I85PREP
⌘ K
Aruba CX 10000 Advanced study materials
Aruba CX 10000 Advanced study resources

Aruba CX 10000 Advanced practice questions

One question at a time. Build your Aruba CX 10000 Advanced understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1CX 10000 architecture and hardware platform

The Aruba CX 10000 switch is best described as which type of platform?

  1. A distributed services switch with a programmable DPU per port group Correct answer.
  2. A wireless controller appliance with integrated access point management
  3. A fixed-configuration top-of-rack switch with no programmable data plane
  4. A chassis-based modular core switch with fabric modules

Explanation

The CX 10000 combines a high-density Ethernet switch ASIC with programmable DPU processing to deliver stateful services inline at the network edge. This distributed-services design is what distinguishes it from ordinary ToR switches.

Question 2CX 10000 architecture and hardware platform

Which processing element in the CX 10000 provides the programmable data plane used for stateful services?

  1. The management CPU complex
  2. The power supply microcontroller
  3. The DPU (Pensando Elba-class processing) Correct answer.
  4. The fan tray controller

Explanation

Stateful inline services on the CX 10000 are handled by programmable DPUs rather than the general-purpose management CPU. The DPU is the engine that enables firewall, telemetry, and similar functions in the data path.

Question 3CX 10000 architecture and hardware platform

What is the primary benefit of distributing stateful services to every CX 10000 at the network edge?

  1. It removes the need for any routing protocol configuration
  2. It guarantees line-rate encryption on all uplinks
  3. It avoids hairpinning traffic to a centralized appliance for inspection Correct answer.
  4. It eliminates the requirement for switch stacking

Explanation

Placing services inline at each edge switch means traffic is inspected where it enters the fabric instead of being redirected to a central appliance. This distributed model reduces latency and removes hairpin bottlenecks.

Question 4CX 10000 architecture and hardware platform

In the CX 10000 data path, how does traffic typically reach the DPU for stateful inspection?

  1. The management CPU proxies every packet through software before transmission
  2. The DPU replaces the switch ASIC and forwards all packets in software
  3. The switch ASIC steers selected flows to the DPU and receives them back for forwarding Correct answer.
  4. The DPU mirrors all traffic to a remote collector before the ASIC forwards it

Explanation

The switch ASIC remains the primary forwarding engine and redirects flows that require services to the DPU. After processing, packets return to the ASIC for normal forwarding.

Question 5CX 10000 architecture and hardware platform

Which Aruba OS-CX capability allows the CX 10000 to host containerized network functions on the DPU?

  1. Loop protection
  2. VSF stacking
  3. The Pensando Distributed Services Card software stack Correct answer.
  4. Smart Link redundancy

Explanation

The DPU runs a software stack that supports hosting and orchestrating containerized services. This is what allows functions to be deployed and managed on the switch itself.

Question 6CX 10000 architecture and hardware platform

A design team wants consistent policy enforcement for workloads regardless of which rack they reside in. Which CX 10000 characteristic most directly supports this?

  1. A distributed policy model applied at each edge switch Correct answer.
  2. A single centralized policy engine in the core
  3. Policy enforcement only on northbound uplinks
  4. Per-switch local policy that is never shared

Explanation

Because each CX 10000 enforces policy locally at the edge, workloads receive consistent treatment wherever they are attached. This distributed enforcement is the core value of the platform.

Question 7CX 10000 architecture and hardware platform

Which statement accurately describes the physical form factor of the CX 10000 series switch?

  1. A blade module installed only in an Aruba chassis
  2. A 4U chassis with hot-swappable line cards
  3. A 2U appliance with no front-panel data ports
  4. A 1U fixed switch designed for data center racks Correct answer.

Explanation

The CX 10000 is a 1U fixed-configuration data center switch. It is not a chassis or blade product.

Question 8CX 10000 architecture and hardware platform

What role does the Aruba Fabric Composer play in a CX 10000 deployment?

