I85PREP
⌘ K
HPE ASE Edge-to-Cloud study materials
HPE ASE Edge-to-Cloud study resources

HPE ASE Edge-to-Cloud practice questions

One question at a time. Build your HPE ASE Edge-to-Cloud understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Edge and Networking

In an HPE Aruba CX switch stack, which protocol forms the single logical control plane across stack members?

  1. Aruba Stacking (backplane/front-plane stacking) Correct answer.
  2. Aruba Virtual Switching Extension (VSX)
  3. Link Aggregation Control Protocol (LACP)
  4. Spanning Tree Protocol (STP)

Explanation

Aruba CX stacking joins physical switches into one logical switch with a single management and control plane, using dedicated stacking ports or front-plane ports. VSX is a two-switch redundancy technology that keeps separate control planes, so it is not stacking.

Question 2Edge and Networking

Which statement describes the role of the conductor in an HPE Aruba CX stack?

  1. It provides the standby configuration used only during a firmware upgrade.
  2. It exclusively monitors environmental sensors and reports to a cloud portal.
  3. It runs the combined configuration and management plane for all stack members. Correct answer.
  4. It only forwards traffic for its own front-panel ports and runs no management functions.

Explanation

The conductor is the stack member elected to run the single management and configuration plane for the whole stack. Other members act as standby or members that forward traffic under conductor control.

Question 3Edge and Networking

An engineer wants two HPE Aruba CX switches to provide active-active Layer 2 and Layer 3 redundancy while keeping independent control planes. Which technology should be used?

  1. Backplane stacking
  2. VSX (Virtual Switching Extension) Correct answer.
  3. VRRP only
  4. Rapid Spanning Tree

Explanation

VSX pairs two CX switches with synchronized but independent control planes, offering active-active multichassis link aggregation and redundant Layer 3 gateways. Stacking instead collapses both into one control plane.

Question 4Edge and Networking

Which interface is used by VSX peers to synchronize state and carry control traffic?

  1. A dedicated stacking backplane cable
  2. The inter-switch link (ISL) Correct answer.
  3. The management VRF default gateway
  4. The keepalive path only

Explanation

The ISL is a link aggregation between the two VSX peers that carries synchronization and control traffic. A separate keepalive path exists to detect peer liveness and split-brain conditions.

Question 5Edge and Networking

What is the purpose of the VSX keepalive path?

  1. To provide the active gateway MAC for hosts
  2. To detect whether the VSX peer is alive and prevent split-brain behavior Correct answer.
  3. To synchronize MAC and ARP tables between peers
  4. To carry all inter-switch user data traffic between peers

Explanation

The keepalive is a separate link used to determine peer liveness. If the ISL fails but the peer is still reachable via keepalive, the switches can avoid both becoming primary and creating a split-brain condition.

Question 6Edge and Networking

In VSX, what does the active gateway feature provide to hosts?

  1. A per-host static route installed on each peer
  2. A DHCP relay address that changes on every failover
  3. A backup gateway that activates only after a manual failover command
  4. A single virtual MAC and IP shared by both peers for default gateway service Correct answer.

Explanation

Active gateway lets both VSX peers share a common virtual IP and virtual MAC for the default gateway, so hosts keep the same gateway and forwarding continues after a failover. Both peers can forward traffic for the virtual gateway.

Question 7Edge and Networking

Which HPE Aruba technology lets an access switch extend Layer 2 connectivity to a centralized gateway over a routed underlay?

  1. EVPN-VXLAN Correct answer.
  2. OSPFv3
  3. Smart Rate
  4. VSX

Explanation

EVPN-VXLAN provides a Layer 2 overlay over a Layer 3 underlay, allowing access switches to stretch segments to a centralized gateway or distributed anycast gateway. VSX is a redundancy pairing, not an overlay.

Question 8Edge and Networking

In an EVPN-VXLAN fabric, which component maps overlay MAC addresses to VTEP tunnel endpoints?

  1. The DHCP relay agent
  2. The underlay IGP
  3. The EVPN control plane using BGP Correct answer.
  4. The spanning tree root bridge

Explanation

EVPN uses BGP to distribute MAC and IP reachability information, including which VTEP owns a given MAC. This control plane avoids unknown unicast flooding across the overlay.

Question 9Edge and Networking

What is the function of a distributed anycast gateway in an EVPN-VXLAN fabric?

