I85PREP
⌘ K
Aruba Campus Access Architect (HPE7-A11) study materials
Aruba Campus Access Architect (HPE7-A11) study resources

Aruba Campus Access Architect (HPE7-A11) practice questions

One question at a time. Build your Aruba Campus Access Architect (HPE7-A11) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Architecture and Design

In a large campus design, which Aruba capability centralizes policy enforcement for wired and wireless clients while forwarding user traffic locally at the access layer?

  1. Gateway-clustered tunnel mode with all client traffic hairpinned to the gateway
  2. Per-SSID VLANs mapped directly to Layer 2 trunks without any policy layer
  3. Static ACLs applied only on the core uplink ports of each closet switch
  4. Role-based access control enforced at the access switch and AP with centralized policy definition Correct answer.

Explanation

Aruba's architecture separates the control plane (policy and role definition, typically via a mobility controller or central management) from the data plane, allowing roles and policies to be enforced at the access device while traffic is forwarded locally. This preserves policy consistency across wired and wireless without forcing all traffic through a central chokepoint.

Question 2Architecture and Design

Which Aruba solution is designed to provide unified wired and wireless management from a single cloud-hosted platform?

  1. Aruba AirWave
  2. Aruba Central Correct answer.
  3. Aruba Instant On
  4. Aruba ClearPass

Explanation

Aruba Central is the cloud-based management platform that provides unified monitoring, configuration, and assurance for Aruba access points, switches, and gateways. AirWave is an on-premises legacy management product, ClearPass is policy management, and Instant On targets small business.

Question 3Architecture and Design

A designer needs a single sign-on experience where users authenticate once and receive consistent role assignments on both wired and wireless networks. Which Aruba component is the primary policy decision point?

  1. ClearPass Policy Manager Correct answer.
  2. The mobility gateway
  3. The access switch
  4. The AP's local user database

Explanation

ClearPass Policy Manager acts as the centralized policy engine that authenticates users and devices and returns role and authorization attributes used by both wired and wireless enforcement points. Gateways and switches enforce the decisions, but ClearPass makes them.

Question 4Architecture and Design

When designing a campus for high availability, what is the purpose of an Aruba mobility gateway cluster?

  1. It replaces the need for redundant core switches
  2. It synchronizes switch firmware versions across the campus
  3. It provides stateful failover and seamless roaming for clients across member gateways Correct answer.
  4. It load-balances DHCP requests across all access switches

Explanation

A mobility gateway cluster shares client state among members so that if one gateway fails, sessions survive and clients continue to be served by another member. This delivers stateful redundancy and supports seamless roaming in tunneled designs.

Question 5Architecture and Design

Which design choice best supports Power over Ethernet budgeting for a closet that will host 802.3bt access points and IP cameras?

  1. Rely on midspan injectors for every device
  2. Select switches with sufficient per-port and total PoE budget and verify LLDP power negotiation Correct answer.
  3. Assume the standard 15.4 W per port is always adequate
  4. Disable PoE on uplink ports to save budget

Explanation

PoE design requires checking both per-port class capability (802.3bt delivers up to 90 W) and the switch's aggregate power budget, and confirming that power negotiation via LLDP works with the endpoints. Underestimating either dimension leads to devices failing to power up.

Question 6Architecture and Design

What is the primary role of a Virtual Mobility Controller (VMC) in an Aruba gateway-less campus design?

  1. It forwards all client data traffic through the cloud
  2. It replaces ClearPass for authentication
  3. It provides only wireless RF spectrum analysis
  4. It runs control-plane functions such as AP termination and client state on Aruba switches or gateways Correct answer.

Explanation

The VMC runs the controller control plane-AP termination, client state, and roaming coordination-on supported Aruba infrastructure, allowing a gateway-less architecture where data is forwarded locally. It does not forward user data itself.

Question 7Architecture and Design

A campus requires that guest wireless traffic never reach internal corporate VLANs. Which design approach enforces this most directly?