  1. It acts as a DHCP relay for management addresses only
  2. It replaces the DPU with a software-only forwarding engine
  3. It provides centralized orchestration and configuration of the fabric and its services Correct answer.
  4. It compiles switch firmware images from source code

Explanation

Fabric Composer is a management and orchestration layer that automates fabric and service configuration across switches. It does not perform packet forwarding or firmware compilation.

Question 9CX 10000 architecture and hardware platform

Which pairing correctly matches a CX 10000 capability with its functional layer?

  1. Inline telemetry generation - DPU service layer Correct answer.
  2. Spanning tree calculation - DPU service layer
  3. Fabric orchestration - DPU data plane
  4. Stateful firewall inspection - switch ASIC forwarding layer

Explanation

Telemetry and stateful services are generated in the programmable DPU service layer. Forwarding and control-plane protocols such as spanning tree belong to the switch ASIC and CPU.

Question 10CX 10000 architecture and hardware platform

Why does placing inspection at the first-hop switch reduce latency compared with a central firewall model?

  1. It disables routing so packets travel fewer hops
  2. It shortens the path by processing traffic before it crosses the fabric Correct answer.
  3. It increases the number of hops traffic must traverse
  4. It compresses packets to reduce transmission time

Explanation

Inline edge processing inspects traffic at the point of ingress, so packets avoid an extra round trip to a central appliance. Fewer traversed segments translate directly into lower latency.

Question 11CX 10000 architecture and hardware platform

Which Aruba OS-CX feature provides a high-availability option for pairing CX 10000 switches at the access layer?

  1. OSPFv3
  2. PIM-SM
  3. VSX (Virtual Switching Extension) Correct answer.
  4. BGP route reflection

Explanation

VSX pairs two switches so they present a resilient, coordinated access layer with independent control planes. The other options are routing or multicast protocols, not high-availability pairing mechanisms.

Question 12CX 10000 architecture and hardware platform

A CX 10000 is deployed as a leaf in an EVPN-VXLAN fabric. What is its typical role regarding services?

  1. It only forwards traffic and cannot host services
  2. It terminates all VXLAN tunnels in the fabric
  3. It acts as a route reflector for the entire fabric
  4. It enforces policy and delivers services inline for locally attached hosts Correct answer.

Explanation

As a leaf, the CX 10000 provides first-hop services and policy enforcement for the workloads attached to it. Route reflection and tunnel termination at scale are handled elsewhere in the fabric.

Question 13CX 10000 architecture and hardware platform

What does the term 'stateful' imply about the services running on the CX 10000 DPU?

  1. The switch retains configuration across reboots
  2. The switch maintains a single global forwarding table
  3. The service tracks connection context such as sessions and flows Correct answer.
  4. The DPU stores packets indefinitely for later replay

Explanation

Stateful services maintain per-connection context, enabling decisions based on session history rather than isolated packets. This is what allows functions like firewalling to work correctly.

Question 14CX 10000 architecture and hardware platform

Which consideration most affects throughput planning when enabling inline services on a CX 10000?

  1. The length of the console cable
  2. The number of configured VLANs only
  3. The capacity of the DPU relative to the volume of steered traffic Correct answer.
  4. The color of the front-panel LEDs

Explanation

Traffic that requires services is steered to the DPU, so its processing capacity bounds service throughput. Planning must account for how much traffic will be redirected.

Question 15CX 10000 architecture and hardware platform

Which Aruba OS-CX telemetry approach lets the CX 10000 export granular flow and service data to external collectors?

  1. RADIUS accounting
  2. Streaming telemetry Correct answer.
  3. SNMP polling only
  4. Syslog at debug level

Explanation

Streaming telemetry pushes structured data to collectors at high frequency, which suits the granular visibility the platform provides. SNMP, syslog, and RADIUS are not designed for high-rate structured telemetry.

Question 16CX 10000 architecture and hardware platform

How does the CX 10000's distributed services model change the placement of security policy relative to a traditional data center?