  1. It provides the same gateway IP and MAC on every leaf, enabling local routing at the edge. Correct answer.
  2. It assigns a unique gateway IP to each leaf so hosts must be re-addressed on migration.
  3. It replaces BGP with static routes for overlay reachability.
  4. It forces all inter-subnet traffic through a single centralized spine.

Explanation

A distributed anycast gateway configures the same virtual IP and MAC on every leaf, so each leaf routes locally for its attached hosts. This avoids tromboning traffic to a central gateway and keeps host addressing stable during migration.

Question 10Edge and Networking

Which HPE Aruba Networking wireless capability allows an AP to tunnel client traffic to a gateway for centralized policy?

  1. ClientMatch
  2. Local bridging
  3. Tunneled node mode Correct answer.
  4. AirMatch

Explanation

Tunneled node mode sends client traffic from the AP to a gateway over a tunnel, where centralized policy and security are applied. Local bridging instead forwards traffic directly at the AP.

Question 11Edge and Networking

What is the primary role of ClientMatch in an HPE Aruba wireless network?

  1. It encrypts management traffic between APs and the gateway.
  2. It assigns IP addresses to wireless clients.
  3. It steers clients to the best AP and band to improve roaming and performance. Correct answer.
  4. It schedules automatic firmware upgrades for access points.

Explanation

ClientMatch monitors client behavior and steers devices toward the most suitable AP and radio band, improving roaming and reducing sticky-client problems. It does not handle addressing, encryption, or firmware scheduling.

Question 12Edge and Networking

Which Aruba wireless feature dynamically adjusts channel and transmit power based on RF neighborhood data?

  1. AirMatch Correct answer.
  2. Dynamic Segmentation
  3. ClientMatch
  4. ClearPass Policy Manager

Explanation

AirMatch continuously analyzes RF data and automatically adjusts channel assignments and transmit power to optimize coverage and reduce interference. ClientMatch handles client steering, which is a different function.

Question 13Edge and Networking

An administrator needs consistent role-based policy for both wired and wireless users on Aruba infrastructure. Which capability should be used?

  1. Dynamic Segmentation Correct answer.
  2. AirMatch
  3. EVPN route reflectors
  4. VSX active gateway

Explanation

Dynamic Segmentation applies role-based policies consistently across wired and wireless traffic, often using a gateway to enforce roles. It unifies policy regardless of the access medium.

Question 14Edge and Networking

Which protocol should be configured on an Aruba CX switch to authenticate wired users against a RADIUS server before granting network access?

  1. NTP
  2. STP
  3. 802.1X Correct answer.
  4. LLDP

Explanation

802.1X port-based authentication uses a RADIUS server to validate user or device credentials before the port grants access. LLDP, STP, and NTP serve discovery, loop prevention, and time synchronization respectively.

Question 15Edge and Networking

Which protocol provides first-hop router redundancy by electing a master and backup router sharing a virtual IP on Aruba CX switches?

  1. LACP
  2. OSPF
  3. VRRP Correct answer.
  4. BGP

Explanation

VRRP elects a master and backup router that share a virtual IP address, giving hosts a resilient default gateway. OSPF and BGP are routing protocols, and LACP aggregates links.

Question 16Edge and Networking

Which HPE Aruba Networking product family is a cloud-managed platform for deploying and monitoring access points and switches without an on-premises controller?

  1. Aruba AirWave
  2. Aruba CX Mobile App
  3. Aruba Central Correct answer.
  4. Aruba ClearPass

Explanation

Aruba Central is the cloud management platform for wireless, wired, and SD-WAN devices, providing onboarding, monitoring, and configuration. ClearPass handles policy, and AirWave is an on-premises management system.

Question 17Edge and Networking

A branch office needs a compact HPE Aruba CX switch that supports stacking with other CX switches for a single management plane. Which CX series is purpose-built for this access/aggregation role?

  1. CX 10000 series
  2. Aruba 7000 series gateway
  3. Aruba 9000 series gateway
  4. CX 6300 series Correct answer.

Explanation

The CX 6300 is a stackable access and aggregation switch family designed for campus and branch deployments with a single management plane when stacked. The CX 10000 is a distributed services switch, while the 7000 and 9000 are gateways.

Question 18Edge and Networking

Which Aruba CX feature allows a single physical port to be configured as a member of multiple VLANs and carry tagged frames?

  1. A trunk port Correct answer.
  2. A console port
  3. An access port
  4. A routed loopback

Explanation

A trunk port carries frames for multiple VLANs, tagging them so the receiving device can distinguish VLAN membership. An access port belongs to a single VLAN and typically sends untagged frames.

