HPE Networking Central Exam Questions and Answers
On which device types can HPE Aruba Networking Central run connectivity and protocol tests?
Options:
Access points, bridges, gateways, and AOS-CX/AOS-S switches
Gateways, air monitors, mobility conductors, and DHCP servers
Access points, VPN concentrators, ClearPass servers, and core routers
Switch stacks, NAC appliances, endpoint agents, and internet firewalls
Answer:
AExplanation:
Technical explanation
Built-in tests run against supported Central-managed infrastructure, and available commands depend on the device type and release. APs, gateways, bridges and AOS-CX/AOS-S switches can expose appropriate ping, traceroute, DNS, cable or protocol diagnostics through their supported tools. A ClearPass appliance or arbitrary third-party firewall is not automatically a Central-managed troubleshooting endpoint. Choose the correct test origin; performing DNS resolution from an AP is not equivalent to testing client DNS access when the two paths use different policies.
Air monitors, conductors and DNS appliances are not all standard managed sources of these troubleshooting tests. Likewise, ClearPass servers and arbitrary firewalls are separate products, not automatically Central test endpoints. The capability follows supported managed device families.
Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central
A site requires role-based traffic inspection to be performed by Gateways. Which configuration meets this requirement?
Options:
Microbranch SSID with Centralized policies
Tunneled SSID with Centralized policies
Mixed SSID with Centralized policies
Answer:
BExplanation:
Technical explanation
A tunneled SSID sends the relevant wireless user traffic to a gateway cluster, where the gateway can evaluate its stateful role-based policies. Confirm that the client's role is assigned at authentication, that the correct rules are installed at the gateway, and that user VLANs terminate on the cluster. Bridged forwarding keeps the datapath local, so policies on a remote gateway cannot inspect those frames. Mixed mode may tunnel selected VLANs, but the simple and unambiguous choice for all affected users is tunneled forwarding. If gateway inspection is mandatory for every client in the given role, mixed forwarding introduces an avoidable bypass condition because a locally bridged VLAN can avoid the gateway datapath.
Microbranch patterns provide selective site forwarding but do not automatically place every target session in the gateway datapath. Mixed mode can bridge some clients locally, bypassing centralized inspection. Tunnel mode makes gateway-side enforcement the explicit default path.
Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
When launching HPE Aruba Networking Central from HPE GreenLake, what is the initial landing page?
Options:
The license subscription page that shows key distribution, expiration status, and utilization totals
The alerts reporting page that ranks active alert instances and supports search and filtering tools
The network overview dashboard that summarizes network state and highlights items needing action
The device inventory page that lists devices and allows filtering by type and assignment status
Answer:
CExplanation:
Technical explanation
The network overview provides initial orientation: overall sites, client health, device condition, active alerts and operational issues requiring follow-up. It supports a drill-down workflow from high-level impact to individual sites and devices. Inventory and licensing are specialized administration views; neither is a comprehensive home dashboard for network state. Operators should confirm selected tenant and workspace because administrative context determines which sites and subscriptions are visible after launching Central from GreenLake.
The subscriptions page is an administrative entitlement view, alerts show exceptions, and inventory shows the device roster. Network overview is the broader landing context for health, sites, clients, and conditions needing investigation.
Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central
Which design ensures continuous WLAN coverage if an AP fails?
Options:
Deploy APs in overlapping coverage zones.
Create a custom 'single channel' RF profile.
Increase transmit power to maximum on all Aps.
Answer:
AExplanation:
Technical explanation
Design overlapping coverage cells such that a client can detect and associate to an alternative AP if a neighbor fails. Validate the secondary AP's signal strength, channel availability and capacity under a failure scenario rather than relying on a fixed overlap percentage. Survey from client height and account for wall attenuation, antenna patterns and voice-roaming requirements. Setting maximum EIRP everywhere tends to enlarge contention domains, while forcing all radios onto one channel undermines spatial reuse and reliable failover.