  1. Place guests on the same VLAN as employees but apply a QoS rule
  2. Use WPA3-Enterprise for guest users
  3. Enable broadcast filtering on the guest SSID
  4. Assign guests to a dedicated role with a policy that permits only Internet-bound traffic Correct answer.

Explanation

Role-based policy is the standard mechanism for guest isolation: a distinct guest role with rules that deny internal subnets and permit only Internet access enforces segmentation regardless of VLAN topology. QoS, encryption type, and broadcast filtering do not provide the required isolation.

Question 8Architecture and Design

Which statement correctly describes the relationship between ArubaOS 8 and ArubaOS-CX in a campus architecture?

  1. Both are switch-only operating systems
  2. ArubaOS 8 runs on mobility gateways and controllers, while AOS-CX runs on Aruba switches Correct answer.
  3. ArubaOS 8 is the cloud management portal for AOS-CX
  4. ArubaOS 8 runs on access switches, while AOS-CX runs on gateways

Explanation

ArubaOS 8 is the control-plane software for mobility controllers and gateways, whereas AOS-CX is the operating system for Aruba's modern switch portfolio. They are complementary layers in a campus design, not interchangeable.

Question 9Architecture and Design

A designer plans a large Layer 2 access domain. Which consideration most strongly argues for introducing Layer 3 segmentation at the distribution layer?

  1. Eliminating the need for VLANs entirely
  2. Guaranteeing zero packet loss during reconvergence
  3. Removing the requirement for spanning tree on access ports
  4. Reducing broadcast domain size and containing failure domains Correct answer.

Explanation

Extending a single Layer 2 domain across a large campus enlarges broadcast and failure domains and increases spanning-tree convergence scope. Routing at distribution creates smaller broadcast domains and bounds failures.

Question 10Architecture and Design

Which Aruba feature allows an AP to forward client traffic locally onto a VLAN at the access switch without tunneling it to a gateway?

  1. Tunnel mode
  2. Split-tunnel mode
  3. Bridge mode Correct answer.
  4. Dynamic segmentation

Explanation

In bridge (local) mode the AP forwards client traffic directly onto the local wired network, typically tagged to a VLAN on the access switch, avoiding a tunnel to a gateway. Tunnel mode sends traffic to the gateway, and dynamic segmentation applies role-based tunneling on switches.

Question 11Architecture and Design

What is the main design benefit of Aruba dynamic segmentation on access switches?

  1. It doubles the wireless throughput of each AP
  2. It converts all switch ports to trunk ports
  3. It assigns a role-based tunnel or local VLAN per client based on ClearPass authorization Correct answer.
  4. It removes the need for any authentication server

Explanation

Dynamic segmentation uses role information from ClearPass to decide, per client, whether traffic is forwarded locally or tunneled to a gateway, enabling consistent policy across wired and wireless. It does not change throughput or eliminate authentication.

Question 12Architecture and Design

A campus must support seamless roaming for voice clients across buildings. Which combination best supports this requirement?

  1. Disabling 802.11k and 802.11v to reduce overhead
  2. Placing each AP on a different VLAN
  3. Separate SSIDs per building with different security settings
  4. Overlapping RF coverage with consistent SSID/security and fast roaming (802.11r) enabled Correct answer.

Explanation

Seamless roaming depends on continuous RF coverage, identical SSID and security configuration, and fast transition mechanisms such as 802.11r so reauthentication does not disrupt voice. Inconsistent settings or coverage gaps break roaming.

Question 13Architecture and Design

Which statement best describes the purpose of a role in Aruba's role-based access control model?

  1. It is the physical switch port to which a client connects
  2. It is the RF channel assigned to an AP
  3. It is the DHCP scope used by a VLAN
  4. It is a named set of policy rules applied to a client after authentication Correct answer.

Explanation

A role is assigned after successful authentication and carries the set of permissions (ACLs, VLAN, QoS) that determine what the client can reach. Roles decouple policy from physical topology such as port or VLAN.

