I85PREP
⌘ K
HPE Aruba Switching Expert (Written, HPE7-A06) study materials
HPE Aruba Switching Expert (Written, HPE7-A06) study resources

HPE Aruba Switching Expert (Written, HPE7-A06) practice questions

One question at a time. Build your HPE Aruba Switching Expert (Written, HPE7-A06) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Routing and Switching

On an Aruba AOS-CX switch, which command displays the hardware forwarding table (MAC table) entry count and aging time for a VLAN?

  1. show mac-address-table Correct answer.
  2. show vlan port
  3. show running-config
  4. show arp

Explanation

The MAC address table is displayed with show mac-address-table, which includes learned entries and aging information per VLAN. ARP output shows IP-to-MAC bindings, not the Layer 2 forwarding table.

Question 2Routing and Switching

A port on an AOS-CX switch is configured with 'spanning-tree port-type admin-edge-port'. What behavior does this enable?

  1. The port is excluded from all spanning tree instances and floods all traffic
  2. The port sends BPDUs to detect loops before forwarding
  3. The port becomes a root guard protected uplink
  4. The port immediately transitions to forwarding and does not participate in topology changes Correct answer.

Explanation

An admin-edge-port skips listening and learning states so attached endpoints can forward immediately, and it does not generate topology change notifications. Loop protection should be paired with it to catch miswiring.

Question 3Routing and Switching

Which AOS-CX feature allows a single physical link to carry multiple VLANs between two switches while tagging frames?

  1. Routed port
  2. Loopback interface
  3. Access port
  4. Trunk port Correct answer.

Explanation

A trunk (tagged) port carries frames for multiple VLANs by inserting 802.1Q tags. Access ports carry a single untagged VLAN, and routed ports carry a single Layer 3 subnet.

Question 4Routing and Switching

What is the default administrative distance of OSPF on an Aruba AOS-CX switch?

  1. 110 Correct answer.
  2. 90
  3. 120
  4. 1

Explanation

OSPF has a default administrative distance of 110 on AOS-CX. Connected routes are 0, static routes are 1, and eBGP is 20.

Question 5Routing and Switching

Which protocol provides loop-free Layer 2 multipathing by using a shortest path tree and IS-IS-like advertisements on Aruba switches?

  1. RSTP
  2. VRRP
  3. MSTP
  4. SPB Correct answer.

Explanation

Shortest Path Bridging (SPB, IEEE 802.1aq) builds a loop-free shortest path tree using IS-IS and supports multipathing at Layer 2. RSTP and MSTP block redundant links rather than using them.

Question 6Routing and Switching

What does the command 'ip route 0.0.0.0/0 10.1.1.1' configure?

  1. A default route via 10.1.1.1 Correct answer.
  2. A floating static route
  3. A host route to 10.1.1.1
  4. A directly connected subnet

Explanation

A destination of 0.0.0.0/0 matches all traffic and is the default route; the next hop is 10.1.1.1. Host routes use /32, and floating statics require a higher administrative distance.

Question 7Routing and Switching

Which statement describes the role of a designated router (DR) in an OSPF broadcast network?

  1. It replaces the ABR function at area boundaries
  2. It originates all Type 5 LSAs for the area
  3. It forms full adjacencies with all routers and floods LSAs to them Correct answer.
  4. It is elected on point-to-point links

Explanation

On multi-access segments the DR forms adjacencies with all other routers and distributes LSAs, reducing the number of adjacencies. DROTHERs only form full adjacencies with the DR and BDR.

Question 8Routing and Switching

Which Aruba AOS-CX command enables an interface as a Layer 3 routed port?

  1. routing
  2. ip routing
  3. interface vlan
  4. no switchport Correct answer.

Explanation

On AOS-CX, 'no switchport' converts a physical interface into a routed port where an IP address can be assigned. 'ip routing' is a global command enabling routing, and interface vlan creates an SVI.

Question 9Routing and Switching

Two AOS-CX switches are connected by two links. STP is enabled and both links are in the same VLAN. What is the expected result?

  1. Traffic is load balanced per packet
  2. Both links forward traffic simultaneously
  3. Both links are disabled by the switch
  4. One link is placed in a blocking or alternate role Correct answer.