Question 19Edge and Networking

On an Aruba CX switch, which command displays the current running configuration?

  1. show running-config Correct answer.
  2. show version
  3. show arp
  4. show interfaces brief

Explanation

The show running-config command prints the active configuration currently in effect on the switch. The other commands display software version, interface status, or ARP entries.

Question 20Edge and Networking

An engineer configures an Aruba CX switch port as a routed interface and assigns an IP address. What must be done to enable IP routing between multiple such interfaces?

  1. Configure LACP on each routed port
  2. Add all interfaces to the same VLAN trunk
  3. Create a spanning tree instance for each interface
  4. Enable IP routing globally with the ip routing command Correct answer.

Explanation

A CX switch needs global IP routing enabled before it forwards traffic between routed interfaces. Merely assigning addresses to interfaces does not enable the routing function.

Question 21Edge and Networking

Two VSX peers lose their ISL but can still reach each other over the keepalive path. What is the intended outcome?

  1. One peer retains the primary role and the other enters a secondary state to avoid split-brain. Correct answer.
  2. Both peers become primary and duplicate gateway MACs, causing a split-brain.
  3. Both peers reboot to elect a new conductor.
  4. The keepalive path is automatically converted into a new ISL.

Explanation

When the ISL fails but keepalive succeeds, the peers detect the condition and keep only one primary role so both do not actively claim the same resources. This prevents split-brain behavior until the ISL recovers.

Question 22Edge and Networking

In an EVPN-VXLAN fabric using a spine-leaf topology, what is the recommended role of the spine layer?

  1. It acts as the Layer 2 access layer where hosts connect.
  2. It performs DHCP and DNS services for the fabric.
  3. It runs the anycast gateway for all attached hosts.
  4. It provides high-speed IP transport between leaf switches and typically does not terminate overlay tunnels. Correct answer.

Explanation

Spines provide a routed, high-bandwidth underlay connecting all leaves, and in many designs they do not act as VTEPs. Hosts attach to leaves, which typically host the anycast gateway and overlay endpoints.

Question 23Edge and Networking

Which statement best describes the relationship between an Aruba gateway and Aruba access points in a tunneled wireless deployment?

  1. The gateway acts only as a DHCP server and never handles client data.
  2. The APs replace the gateway for all Layer 3 routing functions.
  3. The APs forward client traffic directly to the wired network without any gateway involvement.
  4. The APs build tunnels to the gateway, which applies policy and forwards client traffic. Correct answer.

Explanation

In a tunneled deployment, APs encapsulate client traffic to the gateway, which enforces policy and forwards the traffic into the network. This centralizes control while APs handle radio access.

Question 24Edge and Networking

Which HPE Aruba Networking solution is used to onboard, profile, and enforce policy for wired and wireless endpoints using role-based access?

  1. Aruba CX stacking
  2. Aruba AirMatch
  3. Aruba Smart Rate
  4. Aruba ClearPass Policy Manager Correct answer.

Explanation

ClearPass Policy Manager performs device profiling, onboarding, and role-based access enforcement across wired and wireless networks. AirMatch handles RF tuning, stacking merges switches, and Smart Rate concerns port speeds.

Question 25Edge and Networking

A network architect wants loop-free Layer 2 multipathing between two VSX pairs without relying on spanning tree blocking. Which approach fits?

  1. Static routes between all access switches
  2. Disabling all redundant links to avoid loops
  3. A single uplink from each pair with STP enabled
  4. Multichassis link aggregation (MC-LAG) across the VSX pairs Correct answer.

Explanation

MC-LAG allows links from downstream devices to terminate on both VSX peers as one logical aggregate, providing active-active multipathing without STP blocking. STP-based single uplinks would leave redundant paths unused.

Question 26Edge and Networking

Which HPE Aruba Networking switching feature allows an administrator to manage multiple physical CX switches as a single logical device with one control plane?

  1. VSF Correct answer.
  2. VSX
  3. MSTP
  4. VXLAN

Explanation

VSF (Virtual Switching Framework) stacking lets several Aruba CX switches operate as one logical stack sharing a single management and control plane. VSX is a two-node high-availability technology that keeps separate control planes synchronized, not a unified stack.

Question 27Edge and Networking

Which overlay data-plane encapsulation does an HPE Aruba EVPN-VXLAN fabric use to carry tenant traffic between leaf switches?