  1. Policy moves from a central choke point to the workload edge Correct answer.
  2. Policy is applied only at the internet gateway
  3. Policy is removed entirely because switches are trusted
  4. Policy is consolidated onto a single spine switch

Explanation

Distributed services shift enforcement from a centralized appliance to the edge switches where workloads connect. This reduces choke points and scales enforcement with the fabric.

Question 17CX 10000 architecture and hardware platform

Which statement about the relationship between the switch ASIC and the DPU on the CX 10000 is accurate?

  1. The DPU manages the ASIC's forwarding tables
  2. The ASIC is disabled when the DPU is active
  3. The DPU forwards all traffic and the ASIC only handles management
  4. The ASIC and DPU operate independently with the ASIC steering service-bound flows Correct answer.

Explanation

The ASIC performs high-speed forwarding while the DPU handles programmable services, and the ASIC steers flows that need service processing. They are complementary rather than one controlling the other.

Question 18CX 10000 architecture and hardware platform

What is a key operational advantage of inline distributed services over traditional traffic redirection to a service appliance?

  1. It keeps traffic on its natural path and avoids tromboning Correct answer.
  2. It eliminates the need for redundancy
  3. It removes the need for IP addressing
  4. It requires no network configuration at all

Explanation

Inline services process traffic as it passes through the switch, so packets do not detour to a separate appliance and back. This avoids the asymmetric 'tromboning' path and its associated latency.

Question 19CX 10000 architecture and hardware platform

Which deployment scenario best illustrates where a CX 10000 provides the most value?

  1. A remote site with no local servers
  2. A home office with a single laptop
  3. A data center rack hosting multi-tenant workloads requiring per-workload policy Correct answer.
  4. A small branch office with a handful of endpoints

Explanation

The platform targets data center environments where many workloads need consistent, scalable policy enforcement at the edge. Small branch or home scenarios do not exploit its distributed service capabilities.

Question 20CX 10000 architecture and hardware platform

When the CX 10000 is managed through Aruba Central, what is the primary benefit for a multi-site deployment?

  1. Cloud-based centralized visibility and configuration management across sites Correct answer.
  2. Automatic replacement of the DPU with cloud processing
  3. Removal of all local forwarding decisions
  4. Elimination of the need for local switching hardware

Explanation

Central provides a cloud management plane for consistent configuration and monitoring across many sites. It does not move data-plane functions to the cloud or remove local hardware.

Question 21CX 10000 architecture and hardware platform

Which statement correctly describes how services scale in a CX 10000 fabric as more racks are added?

  1. Service capacity stays fixed because it is centralized
  2. Service capacity depends only on the number of uplinks
  3. Service capacity decreases as more switches are added
  4. Service capacity grows with each added edge switch that hosts a DPU Correct answer.

Explanation

Because each CX 10000 carries its own DPU, adding edge switches adds service processing capacity along with them. This horizontal scaling is a central design advantage.

Question 22CX 10000 architecture and hardware platform

Which Aruba OS-CX feature would an administrator use to define which traffic is redirected to the DPU for inspection?

  1. DHCP snooping trust
  2. NTP authentication
  3. LLDP neighbor advertisement
  4. Classifier policies and policy-based redirection Correct answer.

Explanation

Classifier policies match traffic and apply actions such as redirecting selected flows to a service. The other options are supporting protocols with no traffic-steering role.

Question 23CX 10000 architecture and hardware platform

What distinguishes the CX 10000 from a conventional leaf switch in terms of its hardware complement?

  1. It integrates programmable DPUs alongside the switch ASIC Correct answer.
  2. It includes a built-in wireless radio
  3. It uses only software forwarding on a general CPU
  4. It relies on an external service chassis for all functions

Explanation

The defining hardware difference is the inclusion of programmable DPUs that provide inline services. Conventional leaf switches forward packets without this service-processing element.

Question 24CX 10000 architecture and hardware platform

A customer requires east-west traffic between two hosts on the same CX 10000 to be inspected. What is the most direct way to achieve this?