Question 14Architecture and Design

When sizing a wireless design for a high-density auditorium, which factor most directly determines the number of APs needed?

  1. The number of wired switch ports available
  2. The total square footage of the building only
  3. The campus Internet circuit capacity
  4. Expected concurrent clients and their per-client throughput requirement Correct answer.

Explanation

High-density design is driven by client count and per-client bandwidth, plus airtime and channel reuse, rather than raw area alone. Square footage matters for coverage, but capacity planning governs AP count in dense venues.

Question 15Architecture and Design

Which Aruba architecture component is responsible for terminating tunnels from APs and enforcing policy for tunneled clients?

  1. The AP radio
  2. The mobility gateway Correct answer.
  3. The core router
  4. The access switch

Explanation

The mobility gateway terminates AP tunnels and applies role-based policy to tunneled client traffic. Access switches and AP radios are enforcement points but not tunnel terminators in this model.

Question 16Architecture and Design

A design must ensure that a failed uplink does not cause a spanning-tree loop or a long outage. Which feature set is most appropriate on Aruba access switches?

  1. Rapid Spanning Tree or MSTP combined with loop protection and uplink failure detection Correct answer.
  2. Using only static MAC entries on all ports
  3. Disabling spanning tree entirely to speed convergence
  4. Relying on broadcast storms to reveal loops

Explanation

RSTP/MSTP provides fast convergence, and loop protection plus uplink failure detection prevent loops and speed failover. Disabling spanning tree risks broadcast storms, and static entries do not provide redundancy.

Question 17Architecture and Design

Which design principle best supports a scalable campus IP addressing plan?

  1. Summarizable address blocks allocated per building or distribution block Correct answer.
  2. A single flat /16 for all clients and devices
  3. Randomly assigned subnets per closet
  4. Using public addresses for all internal endpoints

Explanation

Allocating contiguous, summarizable blocks per building or distribution block enables route summarization and simplifies growth. Flat or random addressing prevents summarization and complicates troubleshooting.

Question 18Architecture and Design

A customer wants wired and wireless clients to receive the same firewall policy from a single source of truth. Which design element is essential?

  1. A single shared VLAN for all clients
  2. Disabling wired authentication to simplify management
  3. A unified policy engine such as ClearPass returning role attributes to both switch and gateway enforcement points Correct answer.
  4. Separate standalone ACLs maintained per switch and per gateway

Explanation

Consistent policy across wired and wireless requires a central policy source that returns role attributes consumed by each enforcement point. Per-device ACLs diverge over time and cannot guarantee parity.

Question 19Architecture and Design

What is the purpose of Aruba's AirMatch feature in a campus WLAN design?

  1. It load-balances DHCP across VLANs
  2. It automatically optimizes RF channel and power settings across APs Correct answer.
  3. It authenticates users against Active Directory
  4. It encrypts management traffic between switches

Explanation

AirMatch uses RF data to compute and apply channel and transmit-power plans across the AP fleet, reducing interference and manual tuning. Authentication, DHCP, and management encryption are handled by other components.

Question 20Architecture and Design

A campus design must survive the loss of a single distribution switch while maintaining client sessions. Which approach best achieves this?

  1. Spanning tree disabled to speed convergence
  2. Redundant distribution switches with gateway clustering or VRRP plus redundant uplinks Correct answer.
  3. A single high-capacity distribution switch with dual power supplies
  4. Stacking all access switches into one logical switch

Explanation

Surviving a distribution switch failure requires redundant distribution devices and redundant uplinks, with first-hop redundancy (VRRP) or gateway clustering preserving sessions. Dual power supplies protect against power failure but not device failure.

Question 21Architecture and Design

Which consideration is most important when deciding whether to tunnel wireless traffic to a gateway versus forward it locally?