  1. VXLAN Correct answer.
  2. GRE
  3. MPLS
  4. IPsec

Explanation

EVPN-VXLAN fabrics encapsulate original Layer 2 or Layer 3 frames inside VXLAN UDP packets, with EVPN used as the control plane. GRE, IPsec, and MPLS are valid tunneling technologies but are not the encapsulation this fabric design specifies.

Question 28Edge and Networking

Which protocol is the dynamic underlay routing standard typically deployed on Aruba CX spine and leaf switches in an EVPN-VXLAN fabric?

  1. RIP
  2. BGP Correct answer.
  3. OSPF
  4. IS-IS

Explanation

BGP, usually eBGP, is the common underlay and overlay routing protocol in EVPN-VXLAN fabrics because it carries both IP reachability and EVPN address families. OSPF and IS-IS can provide underlay reachability but do not natively carry EVPN routes on Aruba CX.

Question 29Edge and Networking

Which HPE Aruba Networking solution provides a cloud-native, AI-driven operations platform for wired, wireless, and WAN infrastructure?

  1. Aruba AirWave
  2. Aruba Central Correct answer.
  3. Aruba ClearPass
  4. Aruba Fabric Composer

Explanation

Aruba Central is the cloud-based management and AIOps platform covering access points, switches, and gateways. ClearPass handles policy and NAC, Fabric Composer orchestrates fabric configuration, and AirWave is a legacy on-premises management product.

Question 30Edge and Networking

What does an Aruba CX switch do with an 802.1Q frame received on a port configured as an access port for VLAN 10?

  1. It rewrites the tag to VLAN 1 and forwards it
  2. It tunnels the frame to the controller
  3. It drops the tagged frame because access ports expect untagged traffic Correct answer.
  4. It forwards the frame untagged to all VLANs

Explanation

An access port belongs to a single VLAN and expects untagged traffic; a tagged frame arriving on it does not match the port configuration and is discarded. Trunk ports are the correct configuration for carrying 802.1Q tagged frames between switches.

Question 31Edge and Networking

Which Aruba CX command shows the interface IP addresses and link state in a compact table?

  1. show running-config
  2. show vlan
  3. show arp
  4. show ip interface brief Correct answer.

Explanation

The 'show ip interface brief' command lists each interface with its IP address and up/down status, which is useful for quick verification. The running-config shows configuration text, show vlan lists VLAN membership, and show arp lists address resolution entries.

Question 32Edge and Networking

Which protocol does an Aruba CX switch use to authenticate a wired supplicant against a RADIUS server before granting network access?

  1. RADIUS accounting
  2. TACACS+
  3. SNMPv3
  4. 802.1X Correct answer.

Explanation

802.1X is the port-based access control protocol that authenticates supplicants through a RADIUS server before the port is authorized. TACACS+ authenticates administrators for device management, not end-user ports, and SNMPv3 secures monitoring.

Question 33Edge and Networking

Which HPE Aruba Networking capability centralizes role-based access policy for both wired and wireless clients using a single policy engine?

  1. Aruba NetEdit
  2. Aruba Fabric Composer
  3. Aruba ClearPass Policy Manager Correct answer.
  4. Aruba Central NetConductor

Explanation

ClearPass Policy Manager provides role-based policy, profiling, and enforcement for wired and wireless clients from one policy engine. Fabric Composer and NetEdit are configuration tools, and Central NetConductor orchestrates fabric services rather than serving as the core policy engine.

Question 34Edge and Networking

An engineer wants two Aruba CX switches in a VSX pair to remain independently manageable while sharing a common control-plane state. Which statement describes the correct VSX design?

  1. Both peers run fully independent control planes with no synchronization
  2. The secondary peer forwards all traffic to the primary for processing
  3. The primary peer synchronizes control-plane state to the secondary peer over the ISL Correct answer.
  4. The pair requires a single shared management IP with no per-peer addresses

Explanation

VSX keeps two separate control planes but synchronizes critical state, such as ARP and MAC entries, from the primary to the secondary over the inter-switch link. Each peer retains its own management address, and traffic is forwarded locally rather than funneled through one peer.

Question 35Edge and Networking

In an EVPN-VXLAN fabric, which address family must BGP carry between leaf switches so they can advertise MAC and IP reachability for tenant hosts?