Explanation

Classic STP and RSTP build a single active topology, so redundant links are blocked (alternate/discarding) to prevent loops. Only one path forwards at a time.

Question 10Routing and Switching

An OSPF router has two equal-cost paths to a destination. Which configuration causes traffic to be distributed across both paths?

  1. redistribute connected
  2. passive-interface default
  3. maximum-paths 2 Correct answer.
  4. default-information originate

Explanation

Equal-cost multipath (ECMP) is controlled by maximum-paths, which allows multiple equal-cost next hops to be installed. The other commands affect default route origination, interface behavior, or redistribution.

Question 11Routing and Switching

A trunk link between two switches must pass VLAN 10 tagged and VLAN 20 untagged. Which configuration on an AOS-CX interface accomplishes this?

  1. vlan trunk native 10 and vlan trunk allowed 10
  2. vlan access 10 and vlan trunk allowed 20
  3. vlan trunk native 20 and vlan trunk allowed 10,20 Correct answer.
  4. vlan 10 untagged and vlan 20 tagged

Explanation

The native VLAN is sent untagged, so setting native 20 makes VLAN 20 untagged, and the allowed list must include both VLANs so VLAN 10 is tagged. The allowed list determines which VLANs traverse the trunk.

Question 12Routing and Switching

Which OSPF LSA type describes networks in another area and is generated by an ABR?

  1. Type 3 Correct answer.
  2. Type 4
  3. Type 1
  4. Type 2

Explanation

Type 3 summary LSAs are generated by ABRs to advertise inter-area routes. Type 1 is a router LSA, Type 2 is a network LSA, and Type 4 describes an ASBR.

Question 13Routing and Switching

A switch has an SVI in VLAN 30 with IP 10.30.0.1/24 and a routed port with 10.30.0.2/24. What is the result?

  1. The two interfaces form an OSPF adjacency
  2. The routed port is rejected due to overlapping subnet Correct answer.
  3. The SVI is shut down automatically
  4. Both interfaces become active and load balance

Explanation

AOS-CX does not allow two Layer 3 interfaces with overlapping subnets, so the second configuration is rejected. Overlapping addressing would create ambiguous routing.

Question 14Routing and Switching

Which mechanism prevents a rogue switch from becoming the root bridge on an Aruba AOS-CX access switch?

  1. Root guard Correct answer.
  2. TCN guard
  3. BPDU guard
  4. Loop guard

Explanation

Root guard on a port blocks superior BPDUs that would make the connected device the root, keeping the intended root stable. BPDU guard err-disables ports that receive any BPDU, typically on edge ports.

Question 15Routing and Switching

What is the purpose of the 'ip helper-address' command on a VLAN interface?

  1. It enables proxy ARP for the subnet
  2. It forwards DHCP broadcasts to a specified server Correct answer.
  3. It enables VRRP on the interface
  4. It configures a default gateway for clients

Explanation

ip helper-address converts broadcast DHCP requests into unicast packets sent to the configured server, allowing DHCP across subnets. It does not configure client gateways or redundancy.

Question 16Routing and Switching

Which VRRP configuration makes a router the master for group 5 with a virtual IP of 10.0.0.1 on VLAN 10?

  1. vrrp 5 priority 255 and vrrp 5 ip 10.0.0.1 on the same interface
  2. vrrp 5 virtual-router 10.0.0.1
  3. vrrp 5 address-family ipv4 and vrrp 5 ip 10.0.0.1 Correct answer.
  4. vrrp 10 ip 10.0.0.1

Explanation

On AOS-CX, VRRP is enabled with 'vrrp <group> address-family ipv4' followed by 'vrrp <group> ip <virtual-ip>'. The group number must match the intended group.

Question 17Routing and Switching

A static route to 192.168.5.0/24 via 10.0.0.2 is configured with distance 200. What does this accomplish?

  1. It prevents the route from being redistributed
  2. It makes the route preferred over OSPF
  3. It creates a floating static route used only if the primary route fails Correct answer.
  4. It forces the route into the OSPF database

Explanation

A static route with a higher administrative distance than the primary route becomes a floating static, installed only when the preferred route is withdrawn. It is not preferred over OSPF because 200 exceeds OSPF's 110.