A single shared channel causes more co-channel contention, not resilient coverage. Maximum transmit power may make APs visible from farther away while clients still lack a viable return link. Redundancy requires usable neighboring coverage with capacity to absorb failures.
Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
A branch needs SaaS traffic to exit locally with corporate application traffic routed through a Gateway. Which configuration will achieve this?
Options:
Full tunnel for all applications to the gateway
Bridge mode for all traffic from the AP
Split-tunnel with app-based traffic steering
Answer:
CExplanation:
Technical explanation
Application-aware traffic steering selects appropriate paths according to intended access: internet/SaaS sessions exit directly at the branch, while protected corporate destinations traverse a secure tunnel to the central gateway or VPNC. Define the traffic identification, routing policy and NAT behavior so enterprise prefixes are not accidentally leaked onto the public internet. Validate DNS steering and failover when the primary tunnel becomes unavailable. Full tunneling adds needless SaaS backhaul, while bridging everything removes the central enterprise inspection and reachability requested. For a SaaS call, local breakout avoids an unnecessary detour through the data center, while a private ERP connection remains tunneled. Validate DNS steering and how the return traffic selects its route.
A full tunnel hairpins SaaS traffic to the corporate gateway; pure bridging loses the desired corporate tunnel path. Application-aware split tunneling distinguishes the two destinations. VPN reachability, DNS behavior, and return routes must support both paths.
Official HPE references | Layer 3 Microbranch - Validated Solution Guide • Configuring VLANs - Microbranch | Study-guide topic: Introduction to AOS-10
You suspect DNS resolution failures of wireless clients. Which HPE Aruba Networking Central tool confirms name-resolution status from the AP?
Options:
Run an NSLookup in the Troubleshoot panel.
Review event logs only.
Check firmware compliance.
Answer:
AExplanation:
Technical explanation
NSLookup from the AP's troubleshooting context checks whether that network device can reach its configured resolver and translate the requested hostname. Use an internal and external test name to distinguish local-zone problems from general DNS reachability. Record the query result, resolver address, timeout behavior and source network. A successful AP DNS test does not guarantee client DNS works if clients use a different VLAN, resolver, ACL or captive-portal role; test the client path independently when symptoms remain.
Event logs might suggest a DNS timeout but do not execute an actual lookup, and firmware compliance is unrelated to resolver behavior. AP-based NSLookup tests the AP’s DNS context; client VLANs and resolvers still require their own verification.
Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central
You need to define DHCP relay settings for multiple VLANs across all access switches. Which configuration method is the most efficient?
Options:
Create a Port profile with DHCP options to each all-access switches
Create a System profile for VLAN-specific DHCP relay configuration
Create a VLAN profile including DHCP helper settings and assign by site
Answer:
CExplanation:
Technical explanation
A VLAN profile allows DHCP helper-address configuration to follow the VLAN's Layer 3 interface requirements rather than attaching IP relay settings to an unrelated physical access port. Ensure that an SVI exists and has Layer 3 reachability to the DHCP server; DHCP relay is meaningful on the routing device that receives the broadcast. Scope the VLAN profile to the intended site and device functions and check whether any switch needs a unique local SVI address. Validate that both request and reply traffic can traverse the VRF and ACL policies. The VLAN profile workflow starts at Configuration > VLANs & Networks > VLAN > Create Profile, with the desired scope and switch function selected.
A port profile describes physical or logical interface attributes, not VLAN-specific relay across all switches. A generic System profile does not replace the VLAN/SVI-facing helper relationship; tie the helper to the routed VLAN at the intended scope. Be precise about the Layer 3 termination: DHCP relay runs where the client VLAN broadcast reaches a routed VLAN interface. Defining a helper on a switch that only transports the VLAN at Layer 2 will not relay those broadcasts.
Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
You need a routing policy at a specific location without changing other sites. Where should you place the configuration, so inheritance behaves as intended?
