HPE6-A90 시험 - HP실제시험문제와 답 - 100문항

Question No : 1

What is a fundamental requirement for a factory-default AOS-CX switch to successfully complete the Zero Touch Provisioning (ZTP) process and receive its initial configuration from HPE Aruba Networking Central?

A.The switch must be manually added to a designated Configuration Group via the local serial console CLI before booting.
B.The switch must dynamically receive a valid IP address and DNS server information via DHCP on an active uplink interface.
C.The switch must have a statically assigned IP address on its out-of-band management (OOBM) port before connecting to the network.
D.The switch must be pre-staged with a custom Python script to initiate the outbound HTTPS connection to the cloud portal.

정답:

Question No : 2

A Campus IT Manager is standardizing the port configuration for a new rollout of AOS-CX 6200 access switches. The goal is to fully implement Zero Trust edge security using Dynamic Segmentation integrated with Central and ClearPass.
Central Template Group (Grp_Campus_Edge_6200):
% if role == 'access_switch' %
port-access role UNTRUSTED_IOT
ubt-zone iot_zone
gateway-role default
interface 1/1/1-1/1/48
no shutdown
vlan access 1
port-access
onboard-client-limit 2
port-access security
violation action block
port-access mac-based
enable
port-access dot1x
enable
% endif %
Based on the capabilities of the AOS-CX 6200 series and the provided Central template, which THREE statements accurately describe how this switch handles client onboarding and tunneling? (Select all that apply.)

A.The 6200 switch inherently translates the 802.1X certificate details into an EVPN-VXLAN Group Policy Identifier (GPID) before executing the local port-access security violation action.
B.Setting the onboard-client-limit to 2 ensures that the 6200 switch will enforce security by blocking traffic if a third unauthorized device attempts to connect through an unmanaged mini-switch plugged into the wall port.
C.If an IoT device is assigned the UNTRUSTED_IOT role by ClearPass, the 6200 will utilize its local routing table to forward the traffic, ignoring the ubt-zone command since it requires an Advanced license.
D.The 6200 switch uses Concurrent Authentication, allowing it to process both MAC-based and 802.1X authentications simultaneously to speed up the onboarding of mixed device types on the same port.
E.The ubt-zone configuration instructs the 6200 switch to actively encapsulate the authenticated IoT device's traffic into a secure tunnel directed to the centralized AOS-10 Gateway cluster.

정답:

Question No : 3

Which IEEE 802.11 amendment specifically allows an AOS-10 Campus AP to actively provide connecting clients with a "Neighbor Report," assisting the client device in making faster, more informed roaming decisions without needing to actively scan all RF channels?

A.802.11k (Radio Resource Measurement)
B.802.11w (Protected Management Frames)
C.802.11v (BSS Transition Management)
D.802.11r (Fast BSS Transition)

정답:

Question No : 4

A Campus IT Manager wants to quickly identify which specific building (Site) in a 50-building campus has experienced the highest concentration of wireless client connection failures over the last 24 hours.
Which workflow within the HPE Aruba Networking Central UI represents the most direct method to obtain this specific operational intelligence?

A.Download the raw JSON audit logs from the GreenLake platform and utilize a custom Python script to parse MAC authentication failures.
B.Navigate to the Global Network Health dashboard, select the 'Clients' tab, and easily review the 'Connectivity' metrics by Site.
C.Access the local WebUI of each individual AOS-10 gateway device and manually check the datapath tables for dropped user sessions.
D.Create a new NetConductor global role policy that specifically tags failing clients to force a packet capture on the core switches.

정답:

Question No : 5

A NOC Operations Engineer is troubleshooting an AOS-10 Gateway cluster that is failing to form. Both gateways are physically patched into an AOS-CX 8325 core switch. Central reports the cluster status as "Down/Isolated".
The engineer investigates the wired underlay configuration connecting the two gateway nodes:
[AOS-CX 8325 Switch - Interface Status]
Interface 1/1/1 (Connected to Gateway Node 1)
VLAN Mode: Trunk
VLAN Trunk Allowed: 10, 20, 30
Native VLAN: 10
Interface 1/1/2 (Connected to Gateway Node 2)
VLAN Mode: Trunk
VLAN Trunk Allowed: 10, 20, 40
Native VLAN: 20
Which TWO configuration issues on the underlay switch will prevent these AOS-10 Gateways from forming a valid, fully functional Layer 2 cluster? (Choose 2.)

A.The gateways are attempting to negotiate dynamic LACP with the core switch, a protocol that is explicitly blocked when native VLANs differ across a chassis.
B.The native (untagged) management VLANs mismatch (VLAN 10 vs VLAN 20), breaking the fundamental Layer 2 cluster heartbeat and discovery process between the nodes.
C.Layer 2 clustering requires Spanning Tree Protocol (STP) to be completely disabled on the switch ports to allow the proprietary multicast heartbeat frames to pass unhindered.
D.The allowed trunk VLANs are inconsistent (missing VLAN 30 on port 1/1/2, and missing VLAN 40 on port 1/1/1), which will cause asymmetric dropping of client data plane traffic during a failover event.
E.The switch ports are configured as 802.1Q trunks, whereas AOS-10 Gateways strictly require standard access ports to successfully negotiate their cluster virtual MAC addresses.