Question 18Routing and Switching

Which command verifies OSPF neighbor adjacency state on AOS-CX?

  1. show ip ospf interface
  2. show ip ospf neighbors Correct answer.
  3. show ip route ospf
  4. show ip ospf database

Explanation

show ip ospf neighbors lists neighbors and their state (such as FULL or 2-WAY). Route and database commands show routing and LSDB contents rather than adjacency state.

Question 19Routing and Switching

A network uses MSTP with two instances. VLANs 10-20 are mapped to instance 1 and VLANs 30-40 to instance 2. What benefit does this provide?

  1. It forces all VLANs onto the root bridge
  2. It merges both instances into one topology
  3. It disables STP for those VLANs
  4. It allows different forwarding topologies per instance for load sharing Correct answer.

Explanation

MSTP maps VLANs to instances, and each instance can have a different active topology, enabling load sharing across redundant links. All instances still run loop prevention.

Question 20Routing and Switching

What happens when an OSPF interface is configured as passive?

  1. It stops advertising the network and removes it from the LSDB
  2. It becomes an ASBR
  3. It forms adjacencies but does not exchange LSAs
  4. It stops sending hellos but its network is still advertised Correct answer.

Explanation

A passive interface suppresses hello packets so no adjacencies form, but the connected subnet is still advertised in the router LSA. This is common on user-facing VLANs.

Question 21Routing and Switching

A host in VLAN 10 (10.10.10.0/24) cannot reach a host in VLAN 20 (10.20.20.0/24) on the same AOS-CX switch, even though both SVIs are up. Which configuration is most likely missing?

  1. spanning-tree
  2. ip routing Correct answer.
  3. ip helper-address
  4. vlan trunk allowed

Explanation

Inter-VLAN routing on AOS-CX requires the global 'ip routing' command to be enabled. Without it, the switch does not forward between SVIs even though both interfaces are up.

Question 22Routing and Switching

Which AOS-CX command creates an aggregate link using LACP for ports 1/1/1 through 1/1/4?

  1. interface lag 1 and lacp mode static, then assign member ports
  2. interface lag 1 and lacp mode active, then assign member ports Correct answer.
  3. interface lag 1 without LACP and assign member ports
  4. interface port-channel 1, then assign member ports

Explanation

An LAG is created with 'interface lag <id>', LACP is enabled with 'lacp mode active', and member interfaces are added with the 'lag' command. Static mode does not run LACP negotiation.

Question 23Routing and Switching

An OSPF router in area 1 has an interface into area 0. Which statement about its role is true?

  1. It must be the DR on all interfaces
  2. It is a backbone router only and generates no summaries
  3. It is an ASBR by definition
  4. It is an ABR and generates Type 3 LSAs Correct answer.

Explanation

A router with interfaces in more than one area, including area 0, is an Area Border Router and generates Type 3 summary LSAs between areas. ASBR status requires redistribution, and DR election is per segment.

Question 24Routing and Switching

Two AOS-CX switches form an OSPF adjacency over a link, but the neighbor remains stuck in EXSTART. Which mismatch is the most likely cause?

  1. MTU mismatch between the interfaces Correct answer.
  2. Mismatched OSPF area IDs
  3. Mismatched hello timers
  4. Duplicate router IDs

Explanation

EXSTART/EXCHANGE problems are typically caused by MTU mismatch, since database description packets cannot be exchanged when MTUs differ. Area or timer mismatches prevent adjacency earlier, at INIT or 2-WAY.

Question 25Routing and Switching

A switch running MSTP has a different MST region configuration name on each side of a trunk. What is the effect?

  1. All VLANs are blocked on the trunk
  2. The switches automatically synchronize region names
  3. Each switch treats the other as being in a different region, so a single common spanning tree instance is used between them Correct answer.
  4. The trunk is placed in an error-disabled state

Explanation

MSTP requires matching region name, revision, and VLAN-to-instance mapping to be in the same region. If they differ, the switches interoperate using the common internal spanning tree (CIST) as if connected by a single external link.

Question 26Routing and Switching

Which statement describes the behavior of a switch port configured as a Layer 2 access port in VLAN 10?