  1. IPv6 unicast
  2. IPv4 unicast
  3. VPNv4
  4. EVPN Correct answer.

Explanation

The EVPN address family carries the MAC/IP advertisement routes that let leaf switches learn remote host reachability across the overlay. IPv4 unicast provides underlay reachability, while VPNv4 is an MPLS Layer 3 VPN construct not used here.

Question 36Edge and Networking

A designer needs loop-free Layer 2 multipathing between two VSX pairs without spanning tree blocking redundant links. Which technology should be used?

  1. M-LAG with VSX Correct answer.
  2. MSTP
  3. PVST
  4. RSTP

Explanation

M-LAG combined with VSX allows two VSX pairs to form an active-active Layer 2 multichassis link aggregation group, so redundant links are forwarded rather than blocked. Spanning-tree variants would block redundant paths to prevent loops.

Question 37Edge and Networking

What is the purpose of the VSX keepalive link between two peers?

  1. To detect peer liveness and trigger split-brain handling when the ISL fails Correct answer.
  2. To provide the shared virtual MAC for the active gateway
  3. To synchronize the running configuration to the secondary peer
  4. To carry user data traffic between the peers

Explanation

The keepalive link carries heartbeat traffic so each peer can confirm the other is alive; if the ISL fails but the keepalive still succeeds, the peers take split-brain action. It does not carry user data, synchronize configuration, or supply the active-gateway virtual MAC.

Question 38Edge and Networking

An administrator wants a single Aruba AP to broadcast multiple SSIDs that map to different VLANs on the wired network. Which configuration accomplishes this?

  1. Multiple SSIDs each mapped to a distinct VLAN Correct answer.
  2. A single SSID with role-based VLAN assignment disabled
  3. One SSID with VLAN pooling
  4. One SSID with client isolation enabled

Explanation

Each SSID is a separate broadcast domain that can be mapped to its own VLAN, so multiple SSIDs on one AP provide multiple VLAN mappings. VLAN pooling aggregates addresses within one SSID, and client isolation affects peer traffic rather than VLAN mapping.

Question 39Edge and Networking

Which Aruba wireless feature improves client experience by steering clients to the best AP and band based on client capabilities and load?

  1. ARM
  2. ClientMatch Correct answer.
  3. Band steering
  4. AirMatch

Explanation

ClientMatch continuously evaluates client capabilities and RF conditions to steer clients to the most suitable AP and radio. AirMatch and ARM optimize RF channel and power planning, and band steering is a narrower capability focused on moving clients to 5 GHz.

Question 40Edge and Networking

An Aruba gateway terminates tunnels from branch access points. What is the primary benefit of this tunneled design?

  1. It centralizes policy enforcement and traffic inspection at the gateway Correct answer.
  2. It converts all wireless traffic to wired VLANs
  3. It removes the requirement for IP addressing at the branch
  4. It eliminates the need for any local branch switch

Explanation

Tunneling client traffic to a gateway lets the gateway apply centralized policy, firewall inspection, and role enforcement for branch users. Local switching at the branch is still needed, and IP addressing remains required for the APs and clients.

Question 41Edge and Networking

Which Aruba CX feature enables a routed port to participate in an OSPF area and advertise connected subnets to neighbors?

  1. Configuring the port as a trunk
  2. Enabling spanning tree on the port
  3. Assigning the port to a VSF stack
  4. Enabling OSPF on the interface and defining the area Correct answer.

Explanation

A routed interface must have OSPF enabled and be associated with an area before it forms adjacencies and advertises connected networks. Trunk configuration, stacking, and spanning tree relate to Layer 2 behavior and do not enable OSPF adjacencies.

Question 42Edge and Networking

What does an Aruba CX switch do when it receives a frame destined for a MAC address not present in its MAC table?

  1. It drops the frame immediately
  2. It generates an ICMP unreachable message
  3. It floods the frame out of all ports in the same VLAN except the ingress port Correct answer.
  4. It sends the frame to the default gateway

Explanation

Unknown unicast frames are flooded within the VLAN so the destination can be reached and its MAC learned from the reply. The switch does not drop the frame, consult a default gateway at Layer 2, or generate ICMP messages for switching decisions.

Question 43Edge and Networking

An engineer is troubleshooting an EVPN-VXLAN fabric where a host on one leaf cannot reach a host on another leaf. Which control-plane check most directly verifies remote MAC reachability?

  1. Verify the VSF stack membership
  2. Verify the spanning-tree topology on the spine
  3. Verify the local ARP table on the source leaf
  4. Verify the EVPN MAC/IP advertisement routes in BGP Correct answer.