Options:
Site level for the affected location to override global scope
Device level to force changes up the hierarchy
Site collection level to merge with device level equally
Answer:
AExplanation:
Technical explanation
Choose the affected site, associate the correct device function and apply the routing configuration at that scope. The effective configuration is determined by Central's profile association and inheritance rules, including whether an object is shared or local; a site-level adjustment should not be assumed to propagate into other sites. Verify any cross-scope dependencies such as VRFs, interfaces, next hops and named objects. After deployment, compare the site's effective settings and switch routing table with an unaffected location to ensure no unintended global change.
Device scope is more specific but does not propagate “up” the hierarchy. Site collection affects multiple sites if inherited, making it too broad. Site scope retains the global baseline elsewhere while allowing the targeted routing configuration to differ.
Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Network Management with HPE Aruba Networking Central
A retail branch needs POS traffic to be forwarded locally but guest traffic forwarded through a Gateway located in a DMZ. Which SSID mode meets this requirement?
Options:
Tunnel mode
Mixed mode
Bridge mode
Answer:
BExplanation:
Technical explanation
A mixed-mode SSID supports both bridged and tunneled forwarding, selected according to the client VLAN and deployment configuration. Put POS endpoints in the locally bridged role/VLAN where latency-sensitive branch processing must remain onsite; tunnel the guest VLAN toward a DMZ gateway cluster where centralized inspection is required. Ensure guest VLANs terminate on gateways and are not accidentally carried onto the AP's local switching trunk. Mixed mode is not arbitrary per-packet application steering; the forwarding selection must match the actual WLAN/VLAN policy. Under mixed forwarding, the relevant VLAN assignment decides the datapath. Ensure POS VLANs are permitted on the local AP uplink, while the guest VLAN is present on the gateway cluster for tunneling.
All-tunnel forwarding would backhaul the POS transactions unnecessarily; all-bridge forwarding would bypass the DMZ gateway for guests. Mixed forwarding is selected per VLAN/client role, so different VLANs require the intended bridge/tunnel mapping and uplink support. The AOS-10 WLAN wizard exposes Traffic Forwarding Mode = Mixed in its VLAN settings, with a primary gateway cluster for tunneled VLANs.
Official HPE references | AOS-10 Traffic Forwarding Modes • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10
You must provision 30 access switches on different sites at once with identical VLAN and syslog settings. Which feature allows this at scale?
Options:
Assign new switches to a device group and apply VLAN and Syslog server profiles to the Device group.
Assign new switches to their respective sites and apply VLAN and Syslog server profiles to the global level.
Assign new switches to a new temporary site and apply VLAN and Syslog server profiles to that site.
Answer:
AExplanation:
Technical explanation
A device group is a logical configuration target independent of physical site membership, making it suited to switches distributed among 30 branches. Associate common VLAN and syslog profiles with that group, then assign each switch to its genuine physical site for operational reporting. Confirm that site-level variations such as management addresses or local gateway IPs are not accidentally overwritten. A temporary site falsifies location data, and global scope would apply configurations to more devices than the intended group.
Global scope risks including switches outside the intended thirty. Assigning everything temporarily to one site falsifies location and complicates operational visibility. Device-group scope permits common configuration across real sites without corrupting site membership. Create the profiles under Configuration at Device Groups scope, then apply them to the switch function; keep each switch associated with its actual site.
Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
Leadership asks how HPE Aruba Networking Central will improve operations across multiple sites. Which description applies?
Options:
Using different workspaces allows multisite device management
Cloud-native platform with AI insights, unified workflows, and APIs
SNMPv3 allows the secure management of multiple site devices
Answer:
BExplanation:
Technical explanation
A cloud-native management plane integrates deployment, monitoring, troubleshooting, security posture and software maintenance across geographically separated sites. AI-based correlations help focus investigations, while APIs allow authorized external workflows to inventory devices, retrieve statistics or make controlled configuration updates. Unified operation does not depend on SNMPv3 alone; SNMP is one management protocol and cannot supply all policy, firmware and client-experience functions. Workspaces govern administrative organization and delegation, but they do not themselves replace the multi-site management architecture.