  1. It forwards untagged frames in VLAN 10 and strips any VLAN tag on egress. Correct answer.
  2. It forwards frames for all VLANs by default.
  3. It tags frames with VLAN 10 before forwarding.
  4. It requires an IP address to forward traffic.

Explanation

An access port belongs to a single VLAN and typically connects to end devices that do not understand VLAN tags. Ingress untagged frames are assigned to the access VLAN, and egress frames are sent untagged. Tagging is used on trunk ports, not access ports.

Question 27Routing and Switching

Which protocol provides loop-free Layer 2 forwarding by electing a root bridge and blocking redundant paths?

  1. OSPF
  2. STP Correct answer.
  3. VRRP
  4. LACP

Explanation

Spanning Tree Protocol (STP) prevents Layer 2 loops by electing a root bridge and placing redundant ports in a blocking state. OSPF is a Layer 3 routing protocol, LACP aggregates links, and VRRP provides default gateway redundancy.

Question 28Routing and Switching

What is the purpose of the 'ip routing' command on an Aruba AOS-CX switch?

  1. It enables the switch to forward IPv4 packets between different subnets. Correct answer.
  2. It creates a default route to the management gateway.
  3. It assigns an IP address to the management interface.
  4. It enables OSPF routing protocol globally.

Explanation

The 'ip routing' command enables IPv4 routing globally on the switch, allowing it to forward packets between connected subnets. It does not assign IP addresses, enable specific routing protocols, or create static routes.

Question 29Routing and Switching

A network administrator wants to configure a static route on an AOS-CX switch so that traffic to 10.0.0.0/8 is sent to next-hop 192.168.1.1. Which command accomplishes this?

  1. ip route 10.0.0.0/8 192.168.1.1 Correct answer.
  2. ip static-route 10.0.0.0/8 192.168.1.1
  3. ip route 10.0.0.0 255.0.0.0 192.168.1.1
  4. route 10.0.0.0/8 next-hop 192.168.1.1

Explanation

On AOS-CX, static routes are configured in the global configuration context using the 'ip route <destination/prefix> <next-hop>' syntax. The other options use incorrect syntax or unsupported keywords.

Question 30Routing and Switching

In OSPF, which router type generates Type 3 summary LSAs to advertise networks from one area into another?

  1. Area Border Router (ABR) Correct answer.
  2. Autonomous System Boundary Router (ASBR)
  3. Designated Router (DR)
  4. Internal router

Explanation

Area Border Routers (ABRs) connect multiple OSPF areas and generate Type 3 summary LSAs to advertise networks from one area into another. Internal routers do not generate Type 3 LSAs, ASBRs generate Type 5 LSAs for external routes, and DRs manage adjacencies on broadcast networks.

Question 31Routing and Switching

Which statement accurately describes the role of the Backup Designated Router (BDR) in an OSPF broadcast network?

  1. It forwards all multicast OSPF packets to the DR.
  2. It prevents other routers from forming adjacencies with the DR.
  3. It maintains a full adjacency with all routers and takes over if the DR fails. Correct answer.
  4. It is elected only when the DR fails.

Explanation

The BDR forms adjacencies with all routers on the segment and monitors the DR. If the DR fails, the BDR becomes the DR without disrupting adjacencies. It does not forward all multicast packets or prevent other adjacencies.

Question 32Routing and Switching

A network engineer configures VRRP group 10 on two AOS-CX switches with virtual IP 10.0.0.1. Switch A has priority 150 and preempt enabled; Switch B has priority 100. After Switch A reboots, what happens?

  1. Switch A becomes master immediately because it has a higher priority, regardless of preempt.
  2. Both switches become master and load-balance traffic.
  3. Switch A becomes master after it comes back online because preempt is enabled. Correct answer.
  4. Switch B remains master because preempt is disabled on Switch A.

Explanation

With VRRP preemption enabled, a router with a higher priority takes over the master role when it becomes available. Without preempt, the current master would remain master even if a higher-priority router joins. VRRP does not load-balance by default.

Question 33Routing and Switching

A network uses Rapid Spanning Tree Protocol (RSTP). Which port role is assigned to a port that provides an alternative path to the root bridge but is not currently forwarding?