  1. The number of SSIDs broadcast
  2. The switch firmware version
  3. Whether centralized policy inspection or local traffic breakout is required for the client population Correct answer.
  4. The color of the AP enclosures

Explanation

The tunnel-versus-local decision hinges on where policy must be enforced and whether traffic should break out locally for performance or regulatory reasons. Physical appearance, SSID count, and firmware version are not decision drivers.

Question 22Architecture and Design

In a campus design, what does the term 'underlay' refer to?

  1. The wireless security profile
  2. The physical and logical IP transport network that carries overlay or tunneled traffic Correct answer.
  3. The guest portal branding
  4. The AP mounting hardware

Explanation

The underlay is the routed and switched transport fabric that provides connectivity between devices; overlays and tunnels ride on top of it. Security profiles, portals, and hardware are unrelated to the term.

Question 23Architecture and Design

Which Aruba capability helps a designer validate that a proposed campus design meets coverage and capacity goals before deployment?

  1. Switch stacking
  2. ClearPass guest self-registration
  3. Predictive site survey and planning tools Correct answer.
  4. DHCP relay

Explanation

Predictive planning tools model RF propagation and client capacity from floor plans and AP placements, allowing validation before hardware is installed. The other options are unrelated to RF validation.

Question 24Architecture and Design

A design team wants to enforce that IoT devices can reach only their management server. Which mechanism most precisely implements this?

  1. An SSID with a hidden network name
  2. A VLAN that includes both IoT and user devices
  3. A role-based policy with explicit permit to the server and implicit deny elsewhere Correct answer.
  4. A QoS trust setting on the IoT ports

Explanation

Precise least-privilege control is achieved with a role or ACL that permits only the specific destination and denies everything else. Shared VLANs, QoS, and hidden SSIDs do not restrict reachability.

Question 25Architecture and Design

Which statement best captures why a campus design should separate management, control, and data planes conceptually?

  1. It eliminates the need for redundant hardware
  2. It removes the requirement for authentication
  3. It guarantees that wireless and wired use the same VLANs
  4. It clarifies where policy is decided, where forwarding occurs, and how failures propagate Correct answer.

Explanation

Separating the planes helps designers reason about where decisions are made, where traffic is forwarded, and how faults in one plane affect others. It does not remove hardware redundancy, unify VLANs, or eliminate authentication.

Question 26Architecture and Design

In an Aruba campus design, which document defines the intended logical topology, VLANs, and policy so that implementation can be validated against it?

  1. The bill of materials
  2. The rack elevation diagram
  3. The low-level design document Correct answer.
  4. The cable schedule

Explanation

A low-level design (LLD) captures the detailed logical and physical decisions, including VLANs, addressing, and policy, and serves as the baseline against which the built network is validated. The other artifacts describe procurement or physical installation rather than design intent.

Question 27Architecture and Design

Which Aruba design approach centralizes policy enforcement for both wired and wireless clients so that a client's role follows it across the campus?

  1. Per-SSID ACLs on each AP
  2. Role-based dynamic segmentation Correct answer.
  3. MAC authentication on every edge port
  4. Static port-based VLAN assignment

Explanation

Dynamic segmentation assigns a role to a client based on identity and context, and that role carries consistent policy whether the client is wired or wireless and wherever it connects. Static VLANs and per-device ACLs do not provide a single consistent policy source.

Question 28Architecture and Design

A designer is choosing between a gateway-based and a gateway-less (VMC) campus architecture. Which requirement most strongly favors the gateway-based model?

  1. Local breakout of guest traffic at each access switch
  2. Elimination of all controller hardware from the campus
  3. Direct Layer 2 forwarding of client traffic at the edge
  4. Centralized tunnel termination with stateful inspection of client traffic Correct answer.

Explanation

The gateway-based model places dedicated gateways that terminate tunnels and apply stateful policy to client traffic, which suits designs needing centralized inspection and control. Gateway-less designs push forwarding and policy closer to the edge and reduce dependence on centralized tunnel termination.