A workspace defines organizational separation, not by itself an operating model for coordinated multi-site management. SNMPv3 secures one management protocol but does not produce Central’s configuration inheritance, AI analysis, and cross-domain workflows.
Official HPE references | Application Programming Interface (API) FAQ • Multi-Level Hierarchy | Study-guide topic: Network Management with HPE Aruba Networking Central
Where can you see the aggregate AP status?
Options:
RF Optimization Page.
Topology Map.
Device Health card.
Answer:
CExplanation:
Technical explanation
The Device Health card summarizes how many access points are healthy, impaired or offline within the current site or global context. Its expanded representation can break counts down by site and by device class, helping the administrator rank incidents by blast radius. Distinguish an unreachable device from one still online but reporting degraded hardware or service health. RF Optimization is for radio planning, and topology is for connectivity relationships; aggregate health counts belong to the dedicated health view.
Topology says where APs attach; RF Optimization addresses channel/power behavior. Device Health is built to aggregate operational status and direct the engineer toward offline or degraded APs.
Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central
Why has digital transformation increased the importance of the enterprise network?
Options:
Emerging technologies drive higher expectations for performance, security, and efficiency.
Cloud migration removes the need for traditional network operations and monitoring.
Business applications are now executed directly on network switching platforms.
End users increasingly manage network connectivity without IT involvement.
Answer:
AExplanation:
Technical explanation
Cloud applications, IoT sensors, mobile devices and real-time collaboration increase east-west and internet-bound dependencies across the network. The result is higher demand for secure identity-based access, predictable wireless performance, visibility and rapid incident response. Digital transformation does not eliminate routing, switching, authentication or operational telemetry; it makes availability and observability more consequential. Centralized management helps maintain consistent policies and detect cross-domain faults, especially when locations lack onsite networking specialists. Cloud adoption does not eliminate network troubleshooting; it redistributes dependencies. Applications are generally not executed on ordinary campus switches, and self-service connectivity does not remove IT responsibility for enterprise access policy and service quality.
Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central
Where can you find a timeline of connection events for a specific wireless client in HPE Aruba Networking Central?
Options:
Client dashboard – > Events card.
RF Health Dashboard.
AP Configuration tab.
Answer:
AExplanation:
Technical explanation
The client's Events card builds a chronology of connection transitions, enabling operators to correlate disassociation, failed authentication, roaming and IP address assignment. Preserve the client's MAC address and the interval under review because randomized MAC behavior can make a user appear as multiple identities. A device configuration page shows intended WLAN settings, and the RF dashboard captures environmental data, but neither provides the direct per-client event sequence. Use the timeline to identify the first failing stage before investigating downstream services.
RF Health aggregates environmental conditions; AP Configuration describes intended parameters. The client Events card is concerned with time-stamped association, authentication and disconnection activity, the sequence needed to diagnose one station.
Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central
What must an organization do before managing devices in HPE Aruba Networking Central through HPE GreenLake?
Options:
Assign subscription tiers to all devices in the inventory.
Enable automated subscription assignment for managed devices.
Create a workspace to organize resources, users, and services.
Upload audit and compliance data for each network site.
Answer:
CExplanation:
Technical explanation
A GreenLake workspace defines the organizational boundary containing services, users, resource associations and access controls. Establish the workspace, grant appropriate administrator rights and then onboard or assign devices and subscriptions to the Central application. Subscription tier selection remains an important later step but is not the organizational prerequisite asked here. Ensure that invited users and devices are associated with the correct workspace to avoid accidental cross-tenant visibility or assigning entitlements to an unintended environment.
Assigning subscriptions and enabling auto-assignment follow the existence of an organizational workspace. Compliance data upload is not the prerequisite to creating a Central service. Workspace and roles establish the management boundary first.
Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central
You need to implement redundant core switches in a campus environment, ensuring fast failover and independent control and management planes. Which design best suits this requirement?
Options:
VSF to form one logical switch with shared control plane
VSX on supported platforms for distributed control and fast recovery
Two independent switches configured with VRRP and MSTP
Answer:
BExplanation:
Technical explanation
VSX joins a pair of supported AOS-CX switches with independent control and management planes while synchronizing selected L2 forwarding state across an inter-switch link. Downstream MC-LAG connections can remain forwarding through the surviving peer after failure. Configure the keepalive in a resilient and isolated path, size the ISL appropriately and verify peer consistency. VSF, by contrast, presents a stack with a single logical control plane, which does not match the independent-plane requirement despite its access-layer resiliency benefits. In a two-core VSX design, a downstream access switch can form one LACP logical interface with one member on each core chassis. Fail one VSX peer during acceptance testing and confirm traffic remains on the surviving member.
VSF makes several members a logical stack with one control plane, so option A contradicts independent control and management. VRRP/MSTP on standalone peers can supply redundancy but not VSX’s state coordination and active-active MC-LAG behavior; they are not equivalent for this design.
Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
A guest SSID requires captive portal access. Which setting enables this in HPE Aruba Networking Central?
Options:
Apply Guest role to all users with ClearPass
Configure captive portal under the WLAN profile
Set security level to Guest under WLAN profile
Answer:
BExplanation:
Technical explanation
The WLAN security and access configuration defines how unauthenticated clients reach the portal, what redirect URL or hosted portal is used, and how successful authentication changes the user's role. Configure the pre-authentication role so clients can resolve DNS and reach the portal while remaining blocked from protected services. The precise wizard tab differs across Central interface versions, but the captive-portal behavior belongs to the SSID's access/authentication workflow, not merely to a VLAN definition. Validate the redirect on multiple operating systems.
ClearPass may supply identity or guest services, but merely naming its Guest role does not configure HTTP redirection. The Guest security level alone does not replace a captive-portal profile, its pre-authentication rules, or the portal URL.
Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
You're migrating branch sites to AOS10. Which design choice best supports unified policy and visibility with minimal local complexity?
Options:
Standalone APs with bridge mode forwarding
Gateways with bridge mode forwarding
Gateways with tunnel mode forwarding
Answer:
CExplanation:
Technical explanation
With tunneled client forwarding, gateway policy becomes a consistent enforcement point for branch WLAN clients. Authentication, role assignment, user VLAN anchoring and traffic inspection can be coordinated centrally, while individual branches retain relatively modest local VLAN requirements. Check WAN latency, gateway cluster capacity, tunnel redundancy and failure behavior before choosing this architecture. Bridging all traffic locally can be valid in smaller branches, but it decentralizes the datapath and reduces the central inspection consistency stipulated by the scenario. A branch design using tunneled traffic also requires sufficient WAN capacity and a survivability plan. Centralized inspection is beneficial only when the gateway and transport remain appropriately available.
Bridge mode breaks out traffic at the AP and may enforce policy locally, so adding gateways without tunnel forwarding does not centralize inspection. Standalone APs lack the requested shared gateway datapath. A tunneled design consolidates enforcement at the gateway cluster.
Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
Which scenario supports using a port profile instead of configuring ports one-by-one?
Options:
A single uplink port requires a unique combination of parameters that applies only to one interface
A one-time test requires temporarily changing a single interface to validate a device connection
A troubleshooting session requires reading the current port status and neighbor information on one switch
Multiple user-facing access ports require the same speed, MTU, QoS, VLAN mode, and security posture across devices
Answer:
DExplanation:
Technical explanation
When many access ports share the same traffic role, centrally define admin state, speed/MTU, access or trunk VLAN mode, QoS, authentication and protection in a reusable Port Profile. Association of that profile with the desired interfaces yields repeatable intent and easier compliance inspection. Separate templates should be maintained for users, voice/phones, printers and uplinks where the behavior differs. A unique or short-lived diagnostic change on one port does not justify broad profile reuse and may cause unintended outages if inherited. Under Configuration > Interfaces > Port Profile, use Create profile for the shared baseline and assign it to eligible switch interfaces.
