concept presented.

3. David D. Coleman

David A. Westcott. CWNA Certified Wireless Network Administrator Study Guide

5th Edition. (Sybex

2018). While a general industry certification guide

its principles are foundational to vendor-specific exams like HPE7-A01. Chapter 4

"Radio Frequency Fundamentals

" page 121

explicitly defines the EIRP calculation as: "Transmitter Power (in dBm) – Cable Loss (in dB) + Antenna Gain (in dBi) = EIRP (in dBm)".

Question 1 of 20

Premium Access Includes

More HP Practice Tests