Question 29Architecture and Design

Which statement best describes the purpose of an Aruba Mobility Conductor in a large campus deployment?

  1. It replaces the need for any routing in the distribution layer.
  2. It forwards all client data traffic between access switches.
  3. It terminates wireless client encryption at the edge.
  4. It provides centralized configuration and image management for managed controllers and gateways. Correct answer.

Explanation

Mobility Conductor acts as a single point of configuration, licensing, and software management for the controllers and gateways it manages, simplifying operations at scale. It does not carry client data forwarding or replace distribution-layer routing.

Question 30Architecture and Design

When designing the wireless coverage layer for a standard office floor, which practice best supports predictable roaming between APs?

  1. Placing all APs on the same channel for simplicity
  2. Disabling 5 GHz to simplify client behavior
  3. Overlapping cell coverage with consistent power and channel planning Correct answer.
  4. Maximizing AP transmit power to reduce AP count

Explanation

Consistent cell sizing with deliberate overlap gives clients a clean transition point and stable signal as they move. Excessive power or co-channel placement creates sticky clients and interference that undermine roaming.

Question 31Architecture and Design

A campus needs to support a large number of IoT devices that must be isolated from user VLANs but still reach a shared management server. Which design element most directly enforces this?

  1. Placing IoT devices on the native VLAN
  2. A dedicated IoT role with policy permitting only management-server destinations Correct answer.
  3. A separate SSID with no authentication
  4. Using a single flat VLAN for all devices with per-device ACLs

Explanation

A role scoped to the IoT device class, with policy allowing only the required management destination, gives least-privilege enforcement regardless of where the device connects. Flat or unauthenticated designs weaken isolation and are harder to audit.

Question 32Architecture and Design

Which design principle most improves the resilience of a campus distribution layer against a single link failure?

  1. A single high-capacity uplink per access switch
  2. Spanning tree disabled on all distribution links
  3. Redundant links with a loop-prevention and fast-convergence protocol Correct answer.
  4. Static routes with no failover path

Explanation

Redundant paths combined with a protocol that prevents loops and converges quickly keep the distribution layer available when a link fails. Single uplinks and disabled loop prevention remove the redundancy that protects against failure.

Question 33Architecture and Design

When planning IP addressing for a multi-building campus, which approach best supports summarization and growth?

  1. Use a single large subnet for the entire campus
  2. Assign random blocks per floor to avoid predictability
  3. Assign addresses sequentially as devices are installed across all buildings
  4. Assign contiguous address blocks per building and summarize at the distribution layer Correct answer.

Explanation

Contiguous per-building blocks allow the distribution layer to advertise summarized routes, keeping routing tables small and growth manageable. Sequential or random allocation fragments the space and prevents clean summarization.

Question 34Architecture and Design

Which Aruba tool is intended to let a designer model AP placement and predict coverage and capacity before equipment is installed?

  1. Aruba VisualRF planning Correct answer.
  2. Aruba ClearPass Policy Manager
  3. Aruba NetEdit
  4. Aruba Central firmware compliance

Explanation

VisualRF provides predictive planning and heat-map modeling of AP placement, coverage, and capacity before deployment. The other tools address configuration management, compliance, or policy, not RF prediction.

Question 35Architecture and Design

A high-density venue design must handle many clients in a small area. Which factor most directly drives the required AP count?

  1. The maximum transmit power of the APs
  2. The number of SSIDs broadcast
  3. The number of concurrent clients and their per-client throughput demand Correct answer.
  4. The total square footage of the venue

Explanation

In high-density designs, capacity is bounded by the number of concurrent clients and the throughput each needs, which sets how many radios are required. Floor area alone does not capture density, and SSID count or power are tuning factors rather than capacity drivers.

Question 36Architecture and Design

Which statement best explains why a campus design separates the management, control, and data planes conceptually?

  1. It eliminates the need for redundant links
  2. It removes the need for routing protocols in the campus
  3. It guarantees that no single device can fail
  4. It allows each plane to be scaled, secured, and troubleshot independently Correct answer.