A unique uplink or a temporary lab change needs local handling rather than a shared policy object. Reading counters and LLDP is a monitoring task, not a profile-deployment task. Profiles pay off when many ports must share a stable baseline.
Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
Which HPE Aruba Networking Central card shows a breakdown of device count and health by site?
Options:
Device inventory
Device Health
AI Insights
Answer:
BExplanation:
Technical explanation
In the global or site context, Device Health counts APs, switches, gateways and bridges by health classification. Expand the card to compare the same metrics by site and select the affected location for a closer device list. Health aggregation helps prioritize teams and incidents by location but should not be interpreted as identifying the underlying fault. Inventory primarily lists assets and assignment, while AI Insights investigates patterns and anomalies; the health card is the direct summary requested.
Inventory can count devices but is not organized around their assessed health; AI Insights explains anomalies rather than serving as the core device-count summary. The Device Health card answers the operational question directly.
Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central
A downlink reports flapping. Which Troubleshoot tool provides a guided test you can run from HPE Aruba Networking Central to validate physical health?
Options:
Change port speed/duplex manually and observe
Cable test from the Tests tab targeting the specific interface
Open remote console and disable the interface
Answer:
BExplanation:
Technical explanation
Launch the Tests tab for the affected switch, select Cable Test and target the reported downlink interface. Interpret pair status and estimated distance in conjunction with switch port logs and NIC/transceiver behavior. A cable test is most useful for compatible copper media; optical links require optics diagnostics and error counters instead. Changing speed/duplex blindly can introduce mismatches, and administrative shutdown destroys evidence of intermittent negotiation problems. Schedule potentially disruptive cable diagnostics around user impact.
Changing port speed and duplex before testing can create a new negotiation mismatch. Disabling a port via remote console only proves it stops forwarding. The purpose of the cable test is to interrogate the suspect copper pair while preserving diagnostic evidence. Use the affected device’s Troubleshoot > Tests workflow and choose Cable Test where the port and platform support it.
Official HPE references | Troubleshooting Tools • Wired Interfaces Card for Switches | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
What are the benefits of gateway clustering in AOS-10?
Options:
RF channel planning, transmit power calibration, band steering, and airtime fairness
Seamless roaming, hitless failover, client state synchronization, and load balancing
DHCP snooping, dynamic ARP inspection, port security, and storm control tuning
Spanning tree suppression, MAC table merging, link aggregation, and stack monitoring
Answer:
BExplanation:
Technical explanation
Gateway clustering couples high-availability datapath behavior with user state synchronization, load distribution and WLAN mobility support. Client traffic can be anchored and balanced across available gateways, and the cluster can preserve service through supported node failures or controlled software upgrades. Confirm that enough cluster capacity remains when a member is lost and that every gateway has consistent roles and tunnel reachability. RF channel planning belongs to AirMatch; DHCP snooping and spanning-tree are separate switching/security mechanisms rather than principal gateway-cluster benefits. A cluster maintains user-to-gateway mappings and shares relevant state across peers, improving failure recovery and distributing load. A design without valid cluster connectivity cannot provide that continuity simply because two gateways are online.
RF power/channel algorithms belong to radio management, and DHCP snooping or ARP inspection belong to switch security. Spanning tree and stack monitoring are Layer 2 infrastructure functions. Cluster value is the coordinated client state and traffic continuity between gateway peers.
Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
Several users report failed authentication. Which HPE Aruba Networking Central tool gives the most direct insight?