  1. Root port
  2. Alternate port Correct answer.
  3. Edge port
  4. Designated port

Explanation

In RSTP, an alternate port provides an alternative path to the root bridge and is in a discarding state, ready to take over if the root port fails. Root ports are the best path to the root, designated ports forward on a segment, and edge ports connect to end devices.

Question 34Routing and Switching

A network administrator wants to configure an AOS-CX switch to send OSPF hello packets with a different hello interval on a specific interface. Which command should be used?

  1. ospf timer hello 5
  2. ip ospf timer hello 5
  3. ospf hello-interval 5
  4. ip ospf hello-interval 5 Correct answer.

Explanation

On AOS-CX, OSPF interface parameters are configured in interface context using the 'ip ospf' prefix, such as 'ip ospf hello-interval <seconds>'. The other options use incorrect syntax or omit the 'ip' prefix.

Question 35Security

On an Aruba AOS-CX switch, which command applies a MAC-based port security limit of three learned addresses to interface 1/1/5?

  1. mac-limit 3 enable at 1/1/5
  2. port-security mac-limit 3 on interface 1/1/5
  3. interface 1/1/5 then port-security mac-limit 3 Correct answer.
  4. switchport port-security maximum 3 on 1/1/5

Explanation

AOS-CX port security is configured in interface context: enter the interface, then set the MAC limit with the port-security mac-limit command. The limit takes effect once port security is enabled on that interface.

Question 36Security

An administrator wants a switch port to forward traffic for only the first MAC address learned and to drop frames from any other source MAC. Which port security action accomplishes this?

  1. Shutdown
  2. Restrict
  3. Protect Correct answer.
  4. Notify only

Explanation

The protect action silently drops frames with unauthorized source MAC addresses and does not generate a log or alert. Restrict and shutdown both produce notification, while notify alone does not drop traffic.

Question 37Security

Which protocol should be enabled on switch-to-switch links to mitigate VLAN hopping via double-tagged frames on an Aruba AOS-CX access port?

  1. BPDU guard
  2. Loop protection
  3. DHCP snooping
  4. Native VLAN tagging with an unused VLAN Correct answer.

Explanation

Double-tagging attacks exploit the native VLAN, which is untagged. Setting the native VLAN on trunk links to an unused VLAN and tagging all used VLANs removes the untagged path the attack depends on.

Question 38Security

What is the primary purpose of DHCP snooping on an Aruba AOS-CX switch?

  1. To build a trusted binding table of client IP-to-MAC-to-port associations Correct answer.
  2. To load-balance DHCP requests across multiple servers
  3. To rate-limit DHCP requests from clients
  4. To encrypt DHCP messages between client and server

Explanation

DHCP snooping classifies ports as trusted or untrusted and records legitimate bindings in a snooping database. That binding table is then used by features such as Dynamic ARP Protection and IP source guard.

Question 39Security

Dynamic ARP Protection on AOS-CX depends on which other feature to validate ARP packets?

  1. DHCP snooping bindings Correct answer.
  2. RADIUS accounting
  3. STP root guard
  4. LLDP neighbor data

Explanation

Dynamic ARP Protection validates ARP packets against the DHCP snooping binding table, dropping ARP traffic whose IP-to-MAC mapping does not match a trusted binding.

Question 40Security

Which statement correctly describes the behavior of BPDU guard on an Aruba AOS-CX edge port?

  1. It elects the port as an alternate root
  2. It blocks all BPDUs from being forwarded to the CPU
  3. It err-disables the port when a BPDU is received Correct answer.
  4. It converts the port to a trunk automatically

Explanation

BPDU guard is applied to edge (access) ports to prevent rogue switches from participating in STP. When a BPDU arrives on a protected edge port, the port is placed into an error-disabled state.

Question 41Security

An engineer wants to prevent a newly connected access port from becoming the STP root. Which feature should be applied?

  1. Loop guard
  2. TCN guard
  3. BPDU filter
  4. Root guard Correct answer.

Explanation

Root guard keeps a port from accepting superior BPDUs that would make it the root port, preserving the intended root bridge location. If a superior BPDU arrives, the port is placed in a root-inconsistent state.

Question 42Security

Which AOS-CX feature authenticates users via 802.1X and can also apply per-role policies downloaded from ClearPass?

  1. Port security
  2. Storm control
  3. MAC authentication with static ACLs
  4. Role-based access with downloadable user roles Correct answer.