Explanation

Treating the planes separately lets designers size and secure management access differently from forwarding traffic, and it simplifies fault isolation. It does not remove the need for routing, redundancy, or device-level resilience.

Question 37Architecture and Design

Which Aruba capability allows a single policy defined once to be applied to wired ports and wireless clients alike?

  1. Port security with sticky MAC addresses
  2. RADIUS authorization returning only a VLAN
  3. Separate per-switch ACLs and per-SSID firewall rules
  4. Unified role-based policy with ClearPass as the policy source Correct answer.

Explanation

Defining roles and policy once, with ClearPass as the source of truth, lets the same enforcement apply to wired and wireless clients. Per-device ACLs, VLAN-only authorization, and port security do not deliver unified policy.

Question 38Architecture and Design

A design must ensure that an access switch losing its uplink does not create a loop or a prolonged outage. Which combination best meets this requirement?

  1. A single uplink with a static default route
  2. Redundant uplinks with a loop-prevention protocol and fast failure detection Correct answer.
  3. Multiple uplinks with spanning tree disabled
  4. A hub between the access and distribution switches

Explanation

Redundant uplinks plus loop prevention and fast failure detection preserve availability while preventing loops when a link fails. Single paths, disabled loop prevention, or shared hubs remove the protections needed.

Question 39Architecture and Design

Which statement best describes the role of a Virtual Mobility Controller (VMC) in an Aruba gateway-less campus architecture?

  1. It replaces the distribution layer with a single chassis
  2. It runs as software to manage and control APs without dedicated gateway hardware Correct answer.
  3. It terminates all wired client traffic at the core
  4. It provides stateful firewall inspection of all client traffic

Explanation

In a gateway-less design, the VMC provides the management and control functions for APs in software, removing the need for dedicated controller hardware while forwarding stays distributed. It does not centralize stateful inspection or replace distribution switching.

Question 40Architecture and Design

A design team wants guest wireless traffic to be unable to reach internal corporate VLANs. Which design approach enforces this most reliably?

  1. Blocking guest traffic only at the internet firewall
  2. A dedicated guest role with policy that permits only internet-bound destinations Correct answer.
  3. Placing guests on the corporate VLAN with a per-user ACL
  4. A guest SSID with a hidden name and WPA2

Explanation

A dedicated guest role with explicit policy limiting destinations to the internet enforces isolation at the point of admission and follows the client wherever it connects. Hidden SSIDs, shared VLANs, or firewall-only blocking leave paths to internal resources.

Question 41Wired and Wireless Campus Access Infrastructure

In an ArubaOS-CX VSX pair, which protocol provides the inter-switch synchronization of MAC and ARP entries between the two peer switches?

  1. RSTP over the keepalive path
  2. BGP over the peer link
  3. OSPFv3 over the management VRF
  4. IS-IS over the inter-switch link Correct answer.

Explanation

VSX uses IS-IS on the inter-switch link to synchronize MAC and ARP tables and to carry control traffic between peers. The keepalive path is a separate L3 link used only for split-brain detection, and the peer link is a L2 aggregate.

Question 42Wired and Wireless Campus Access Infrastructure

An engineer configures a VSX LAG toward a downstream access switch. On which switch(es) must the multichassis LAG be configured for the bundle to come up correctly?

  1. On the downstream access switch only
  2. Only on the primary VSX peer
  3. Independently on both VSX peers with matching LAG IDs Correct answer.
  4. Only on the secondary VSX peer

Explanation

A VSX LAG must be configured on both VSX peers as a multichassis LAG with matching LAG IDs so the pair presents a single logical bundle to the downstream device. The downstream device simply sees a normal LAG.

Question 43Wired and Wireless Campus Access Infrastructure

What is the purpose of the VSX keepalive link?

