HPE Networking CX 10000 (HPE6-A87) Certification Sample Questions

02. A company's security engineers sign in with Active Directory accounts and belong to the AD group SecEng. The directory is reachable only over LDAP, and a PSM Role with the permissions they need already exists.
Which two configurations give the SecEng members that access in PSM?
(Select two.)
a) A Policy Distribution Target naming the SecEng group
b) A Role Binding that maps SecEng to the existing Role
c) An LDAP authenticator using the Active Directory provider
d) A RADIUS authenticator configured for the SecEng group members
e) A new tenant created for the SecEng group

03. PSM raises an event reporting that a DSS has reached its maximum connections-per-second (CPS) limit. What does that event tell the engineer about the DSS?
a) Its new-connection setup rate hit the maximum
b) Its uplinks to the spines reached full bandwidth
c) Its policy reached the maximum number of rules
d) Its firewall-log space in PSM is full

04. A network engineer has a Fabric Composer account but no PSM login. The engineer must review which leaf ports an ESXi host's VMs connect through, and the alerts PSM has raised for the CX 10000 switches. Which two Fabric Composer features cover these tasks?
(Select two.)
a) The API Explorer
b) The Statistics visualization
c) The Firewall Log page in the Policy menu
d) The PSM Alerts page in the Policy menu
e) The Host visualization

05. On the Fabric Composer dashboard, one leaf switch's square shows the critical-issue state. The engineer wants to see what problem the fabric is reporting for it. Which System menu entry should the engineer open?
a) Configuration Editor
b) Health
c) Remote Sites
d) API Explorer

06. A newly deployed payroll VM lands on an ESXi host that is already included in Fabric Composer microsegmentation. An Allow rule from the payroll Endpoint Group to the database Endpoint Group is in place. The older payroll VMs reach the database normally, but the new VM cannot.
What is the most likely cause?
a) The host must be added again with Update Microsegmentation before any VM on it is filtered
b) The Enforcers omit the database network, so the rule is not applied on that network
c) The new VM is not a member of the payroll Endpoint Group, so no Allow rule matches its traffic
d) The rule identifies the service with a Service Qualifier and not with an Application

07. An ESXi host is meant to be dual-homed to both leaf switches of a VSX pair. In the Fabric Composer Host visualization, the host appears with a path to only one of the two leaves, while its VMs and VMkernel adapters are listed normally.
What is the most reasonable conclusion?
a) The second leaf has not been admitted to the PSM cluster
b) The vSphere integration has stopped reporting that host
c) The second leaf is not in a VSX pair in Fabric Composer
d) The host's connection to the second leaf is missing or down

08. VRF Prod holds networks App, DB and Web, and more networks will be added next quarter. A baseline policy must cover every current and future Prod network, and a stricter policy must apply to the Web network only.
Which two attachments meet both requirements?
(Select two.)
a) Attach the baseline policy to App, DB and Web
b) Attach the baseline policy to VRF Prod
c) Move Web into a VRF of its own with the stricter policy
d) Attach the stricter policy to the Web network
e) Attach the stricter policy to VRF Prod

09. After a Distributed Firewall policy was applied in Fabric Composer, users of an application tier lose access to its database tier. The firewall logs show Deny records from the application Endpoint Group to the database Endpoint Group on the database's service port.
What do those records most likely indicate?
a) No Allow rule matches that traffic
b) The log severity is Deny, which hides Allow records
c) IPFIX export is off, so allowed flows go unrecorded
d) The database hosts are left out of microsegmentation

10. PSM is integrated with vCenter and lists the hosts and workloads correctly. For one ESXi host, however, PSM shows no mapping to the DSS the host is cabled to, while the other hosts map as expected. What is the most likely cause?
a) The host's workloads belong to a VRF with no attached policy
b) The LDAP authenticator is ranked below the Local one
c) vCenter reports no LLDP neighbor details for that host
d) The DSS for that host has no firewall-log export policy