Options:
Client dashboard
Client Event Log
Site Inventory
Answer:
BExplanation:
Technical explanation
For multiple affected users, compare Client Event Log entries for a shared SSID, RADIUS server, authentication method and time interval. Similar failures concentrated after a policy or certificate change indicate a systemic cause; only one model or supplicant version failing suggests a client compatibility issue. Check whether the log reports rejection, response timeout or association loss before changing RADIUS policies. The broader Client dashboard helps establish scale, but the per-event failure messages supply the direct diagnostic evidence requested.
The Client dashboard is the route into a particular user session, but the Client Event Log contains the concrete failure record. Site Inventory lists managed assets rather than authentication exchanges. Use multiple affected clients to determine whether the issue is shared.
Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central
Which capability is enabled by a firewall’s Deep Packet Inspection (DPI) behavior?
Options:
Assigning IP addresses based on DHCP option fields and relay behavior
Selecting RF channels based on airtime utilization and interference levels
Performing SSL inspections looking for known threat vectors
Enforcing policy based on recognized applications and traffic categories
Answer:
DExplanation:
Technical explanation
DPI identifies traffic according to application signatures and behavioral characteristics beyond traditional IP-address, port and protocol matches. That classification enables role-based rules and QoS decisions for applications such as collaboration, streaming or file sharing, even when services reuse common transport ports. DPI should not be equated with universal SSL interception; decryption requires separate, explicit capabilities and trust arrangements. Nor does it perform DHCP address allocation or Wi-Fi channel selection, which belong to different network subsystems.
DHCP relaying and RF channel selection are separate functions. Decrypting arbitrary SSL traffic is not implied by DPI; that would require additional TLS-interception capabilities and trust. DPI is useful because recognized application identities can be inputs to traffic policy.
Official HPE references | Application Visibility • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
Per the “Rule of Threes,” what does a 3 dBm increase correspond to?
Options:
Ten times the power
Double the power
Half the power
One-tenth the power
Answer:
BExplanation:
Technical explanation
The rule is a logarithmic shortcut. A 3 dB gain multiplies linear power by 10^(3/10), approximately 1.995, so 1 mW becomes about 2 mW. In dBm, that is 0 dBm to roughly +3 dBm. A tenfold power increase requires +10 dB, not +3 dB. Negative 3 dB approximately halves power; negative 10 dB reduces it to one-tenth. The question is about power ratio, not a guarantee of twice the Wi-Fi range.
Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central
How is the port profile configuration process organized in HPE Aruba Networking Central?
Options:
A two-step flow covering system settings and routing settings, followed by device-level overrides
A three-step flow covering inventory assignment, license assignment, and audit trail verification steps
A four-step flow covering general settings, VLAN settings, authentication settings, and loop-prevention settings
A five-step flow covering VLANs, VRFs, BFD, routing protocols, and gateway tunneling parameters
Answer:
CExplanation:
Technical explanation
Port Profile creation follows the functional configuration areas of general properties, VLAN/network settings, authentication/security and loop-prevention parameters. General settings include administrative status, PoE and MTU; network settings define VLAN modes; security associates relevant 802.1X or MAC-authentication policy; loop protection controls spanning-tree and safeguard behavior. The wizard's exact visual organization may evolve by Central release or switch family, but these concerns form the intended design sequence. Save the profile and associate it with the correct interface/device scope before expecting changes on hardware.
System/routing, inventory/licensing, and BFD/VRF lists describe other workflows. This question refers to the switch port profile’s general, VLAN, authentication, and loop-prevention stages—not generic onboarding or Layer 3 design.
Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
Which feature is only available with an AOS10 Advanced AP license, not with a Foundation license?
Options:
UCC visibility
Live upgrades
AI insights
Answer:
AExplanation:
Technical explanation
The licensing distinction must be read against the actual entitlement matrix, not assumed from feature names. HPE lists base AI Insights under Foundation, while its official Classic Central AP license table lists Unified Communications and Collaboration (UCC) and Live Upgrades under Advanced. UCC visibility concerns voice/video collaboration experience; Live Upgrade is a firmware-maintenance orchestration capability. The test’s answer key singles out UCC, but the wording admits another Advanced-only selection in that documented matrix.