  1. Apply a classifier policy that redirects the local flows to the DPU Correct answer.
  2. Enable spanning tree on the host VLAN
  3. Send the traffic to a core firewall and back
  4. Disable local switching so all traffic is routed

Explanation

Local east-west flows can be steered to the on-switch DPU using classifier policies, keeping inspection inline. Sending traffic to a core firewall would reintroduce hairpinning.

Question 25AOS-CX fundamentals and configuration management

On an Aruba CX switch, which command saves the running configuration to the startup configuration so it persists across a reboot?

  1. copy running-config startup-config Correct answer.
  2. write memory
  3. commit apply
  4. archive save

Explanation

AOS-CX uses the copy running-config startup-config command (also available as write memory in some contexts) to persist the active configuration to the startup database. The configuration model in AOS-CX separates running, startup, and checkpointed configurations.

Question 26AOS-CX fundamentals and configuration management

Which AOS-CX feature creates a named, point-in-time snapshot of the running configuration that can later be restored?

  1. Rollback
  2. Snapshot
  3. Baseline
  4. Checkpoint Correct answer.

Explanation

AOS-CX checkpoints capture the current running configuration under a named identifier and can be compared against or copied back later. Checkpoints are distinct from the startup configuration and are managed with the checkpoint commands.

Question 27AOS-CX fundamentals and configuration management

An administrator wants to compare the running configuration against a previously created checkpoint named pre-change. Which command performs this comparison?

  1. compare config pre-change
  2. show running-config vs pre-change
  3. show checkpoint diff pre-change Correct answer.
  4. diff checkpoint pre-change

Explanation

The show checkpoint diff <name> command displays the differences between the named checkpoint and the current running configuration. This is used to audit changes made since the checkpoint was taken.

Question 28AOS-CX fundamentals and configuration management

Which AOS-CX command displays the switch's current configuration in the active CLI context, excluding defaults?

  1. show startup-config
  2. show config all
  3. show defaults
  4. show running-config Correct answer.

Explanation

show running-config displays the active configuration as currently applied, omitting default values. Startup configuration reflects what will load on next boot and is shown separately.

Question 29AOS-CX fundamentals and configuration management

Which AOS-CX command enables the REST API and its associated web interface on the management interface?

  1. https-server enable rest
  2. web-management enable
  3. rest enable
  4. https-server rest access-mode read-write Correct answer.

Explanation

In AOS-CX, the https-server rest access-mode command enables the REST API with the specified access mode (read-only or read-write). The HTTPS server must be enabled for the REST interface to be reachable.

Question 30AOS-CX fundamentals and configuration management

Which protocol does AOS-CX use for centralized configuration and image management with Aruba Central?

  1. Aruba Central cloud management via the central CLI
  2. Aruba Activate Correct answer.
  3. TFTP
  4. SNMPv3 only

Explanation

AOS-CX switches can be onboarded to Aruba Central for cloud-based configuration and firmware management, using the Aruba Activate service for initial provisioning. This provides centralized management across the fleet.

Question 31AOS-CX fundamentals and configuration management

Which AOS-CX command creates a checkpoint named before-upgrade?

  1. checkpoint create before-upgrade Correct answer.
  2. checkpoint save before-upgrade
  3. copy running-config checkpoint before-upgrade
  4. archive checkpoint before-upgrade

Explanation

The checkpoint create <name> command captures the current running configuration as a named checkpoint. It can be referenced later for rollback or comparison.

Question 32AOS-CX fundamentals and configuration management

What is the default behavior of the AOS-CX CLI when an administrator types an ambiguous command prefix?

  1. The switch rejects the command with an error
  2. The switch enters configuration mode
  3. The switch displays the possible completions Correct answer.
  4. The switch executes the first matching command

Explanation

AOS-CX provides context-sensitive help; pressing Tab or ? after an ambiguous prefix lists the possible completions. This helps administrators discover valid command syntax without guessing.