  1. To synchronize the running configuration
  2. To forward broadcast traffic between peers
  3. To detect a split-brain condition between the peers Correct answer.
  4. To carry user data if the peer link fails

Explanation

The keepalive is a separate L3 path used to detect when peers lose ISL connectivity but remain alive, triggering split-brain protection. It does not carry user data or configuration synchronization.

Question 44Wired and Wireless Campus Access Infrastructure

Which ArubaOS-CX feature allows a pair of switches to appear as a single device for Layer 2 multipathing while each switch maintains an independent control plane?

  1. VSX Correct answer.
  2. VRRP
  3. MSTP
  4. VSF stacking

Explanation

VSX provides active-active Layer 2 multipathing with two independent control planes, unlike a stack which merges control planes. VRRP and MSTP are separate resiliency protocols.

Question 45Wired and Wireless Campus Access Infrastructure

A designer wants active gateway redundancy where both VSX peers can forward traffic for the same virtual IP and MAC. Which feature should be enabled?

  1. VSX active-gateway Correct answer.
  2. Spanning tree root guard
  3. VRRP preempt mode
  4. Proxy ARP

Explanation

VSX active-gateway lets both peers own and forward for the same virtual IP and MAC, avoiding suboptimal traffic paths. Classic VRRP makes only the master forward for the virtual address.

Question 46Wired and Wireless Campus Access Infrastructure

Which statement describes a correct VSF (Virtual Switching Framework) behavior on ArubaOS-CX switches?

  1. VSF members must run different firmware versions
  2. Members keep separate management IPs and control planes
  3. VSF requires IS-IS on the inter-switch link
  4. A single member becomes commander and the stack shares one control plane Correct answer.

Explanation

VSF merges member switches into one logical device with a commander and a shared control plane. Unlike VSX, there is no IS-IS synchronization and members do not retain independent control planes.

Question 47Wired and Wireless Campus Access Infrastructure

Which ArubaOS-CX feature provides loop-free Layer 2 multipathing without relying on Spanning Tree by using a distributed control protocol?

  1. EVPN-VXLAN Correct answer.
  2. EtherChannel
  3. VSX with loop protection
  4. MSTP

Explanation

EVPN-VXLAN provides a control-plane-driven overlay that avoids Layer 2 loops without depending on STP for multipathing. MSTP and EtherChannel are traditional L2 mechanisms, and VSX loop protection only guards against specific misconfigurations.

Question 48Wired and Wireless Campus Access Infrastructure

Which role does a VTEP play in an EVPN-VXLAN fabric?

  1. It elects the spanning tree root
  2. It authenticates users against RADIUS
  3. It assigns IP addresses to clients via DHCP
  4. It maps VLANs to VNIs and encapsulates frames in VXLAN Correct answer.

Explanation

A VTEP terminates VXLAN tunnels, mapping VLANs to VNIs and encapsulating/decapsulating frames. DHCP, STP, and RADIUS are separate functions.

Question 49Wired and Wireless Campus Access Infrastructure

In Aruba Central, which feature provides centralized onboarding and policy enforcement for wired and wireless clients across the campus?

  1. AirGroup
  2. Aruba Fabric Composer
  3. NetConductor
  4. ClearPass Policy Manager Correct answer.

Explanation

ClearPass Policy Manager performs centralized onboarding, role assignment, and policy enforcement. NetConductor automates fabric provisioning, AirGroup manages mDNS/Bonjour services, and Fabric Composer orchestrates the fabric.

Question 50Wired and Wireless Campus Access Infrastructure

Which protocol does Aruba use to dynamically assign a user role to a wired client based on authentication results?

  1. Syslog severity mapping
  2. SNMPv3 user-based security
  3. RADIUS with vendor-specific attributes Correct answer.
  4. TACACS+ command authorization

Explanation

Aruba switches apply role-based access using RADIUS-returned attributes (such as Aruba-User-Role) after authentication. TACACS+ handles admin command authorization, and SNMP/syslog are for monitoring.