The Foundation license includes AI Insights, making C ineligible as an Advanced-only distinction. However, HPE’s official Classic Central license table places both UCC and Live Upgrades in the Advanced column. Accordingly, A is the supplied key but B also satisfies the literal wording; the question is not unambiguous as a single-choice item.
Source-specific qualification: HPE’s AP Foundation and Advanced License table places both UCC and Live Upgrades under Advanced. A single-answer interpretation of this question therefore requires the intended curriculum/release context.
Official HPE references | AP Foundation and Advanced License – HPE Aruba Networking Central • Dynamic Application Prioritization Profile | Study-guide topic: Introduction to AOS-10
A customer needs consistent port configuration (Speed, Duplex, PoE, STP) on all access switches. Which configuration approach uses HPE Aruba Networking Central’s intent-based model?
Options:
Apply a Global alias only without profile linkage
Configure interfaces for every switch individually
Create a Port Profile and assign it to applicable interfaces
Answer:
CExplanation:
Technical explanation
Build a reusable Port Profile containing interface administrative state, speed/duplex behavior, PoE settings, applicable spanning-tree options and associated VLAN/security parameters. Assign it through the appropriate Interface Profile or interface selection according to device family and UI workflow. Compare effective configuration on representative switches before deploying widely because uplinks, phones and ordinary edge hosts require different policy. A global alias without an applied profile carries no operational intent, while configuring every port independently raises drift and audit risk.
An alias does not automatically carry an entire port configuration, and editing every interface by hand invites drift. Profiles bind the required switchport intent to a reusable object; assignment to actual ports remains necessary. Open Configuration > Interfaces > Port Profile > Create profile, define the switch settings, then apply the profile from Switch Interface Configuration.
Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
In cases where spanning tree protocols cannot be used to prevent loops at the edge of the network, which switch feature should you enable to avoid loops?
Options:
LACP with LACP-fallback disabled
Loop protection
BPDU-Guard
Answer:
BExplanation:
Technical explanation
Loop protection can emit and detect dedicated loop-detection frames on ports where spanning-tree participation is unavailable or inappropriate. When the device sees its loop-detection traffic return, it can disable or otherwise isolate the problem interface according to configured action and recovery behavior. BPDU Guard requires reception of spanning-tree BPDUs; a loop formed between two ordinary edge ports or through a device that does not emit BPDUs can evade that trigger. Define recovery policy to avoid repeated flapping into an unresolved loop.
LACP bundles links but is not a general defense against accidental edge patch loops. BPDU Guard reacts to received BPDUs; a silent loop can bypass it. Loop protection tests for loopback behavior itself.
Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
Operations want a visual of active wired ports and link speed. Which HPE Aruba Networking Central view provides this at a glance?
Options:
Hardware card in the switch dashboard
Wired Interfaces card (faceplate)
Health card in the switch dashboard
Answer:
BExplanation:
Technical explanation
The switch faceplate condenses a large port table into physical positions that resemble the chassis. Link coloring distinguishes connected, down, and disabled interfaces; selecting a port exposes negotiated speed/duplex, neighboring devices and other relevant interface diagnostics. If a port unexpectedly negotiates at a lower speed, check transceiver type, auto-negotiation, cabling and peer settings. Hardware health reports CPU, fans, temperature and power supplies, which are important but do not substitute for per-interface link visibility.
The Hardware card addresses chassis components, and Device Health summarizes operational condition. Neither presents the port-by-port speed/status layout needed by operations. On AOS-CX the card also separates RJ45 and QSFP port groups. In Central, open the managed switch’s Network dashboard and expand Wired Interfaces; the faceplate hover fields include speed/duplex and PoE status.
Official HPE references | Wired Interfaces Card for Switches • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central