Question 33AOS-CX fundamentals and configuration management

Which CLI context must an administrator enter to configure a VLAN on an Aruba CX 10000 switch?

  1. Interface context
  2. Global configuration context Correct answer.
  3. Router context
  4. VLAN context

Explanation

VLANs are created from the global configuration context using the vlan command, then interfaces are assigned to the VLAN. The VLAN itself is defined at global configuration level.

Question 34AOS-CX fundamentals and configuration management

Which command displays the AOS-CX software version currently running on the switch?

  1. show software
  2. show version Correct answer.
  3. show system
  4. show image

Explanation

show version displays the running software version, build, and hardware information. It is the standard command for verifying the current firmware.

Question 35AOS-CX fundamentals and configuration management

An administrator wants to back up the running configuration to a TFTP server. Which command accomplishes this?

  1. copy running-config tftp://192.0.2.10/backup.cfg Correct answer.
  2. backup running-config tftp 192.0.2.10
  3. save config tftp://192.0.2.10/backup.cfg
  4. export config tftp 192.0.2.10

Explanation

AOS-CX uses the copy command with a URL-style destination to transfer the running configuration to a remote server. Supported protocols include TFTP, SFTP, and SCP.

Question 36AOS-CX fundamentals and configuration management

Which AOS-CX feature allows an administrator to apply configuration changes at a scheduled time in the future?

  1. Scheduled configuration via the config-scheduler Correct answer.
  2. Time-range ACLs
  3. Checkpoint scheduling
  4. Cron jobs

Explanation

AOS-CX supports scheduled configuration using the config-scheduler feature, which allows commands to be applied at a defined future time. This is useful for maintenance windows.

Question 37AOS-CX fundamentals and configuration management

Which command restores a checkpoint named pre-change to the running configuration?

  1. checkpoint rollback pre-change
  2. apply checkpoint pre-change
  3. copy checkpoint pre-change running-config Correct answer.
  4. restore checkpoint pre-change

Explanation

The copy checkpoint <name> running-config command restores the named checkpoint's contents into the running configuration. This is the documented AOS-CX method for checkpoint rollback.

Question 38AOS-CX fundamentals and configuration management

What is the purpose of the AOS-CX 'archive' feature?

  1. To automatically save configuration backups based on a schedule or trigger Correct answer.
  2. To encrypt the startup configuration
  3. To export firmware images to a remote server
  4. To compress log files for long-term retention

Explanation

The AOS-CX configuration archive feature automatically saves copies of the running configuration to a local or remote destination based on configured triggers or schedules. This provides versioned configuration history.

Question 39AOS-CX fundamentals and configuration management

Which command displays the AOS-CX switch's management interface IP configuration?

  1. show mgmt ip
  2. show interface mgmt Correct answer.
  3. show ip mgmt interface
  4. show ip interface mgmt

Explanation

The management interface in AOS-CX is displayed with show interface mgmt, which shows the assigned IP address, mask, and status. This is distinct from data-plane interface commands.

Question 40AOS-CX fundamentals and configuration management

An administrator needs to verify which user roles are configured for local authentication. Which command displays the configured users and their roles?

  1. show local-users
  2. show running-config | include user
  3. show user Correct answer.
  4. show authentication users

Explanation

The show user command lists local users and their assigned roles on AOS-CX. Role-based access control determines which CLI contexts and commands each user can access.

Question 41AOS-CX fundamentals and configuration management

Which AOS-CX role provides full read-write access to all CLI contexts and commands?

  1. operators
  2. auditors
  3. administrators Correct answer.
  4. read-only

Explanation

The administrators role grants full read-write access across all contexts. The operators role allows limited configuration, and auditors have read-only access to configuration and logs.

Question 42AOS-CX fundamentals and configuration management

Which command on AOS-CX enables the NETCONF over SSH server for programmatic configuration?

  1. ssh netconf enable
  2. enable netconf
  3. netconf-server enable Correct answer.
  4. netconf ssh enable

Explanation

AOS-CX enables NETCONF via the netconf-server enable command in global configuration. NETCONF provides a standards-based programmatic interface for configuration management.

