Aruba Campus Access Associate common mistakes
Aruba Campus Access Associate · Understand the traps and how to avoid them.
Treating VLANs as purely Layer 2 broadcast domains and forgetting that inter-VLAN routing requires a Layer 3 gateway (SVI or router interface).
Candidates often memorize 'VLAN = subnet' and then assume devices in different VLANs can communicate automatically once VLANs are configured on the switch.
What to do instead
Practice mapping each VLAN to a unique IP subnet and explicitly identifying the Layer 3 device (SVI on a switch or router subinterface) that will route between them; verify with a simple topology diagram before answering.
Confusing access ports and trunk ports, especially when a port connects to an AP or another switch.
The terms 'access' and 'trunk' are familiar, but candidates overlook that an AP management interface may use an access port while user traffic uses a trunk, or vice versa depending on the design.
What to do instead
For every port scenario, ask: does this link carry one VLAN (access) or multiple VLANs (trunk)? Then check the device role (endpoint, AP, switch) to confirm the expected mode.
Assuming 2.4 GHz and 5 GHz bands have identical coverage and penetration, and selecting the wrong band for a given requirement.
Candidates remember '5 GHz is faster' but forget that higher frequency means shorter range and worse wall penetration, leading to incorrect answers about coverage planning.
What to do instead
Memorize the trade-off: lower frequency = longer range/better penetration but lower throughput; higher frequency = shorter range but more channels and higher throughput. Apply this to each scenario.
Mixing up authentication, authorization, and accounting (AAA) concepts, or confusing 802.1X roles (supplicant, authenticator, authentication server).
The terms are often used together, and candidates may not clearly separate who does what in a port-based access control scenario.
What to do instead
Create a mental map: supplicant = client device, authenticator = switch/AP, authentication server = RADIUS. Then link each AAA function to its purpose (who are you, what can you do, what did you do).
Believing that enabling a VLAN or SSID automatically provides security, without considering authentication or encryption settings.
Candidates may focus on connectivity and overlook that an open SSID or a VLAN with no ACL is not secure by default.
What to do instead
Always check for security settings: WPA2/WPA3 encryption on wireless, and ACLs or role-based access on wired VLANs. If a question asks about security, verify these are explicitly configured.
Assuming Aruba Central requires no initial device onboarding or that devices are automatically managed once powered on.
Candidates may think Central is plug-and-play, forgetting that devices must be registered, assigned to a group, and have connectivity to Central.
What to do instead
Review the onboarding workflow: device must be added to Central (by serial or automatically via Activate), assigned to a group, and have a valid subscription. Practice ordering these steps.
Confusing groups, sites, and labels in Aruba Central, and using them interchangeably.
These are all organizational constructs, but they serve different purposes: groups for configuration, sites for location, labels for filtering/monitoring.
What to do instead
Memorize: groups = configuration template application; sites = physical location mapping; labels = custom tags for filtering and reporting. Match each to its function in scenario questions.
Overlooking the need for a DHCP server or helper address when deploying APs or clients on a VLAN.
Candidates focus on Layer 2 connectivity and forget that IP address assignment requires DHCP, especially when the DHCP server is on a different VLAN.
What to do instead
For any new VLAN or SSID, ask: where is DHCP? If the server is remote, ensure a DHCP relay (helper address) is configured on the gateway. Include this in design checks.
Misinterpreting monitoring data, such as confusing channel utilization with client count or RSSI with SNR.
Dashboards show many metrics, and candidates may not understand what each represents, leading to wrong conclusions about network health.
What to do instead
Learn the definitions: channel utilization = percentage of airtime used; client count = number of associated devices; RSSI = signal strength; SNR = signal minus noise. Practice interpreting sample graphs.
Skipping the physical layer when troubleshooting connectivity issues, jumping straight to VLAN or IP configuration.
Candidates often assume logical misconfigurations are the cause and forget to verify cable, port status, PoE, or AP LED indicators.
What to do instead
Follow a bottom-up troubleshooting approach: check physical connectivity (cables, LEDs, PoE) first, then Layer 2 (VLAN, trunk), then Layer 3 (IP, routing). Apply this order in scenario questions.