HPE Network Switching Expert (HPE7-A09) Certification Sample Questions

01. Three capacity constraints have been identified: an access closet approaching its uplink limit, an aggregation pair whose table occupancy is rising, and a campus exit at moderate utilization. The customer plans to add a large department next quarter. Which should be relieved first?
a) The access closet, since it is closest to its limit and its users would be the first to experience the consequences
b) The one the planned growth will push past its limit soonest, judged against how long each remedy takes to deliver
c) The aggregation pair, since table exhaustion degrades forwarding for every segment rather than for one closet
d) The campus exit, since it carries traffic from the whole estate and the new department will add to all of it

02. An operations team is writing a configuration standard for its access switches with the explicit aim of reducing ongoing effort. Which two properties of the standard would deliver that?
(Select two answers)
a) Compliance with it can be checked automatically rather than by inspection
b) It documents the rationale for each setting so that future engineers understand why it was chosen
c) It reduces the number of distinct configurations the team has to understand and maintain
d) It covers every setting on the switch so that nothing is left to individual discretion

03. Guest endpoints are placed in a segment that should reach only the internet. An audit finds that a guest can reach an internal application server. The access policy applied to the guest ports is correct and is being enforced. Where should the investigation go next?
a) To the application server, since it may be reachable through a second interface that sits outside the internal network
b) To the policy source, since the guests may be receiving a role other than the one intended for them at the point of connection
c) To the segment assignment, since the guest endpoints may be landing in a segment other than the one reserved for guests
d) To the routing, since a correctly enforced port policy still permits anything it was not written to deny once the traffic is routed

04. A team performs a post-change verification after every maintenance activity, but problems are still being reported by users the following morning. Which three elements would make that verification meaningful?
(Select three answers)
a) It compares results against the baseline captured before the change
b) It is recorded in the change record so that the outcome is auditable afterwards
c) It covers the paths and populations the change could plausibly have affected, not only the devices touched
d) It is performed by an engineer who was not involved in making the change, so that assumptions are not carried into the check
e) It exercises the functions users depend on rather than the state of the devices that were changed

05. Within one minute, the platform records an uplink down on an access switch, a routing adjacency loss on a distribution switch, high processor load on a core switch, and dozens of endpoint disconnections. Timestamps are consistent across all devices.
How should the engineer identify the causal event?
a) Identify the event affecting the largest number of users, since the causal event is the one with the widest blast radius
b) Order the events by time, and test whether the earliest could produce the later ones through a known dependency
c) Identify the event that persists after the others have cleared, since the causal condition remains while its effects resolve
d) Identify the event at the highest layer of the topology, since a fault at the core propagates downwards to the access layer

06. Statistics are aggregated before storage. Too coarse an interval hides the short congestion events the team is chasing; too fine an interval produces more data than anyone reviews and makes ordinary variation look like a problem. How should the interval be chosen?
a) From the interval at which the operations team reviews the data, so that each review covers a whole number of aggregation periods
b) From the polling interval already in use, so that the aggregation does not combine measurements taken at different times
c) From the duration of the events that must be visible, so the interval is short enough to contain one
d) From the volume of data the platform can retain, so that the desired history fits within the available storage capacity

07. A serious fault is affecting a production building, and management has instructed that service be restored immediately. The engineer expects the fault to recur and wants a diagnosis to remain possible afterwards. Which three actions preserve the evidence?
(Select three answers)
a) Leave the affected devices reachable so that the state can be examined once service has been restored
b) Change one thing at a time, so that the action which restored service is known
c) Raise the logging detail on the affected devices before restoring service, so that more information is recorded
d) Record the exact time of each action taken during the restoration
e) Capture the current device state before making any change

08. Analysis of a recurring performance complaint concludes that the delay is being introduced beyond the campus boundary, in a service the network team does not operate. What is the appropriate response?
a) Hand over the evidence that localizes the delay, and keep measuring so the campus contribution stays known
b) Re-run the analysis with finer measurement to confirm the conclusion before raising it with the other party
c) Close the investigation and record that the cause lies outside the scope of the wired network
d) Apply a prioritization policy to the affected traffic so that the campus contributes as little delay as possible while the other party investigates

09. A team is deciding which of the metrics it collects should raise an alert and which should simply be available on a dashboard. Which two properties make a metric worth alerting on?
(Select two answers)
a) The metric is one that the platform can display alongside related metrics for the same device
b) Crossing its threshold indicates a condition somebody is expected to act on
c) The metric is collected frequently enough to show short-term variation in its value
d) The condition would otherwise be discovered by users before the team noticed it

10. An incident went undetected for several hours. It began as a single access switch losing one of its two uplinks; the second uplink carried the load until it too became congested, at which point users complained. Which monitoring change would have detected it earliest?
a) Alerting on user-experience measurements from that building, so that degradation is detected without depending on users to report it
b) Alerting on utilization of the surviving uplink, so that the rising load is noticed before it reaches the point of congestion
c) Alerting on the loss of redundancy itself, rather than on the congestion that eventually followed it
d) Alerting on the error counters of both uplinks, so that a link degrading towards failure is identified before it goes down