Explanation

In an EVPN-VXLAN fabric, remote host reachability depends on EVPN MAC/IP advertisement routes being exchanged and installed, so inspecting BGP EVPN routes is the most direct check. Local ARP, spanning tree, and VSF membership do not confirm that remote MAC routes were learned.

Question 44Edge and Networking

Why does an Aruba CX switch use a dedicated management VRF?

  1. To increase the switching throughput of user ports
  2. To isolate management-plane traffic from user data-plane traffic Correct answer.
  3. To replace the need for a default gateway
  4. To allow management traffic to bypass authentication

Explanation

A dedicated management VRF separates management-plane traffic from user data-plane traffic, improving security and operational clarity. It does not boost user throughput, replace default gateway requirements, or bypass authentication.

Question 45Edge and Networking

An Aruba CX switch port is configured as a routed interface but remains down. Which condition most likely explains the failure?

  1. The port has no IP address assigned Correct answer.
  2. The port is configured as a trunk
  3. The port is a member of a VSF stack
  4. The port is assigned to a VLAN and is administratively up

Explanation

A routed interface needs an IP address to be operational and to participate in routing; without one it will not come up for routed traffic. VLAN assignment, trunk configuration, and VSF membership do not by themselves prevent a routed port from functioning.

Question 46Edge and Networking

Which statement correctly describes the role of the Aruba CX spine layer in a VXLAN fabric?

  1. It terminates all client wireless tunnels
  2. It provides high-speed IP transport between leaf switches Correct answer.
  3. It performs MAC learning for all tenant hosts
  4. It acts as the default gateway for every tenant

Explanation

Spines provide the routed, high-speed IP transport that connects every leaf, forming the fabric underlay. Leaf switches perform host MAC learning and typically host the distributed anycast gateway, while wireless tunnels terminate on gateways.

Question 47Edge and Networking

A VSX pair loses its ISL while the keepalive link remains up. What split-brain action should the administrator expect?

  1. Both peers continue forwarding all traffic independently
  2. The keepalive link is promoted to carry user data
  3. Both peers reboot to re-form the pair
  4. The secondary peer disables its VSX interfaces to prevent duplicate forwarding Correct answer.

Explanation

When the ISL fails but keepalive succeeds, VSX detects the split-brain condition and the secondary peer disables its VSX-related interfaces so traffic is not duplicated. The peers do not both forward independently, reboot, or repurpose the keepalive link for user data.

Question 48Edge and Networking

In an EVPN-VXLAN fabric, what does a leaf switch use the VXLAN network identifier for?

  1. To identify the physical spine used for forwarding
  2. To identify the RADIUS server for authentication
  3. To identify the tenant Layer 2 segment carried in the overlay Correct answer.
  4. To identify the spanning-tree root bridge

Explanation

The VXLAN network identifier, or VNI, identifies a specific tenant Layer 2 segment in the overlay so frames are placed in the correct broadcast domain. It does not identify physical spines, RADIUS servers, or spanning-tree roots.

Question 49Edge and Networking

An administrator wants to apply the same role-based policy to a user regardless of whether the user connects over wired or wireless access. Which Aruba design achieves this?

  1. Disabling 802.1X on wireless to match the wired configuration
  2. Relying on VLAN assignment alone for both media types
  3. Configuring separate ACLs on each access switch and each SSID
  4. Using ClearPass role mapping enforced consistently at the enforcement points Correct answer.

Explanation

ClearPass maps users to roles and the same role-based policy is enforced at both wired and wireless enforcement points, giving consistent treatment across media. Separate per-device ACLs diverge over time, VLAN assignment alone does not express role policy, and disabling authentication weakens security.

Question 50Edge and Networking

A network architect is designing an EVPN-VXLAN fabric and wants to avoid stretching a VLAN across the entire data center. Which design approach best meets this goal?

  1. Extend the same VLAN to all leaves using MSTP
  2. Use EVPN to provide Layer 2 stretch only where required and route between segments at the leaves Correct answer.
  3. Use VSF to stack all leaves into one logical switch
  4. Configure all leaves as access ports in VLAN 1

Explanation

EVPN allows targeted Layer 2 extension only where a segment is genuinely needed, while inter-segment traffic is routed at the leaves, avoiding large stretched VLANs. Extending a VLAN everywhere, using VLAN 1 broadly, or stacking all leaves defeats the scaling and fault-containment goals.