HPE Aruba Campus Access Switching Expert (HPE7-A06) Certification Sample Questions

02. Two AOS-CX distribution switches are meant to be in the same MSTP region. Comparing their MSTP configuration shows the same region name on both, a configuration revision of 2 on one and 3 on the other, and VLANs 10-20 mapped to instance 1 on one switch but to instance 2 on the other. Both run MSTP on the link between them, and traffic for some VLANs blocks on unexpected ports.
Which two settings must be made identical for the switches to form one region?
(Choose two.)
a) The root bridge of each MSTP instance
b) The bridge priority of each switch
c) The VLAN-to-instance mapping
d) The port path cost of the interconnect
e) The configuration revision number

03. A distribution center is moving its 802.1X SSID on Wi-Fi 6 APs to WPA3-Enterprise. The SSID is broadcast on 2.4 GHz and 5 GHz only. New laptops support WPA3, but several hundred handheld scanners support only WPA2-Enterprise and cannot be replaced this year. Security requires 802.1X for every device, and there is no requirement for the 192-bit suite.
Which security mode meets the requirements on a single SSID?
a) WPA3-Enterprise 128-bit in WPA3-only mode, which requires protected management frames
b) WPA3-Enterprise 128-bit in transition mode, which admits WPA2-Enterprise clients as well
c) WPA3-Enterprise 192-bit mode, which enforces the CNSA suite for every client
d) Enhanced Open combined with MAC authentication, which needs no client credentials

04. An IT administrator installs an HPE Aruba Networking User Experience Insight (UXI) sensor on a branch access switch port. The port shows link up and PoE delivering, and the switch's DHCP snooping table shows the sensor obtained an address. Hours later the sensor still has not appeared in the UXI dashboard. The branch firewall permits outbound traffic only to an approved list of destinations.
What is the most likely cause?
a) The sensor is still booting and will register on its own shortly
b) The sensor requires a multi-gigabit port rather than a 1 Gbps port
c) The switch port lacks the PoE budget to power the sensor's radios
d) The sensor cannot reach the UXI cloud through the branch firewall

05. A company is planning a group-based policy (GBP) rollout across 40 AOS-CX access switches connected by a VXLAN fabric. Contractors must never reach the finance servers, wherever either of them connects, and the security team wants a single place to review role-to-role rules.
Which practice keeps role-to-role enforcement consistent across the fabric?
a) Define roles and group policy IDs centrally so every fabric device maps each role to one ID
b) Express the contractor rule as IP ACLs on every access switch, matching the finance server subnets
c) Define the roles on each switch by hand and let each switch assign its own group policy IDs to them
d) Enforce the contractor rule only on the ingress switch, since that switch knows the contractor's role

06. On a VSX aggregation pair, lag 1 is a multi-chassis LAG to the core with OSPF running on its SVI, and lags 11-40 are multi-chassis LAGs to access stacks. After the secondary reboots, the link-up delay holds its LAGs down while ARP and MAC tables resynchronize. When the access LAGs come back, the secondary briefly blackholes northbound traffic because it has not yet learned the core routes.
Which change resolves the blackhole?
a) Set the link-up delay timer to zero so that every LAG returns as soon as the reboot completes
b) Exclude the ISL LAG from the link-up delay so that table synchronization completes sooner
c) Exclude lag 1 from the link-up delay so that OSPF learns core routes before access LAGs return
d) Exclude lags 11-40 from the link-up delay so that access clients regain service sooner

07. A customer is deploying PoE-powered IoT security sensors on AOS-CX access switches. Because they are critical, the sensors must stay powered while a switch reloads during a software upgrade. Each sensor connects to a single access switch port, and data loss during the reload itself is acceptable.
Which feature meets the requirement?
a) Always-on PoE, which keeps power through a soft reboot
b) Quick PoE, which powers ports soon after a cold boot
c) PoE priority set to critical on the sensors' ports
d) A VSX pair of switches so the sensors fail over to the peer

08. An AOS-10 campus tunnels its 802.1X WLAN to an L2-connected HPE Aruba Networking Gateway cluster whose members share the same management and user VLANs. ClearPass Policy Manager is the RADIUS server. The design review must state correctly how authentication and client state behave in this architecture.
Which two statements are true?
(Choose two.)
a) The gateway terminates 802.1X and holds the client keys, as the Mobility Controller did in AOS-8
b) Losing connectivity to HPE Aruba Networking Central drops the authenticated sessions on the WLAN
c) If a client's designated gateway fails, the client moves to its standby gateway with state intact
d) The AP is the 802.1X authenticator, while the gateway proxies RADIUS toward ClearPass for the AP
e) Each client keeps a single designated gateway with no standby, so a failure forces reauthentication

09. A hotel group is rolling out AOS-10 APs managed from HPE Aruba Networking Central, and employees authenticate with 802.1X against ClearPass Policy Manager. Guests must be individually accountable through a front-desk sponsor approving each registration, must never reach internal subnets and must not affect the employee WLAN's security settings.
Which design meets these requirements most securely?
a) Separate SSIDs, with sponsored ClearPass Guest login and a guest role denying internal subnets
b) A separate guest SSID using MAC authentication against a ClearPass list of registered guest devices
c) One SSID for everyone, with 802.1X for employees and a captive portal for guests on the same network
d) A separate guest SSID secured with a WPA2 passphrase printed at reception and mapped to a guest VLAN

10. AOS-CX access switches are being integrated with ClearPass for dynamic segmentation using downloadable user roles (DUR). ClearPass's HTTPS certificate is signed by the company's internal CA. In testing, Access Tracker shows an accept that names a downloadable role, but the switch reports that the role could not be downloaded and the client stays unauthorized. The switch resolves ClearPass's FQDN correctly.
Which two prerequisites should be verified on the switch?
(Choose two.)
a) RADIUS change of authorization enabled from ClearPass to the switch
b) Trust in the internal CA that signed ClearPass's HTTPS certificate
c) ClearPass credentials the switch uses to authenticate the download
d) A switch certificate signed by ClearPass's CA for mutual TLS on the download
e) Local roles with the same names as the downloadable roles, created empty