HPE Aruba Campus Access Mobility Expert (HPE7-A07) Certification Sample Questions

02. A penetration test finds that the SSH and HTTPS management interfaces of the campus AOS-CX switches and gateways answer from every user VLAN, including guest. Management from the NOC must keep working, and user traffic forwarding must not change.
Which two changes best address the finding?
(Select two.)
a) Move device management into a dedicated management VRF or network
b) Restrict management access to the NOC's source addresses
c) Enable HTTPS certificate checking on the management interfaces
d) Move SSH and HTTPS to non-standard ports to evade user VLAN scans
e) Require 802.1X on the management interfaces for each login

03. Two AOS-CX switches connected by a routed link fail to reach a full OSPF adjacency. Area, subnet, network type, and hello and dead intervals all match. The neighbor state stays at EXSTART or EXCHANGE and resets repeatedly. Last week a storage project changed the IP MTU on several interfaces in the building.
What is the most likely cause?
a) The two switches share the same router ID, so each rejects the other's LSAs
b) The link is a broadcast network type, so the switches are waiting for a DR election
c) The interfaces have mismatched IP MTU values, which stalls the database exchange
d) One side is configured as a stub area while the other side is a normal area

04. An AOS-CX distribution switch runs OSPF on its core uplinks and on the SVIs for 30 user VLANs, because those subnets must be advertised. A security audit shows OSPF hellos being sent into every user VLAN and warns that a rogue device could form an adjacency and inject routes.
Which two changes would each stop a rogue adjacency while the distribution switch keeps advertising the user subnets in OSPF?
(Select two.)
a) Increase the OSPF hello interval on the user VLAN interfaces
b) Move the user VLAN interfaces into a separate stub area
c) Remove the user VLAN interfaces from OSPF and use static routes on the core
d) Configure the user VLAN interfaces as passive interfaces in OSPF
e) Require OSPF authentication on every interface that runs OSPF

05. On a bridged 802.1X SSID, a ClearPass posture check moves non-compliant laptops into a quarantine role that carries VLAN 90. ClearPass sends a CoA after the check, and the AP applies the new role and VLAN. The affected laptops then lose all connectivity, and their IP configuration still shows an address from the employee VLAN.
What is the most likely reason the laptops lose connectivity?
a) VLAN 90 has no DHCP scope, so the laptops cannot obtain a quarantine address
b) The VLAN changed mid-session, but nothing made the laptops request a new address
c) The CoA failed, so the laptops stayed in the employee role but are blocked by the posture result
d) The quarantine role denies ARP, so the laptops cannot resolve their default gateway

06. ClearPass's EAP server certificate was replaced with one issued by the company's new internal CA. The next morning, managed laptops fail to connect to the EAP-TLS SSID. Access Tracker shows each attempt stopping just after ClearPass sends its certificate, with the client ending the exchange, and ClearPass never receives a client certificate. Client certificates were not changed.
What is the most likely cause?
a) The laptops do not yet trust the new CA that issued ClearPass's certificate
b) ClearPass does not trust the CA that issued the laptops' certificates
c) The SSID's EAP method was changed to PEAP when the certificate was replaced
d) The laptops' certificates expired when ClearPass's certificate was replaced

07. Users in one meeting room report slow file downloads over Wi-Fi. The room's AP shows strong client signal, good SNR, low retry rates and modest channel utilization, while clients on neighboring APs download several times faster. A wired test on the AP's switch port shows the link negotiated at 100 Mbps.
Which two items should be checked to restore full throughput?
(Select two.)
a) The co-channel overlap between this AP and its neighbors
b) The number of APs in the room and whether a second AP is needed
c) The speed and duplex settings on the switch port
d) The cabling and patch cords between the AP and the switch
e) The clients' signal strength and MCS rates in the room

08. On a tunneled SSID, most of the broadcast frames that APs transmit are ARP requests from the gateway and wired hosts looking for wireless clients. The gateway already knows every wireless client's IP-to-MAC binding from DHCP. The team must cut this airtime without splitting the VLAN.
Which approach meets the requirement?
a) Lower the DTIM period so that buffered broadcasts reach sleeping clients more often
b) Let the gateway answer or unicast ARP for known clients rather than flooding it
c) Move the wireless clients into a VLAN pool so that each ARP request reaches fewer APs
d) Block all ARP traffic on the SSID so that clients and hosts rely on their cached entries

09. During a rushed installation, APs with integrated omnidirectional antennas designed for ceiling mounting were fixed to corridor walls at desk height in a clinic. Coverage is strong along the corridors near each AP but weak in the treatment rooms on the same floor, and clients on the floor above associate to these APs.
Which two changes would each correct the coverage pattern?
(Select two.)
a) Use AP models whose antennas are designed for wall mounting
b) Raise the transmit power so the signal reaches into the treatment rooms
c) Remount the APs on or near the ceiling as their antenna pattern expects
d) Disable the lowest data rates so clients upstairs stop associating
e) Create a separate SSID for each floor so clients join only local APs

10. An 802.1X SSID tunnels to an AOS 10 gateway cluster. A new ClearPass enforcement profile returns the role name contractor-restricted for contractors. Access Tracker shows the contractors accepted with that role in the Access-Accept, yet on the gateway they receive the SSID's default authenticated role and full employee access.
What is the most likely cause?
a) The contractors' credentials failed, so the gateway placed them in the SSID's default role instead
b) ClearPass must return a VLAN instead of a role name for a tunneled SSID
c) The gateway always applies the SSID default role and ignores any role that ClearPass returns
d) No role named contractor-restricted exists on the gateway, so it falls back to the default role