Question 43AOS-CX fundamentals and configuration management

What does the AOS-CX command 'show running-config all' display that 'show running-config' does not?

  1. Only the startup configuration
  2. Configuration values including those set to their defaults Correct answer.
  3. Only interface configurations
  4. Only security-related configuration

Explanation

show running-config all includes default values in addition to explicitly configured ones, which is useful for auditing effective settings. The standard show running-config omits defaults.

Question 44AOS-CX fundamentals and configuration management

Which AOS-CX command sequence correctly enters interface context for port 1/1/1 and assigns it to VLAN 10 as an access port?

  1. interface 1/1/1 then switchport access vlan 10 Correct answer.
  2. interface vlan 10 then assign 1/1/1
  3. vlan 10 then interface 1/1/1
  4. interface 1/1/1 then vlan access 10

Explanation

On AOS-CX, the interface context uses switchport access vlan <id> to assign an access VLAN to a physical port. The port must be in interface context first.

Question 45AOS-CX fundamentals and configuration management

Which AOS-CX command shows the configuration differences between the running configuration and the startup configuration?

  1. show config diff Correct answer.
  2. show startup-config diff
  3. diff running startup
  4. show running-config diff startup-config

Explanation

The show config diff command compares the running configuration with the startup configuration, highlighting unsaved changes. This helps ensure changes are persisted before a reboot.

Question 46AOS-CX fundamentals and configuration management

Which statement best describes the AOS-CX configuration model regarding candidate configurations?

  1. Changes are only applied during a maintenance window
  2. Changes are staged in a candidate configuration until explicitly committed
  3. Changes apply immediately to the running configuration as commands are entered Correct answer.
  4. Changes require a reboot to take effect

Explanation

AOS-CX applies configuration commands immediately to the running configuration as they are entered, without a separate candidate/commit step. Persistence to startup requires an explicit save.

Question 47AOS-CX fundamentals and configuration management

Which AOS-CX command enables SSH server access for remote CLI management?

  1. enable ssh
  2. management ssh enable
  3. ssh-server enable
  4. ssh server vrf mgmt Correct answer.

Explanation

On AOS-CX, the ssh server vrf <vrf> command enables the SSH server in the specified VRF, typically mgmt for management access. This is required for secure remote CLI sessions.

Question 48AOS-CX fundamentals and configuration management

An administrator restores a checkpoint but the change is not desired. Which action reverts the switch to the configuration that was active before the restore?

  1. Run show config diff to revert
  2. Reboot the switch without saving
  3. Delete the checkpoint and reload
  4. Restore the checkpoint taken immediately before the restore Correct answer.

Explanation

Because restoring a checkpoint overwrites the running configuration, the safest way to undo it is to restore a checkpoint captured just before the restore. Reverting is not automatic.

Question 49Layer 2 and Layer 3 networking on CX 10000

On an Aruba CX 10000 switch, which interface type is used to configure a Layer 2 VLAN interface for management or in-band access?

  1. A physical routed port
  2. A LAG member port
  3. A loopback interface
  4. A VLAN interface (SVI) Correct answer.

Explanation

Layer 2 VLANs on CX 10000 are given IP reachability through a VLAN interface (SVI), created in VLAN context. Loopbacks and routed ports serve Layer 3 purposes, and LAG members are link aggregation, not IP interfaces.

Question 50Layer 2 and Layer 3 networking on CX 10000

Which command creates a Layer 2 VLAN with ID 20 and then places it into the VLAN database on an Aruba CX switch?

  1. interface vlan 20
  2. vlan 20 Correct answer.
  3. ip vlan 20
  4. switchport access vlan 20

Explanation

The global 'vlan <id>' command creates the VLAN in the VLAN database. The interface-level 'vlan' form (access/trunk) assigns ports, and 'interface vlan' creates the SVI rather than the VLAN itself.