Explanation

AOS-CX supports role-based access where a RADIUS server such as ClearPass returns a user role that defines VLAN and ACL policy for the authenticated session. This provides centralized, dynamic policy per user or device.

Question 43Security

A port is configured for 802.1X with client-mode multiple-host. What happens when the first client authenticates successfully?

  1. Each additional client must authenticate independently before forwarding
  2. Only that client's MAC is permitted; all others are dropped
  3. All clients on the port are permitted to send traffic Correct answer.
  4. The port is placed into a guest VLAN for all clients

Explanation

In multiple-host mode, once the first supplicant authenticates, the port opens and all hosts on that port are permitted. This is convenient but provides weaker per-device enforcement than client-mode based modes.

Question 44Security

Which RADIUS attribute commonly carries the authorization role returned to an AOS-CX switch for role-based access?

  1. Session-Timeout
  2. Framed-IP-Address
  3. Called-Station-Id
  4. Filter-Id Correct answer.

Explanation

Aruba role-based access uses the Filter-Id RADIUS attribute to convey the role name (and associated policy) from the RADIUS server to the switch. The switch then applies the locally or centrally defined role.

Question 45Security

What is the effect of enabling MAC authentication (MAC-Auth) as a fallback on an 802.1X port?

  1. Devices that cannot perform 802.1X are authenticated by their MAC address Correct answer.
  2. MAC-Auth replaces 802.1X entirely on that port
  3. The switch authenticates using the RADIUS server's MAC
  4. The port bypasses all authentication

Explanation

MAC authentication lets non-supplicant devices (such as printers or cameras) be authenticated using their source MAC as the credential. When configured as a fallback, it is attempted after 802.1X fails or times out.

Question 46Security

Which command on AOS-CX enables 802.1X authentication on interface 1/1/10 with the RADIUS server group 'corp'?

  1. 802.1x enable group corp at 1/1/10
  2. interface 1/1/10 then aaa authentication dot1x corp
  3. interface 1/1/10 then dot1x authenticator then radius-server group corp Correct answer.
  4. dot1x authenticator radius corp on 1/1/10

Explanation

On AOS-CX, 802.1X is enabled in interface context using the dot1x authenticator command, and the RADIUS server group is referenced with radius-server group. Both are configured under the target interface.

Question 47Security

Which feature protects the control plane by limiting the rate of ARP packets destined to the switch CPU?

  1. ARP inspection
  2. ARP cache aging
  3. Control-plane policing (CoPP) Correct answer.
  4. Proxy ARP

Explanation

Control-plane policing classifies and rate-limits traffic destined to the CPU, protecting the switch from floods such as ARP storms. ARP inspection validates ARP contents but is not the rate-limiting mechanism for CPU-bound traffic.

Question 48Security

An administrator needs to restrict management access so that only hosts in 10.10.0.0/24 can reach the switch via SSH. Which AOS-CX mechanism is appropriate?

  1. An SSH key with a passphrase
  2. BPDU guard on the management port
  3. A management ACL applied to the VRF or interface Correct answer.
  4. Port security on the management port

Explanation

A management ACL restricts which source addresses may access switch management services such as SSH and HTTPS. It is applied to the management interface or VRF to filter control-plane access.

Question 49Security

Which statement about local user authentication versus RADIUS/TACACS+ on AOS-CX is correct?

  1. RADIUS encrypts the entire packet body by default
  2. TACACS+ encrypts the entire payload and is often chosen for device administration Correct answer.
  3. Local users cannot be used as a fallback when servers are unreachable
  4. TACACS+ is used only for 802.1X and not for CLI logins

Explanation

TACACS+ separates authentication, authorization, and accounting and encrypts the full packet body, making it well suited for command-level device administration. RADIUS encrypts only the password field.

Question 50Security

Which command creates a local user 'netops' with a SHA-256 hashed password on AOS-CX?

  1. user netops password ciphertext
  2. username netops password ciphertext Correct answer.
  3. user netops secret sha256
  4. username netops password plaintext

Explanation

On AOS-CX, local users are created with the username command followed by password and the ciphertext keyword to store the password in hashed form. The plaintext keyword stores it in clear text, which is not recommended.