정답:

Question No : 6

A NOC Operations Engineer is troubleshooting a persistent roaming issue in an AOS-10 environment. Medical VoIP clients are dropping calls specifically when moving between Campus-AP-01 and Campus-AP-02, both managed by Branch-GW-01.
The engineer uses SSH to access both the Gateway and the AP directly to deeply inspect the state.
Review the CLI output below:
(Branch-GW-01) # show datapath user mac 00:11:22:33:44:55
Datapath User Table Entries
MAC IP VLAN Flags State Tunnel
--- -- ---- ----- ----- ------
00:11:22:33:44:55 10.20.5.150 20 AWVI Act 0x10a2
(Campus-AP-02) # show ap remote debug mgmt-frames
Timestamp Type Subtype DA SA RSSI
--------- ---- ------- -- -- ----
14:22:15.1023 Management Auth a8:bd:27:f1:22:3c 00:11:22:33:44:55 35
14:22:15.1540 Management AssocRq a8:bd:27:f1:22:3c 00:11:22:33:44:55 36
14:22:15.1890 Management AssocRs 00:11:22:33:44:55 a8:bd:27:f1:22:3c 36
14:22:15.2050 Management Deauth a8:bd:27:f1:22:3c 00:11:22:33:44:55 -
Reason Code: 6 (Class 2 frame received from nonauthenticated STA)
To effectively fuse CLI execution skills with roaming diagnostics, which THREE statements represent correct analytical approaches based on this methodology? (Select all that apply.)

A.Utilizing show ap remote debug mgmt-frames on the AP CLI is critical for analyzing the raw 802.11 authentication and association frames exchanged during the roaming event.
B.The correct diagnostic step to resolve the Reason Code 6 error is to use the CLI to completely disable 802.11k/v/r protocols on the VoIP SSI
C.Executing show datapath user on the gateway CLI is necessary to verify if the client's tunnel and forwarding state correctly updated after roaming to the new A
D.The engineer could optionally utilize the WebUI Remote Console to run show ap debug client-table to inspect the client's current association state and RSSI values without needing an SSH client.
E.The engineer should run clear arp on the core switch via Central to flush the gateway's client cache, forcing a complete network-wide re-authentication.

정답:

Question No : 7

MAC Authentication with
ClearPass
VSAs
Which TWO proposed features represent absolute hardware or software anti-patterns for the AOS-CX 6200 series platform and must be removed from the design? (Choose 2.)

A.Attempting to use the 6200 series to execute Dynamic Segmentation (User-Based Tunneling), as this requires a dedicated hardware GRE module only found on the 6400 chassis.
B.Configuring the 6200 series to act as an EVPN-VXLAN Route Reflector (BGP RR), a role that exceeds the platform's routing table capacity and intended architectural placement.
C.Integrating MAC Authentication with ClearPass VSAs, which is an advanced identity feature exclusively supported on the AOS-10 Gateway clusters.
D.Designing the aggregation layer to use Virtual Switching Extension (VSX) Active-Active Gateways, as the 6200 series strictly supports Virtual Switching Framework (VSF) instead.
E.Utilizing OSPF Underlay Routing for point-to-point links, because the 6200 series only supports static routing and basic RIPv2 protocols.

정답:

Question No : 8

254.0.2 1 FULL/BDR 00:00:36 10.1.1.5 1/1/50
Based on this specific OSPF neighbor state output, which TWO issues are the most likely causes of the failure between Leaf-1 and Spine-1 (10.254.0.1)? (Choose 2.)

A.The OSPF Hello or Dead timers are mismatched between the Leaf-1 interface and the Spine-1 interface.
B.One switch interface is configured as an OSPF broadcast network type, while the other is mistakenly configured as point-to-point.
C.The OSPF router IDs on both Leaf-1 and Spine-1 have been accidentally configured with the exact same IP address.
D.There is an IP Maximum Transmission Unit (MTU) mismatch configured on the point-to-point interfaces connecting the two switches.
E.The physical fiber optic cable between the switches is experiencing unidirectional link failure, dropping all hellos.

정답:

Question No : 9

A Campus IT Manager is drafting a proposal to deploy Dynamic Segmentation across a university campus. They plan to use User-Based Tunneling (UBT) to secure legacy devices.
Which TWO statements represent severe anti-patterns or critical design flaws when planning a UBT deployment? (Choose 2.)

A.Defining a primary gateway cluster IP for the UBT zone and configuring a secondary cluster IP to ensure high availability for the tunnels.
B.Ensuring the UBT underlay network accommodates jumbo frames (MTU 9000) to safely account for the GRE and IPsec encapsulation overhead.
C.Tunneling high-bandwidth, trusted server-to-server traffic from the data center edge switches to the campus gateways for stateful firewall inspection.
D.Utilizing UBT to isolate legacy, unpatchable medical devices that only support MAC authentication and cannot run 802.1X supplicants.
E.Configuring a "fail-open" local VLAN role for highly untrusted IoT devices to ensure they maintain internet access if the UBT connection to the gateway cluster goes down.

정답:

Question No : 10

A Security Operations Analyst is integrating AOS-10 Campus APs (operating strictly in Bridge Mode) with an EVPN-VXLAN campus fabric managed by Central NetConductor.
The APs are broadcasting a Corporate SSID mapped to local VLAN 100. Wireless clients authenticate via 802.1X, and ClearPass Policy Manager returns NetConductor global roles dynamically.
[NetConductor Policy]
Role 'Finance_User' -> GPID 505
Role 'HR_User' -> GPID 606
Which THREE statements correctly describe how the Campus AP persona handles the bridge mode datapath and NetConductor role enforcement within this specific fabric architecture? (Select all that apply.)

A.The downstream AOS-CX access switch receives the bridged, GPID-tagged Ethernet frame, encapsulates it into the EVPN-VXLAN overlay, and forwards it across the campus while preserving the identity context.
B.Bridge mode inherently strips all role-based metadata from the 802.11 frames, requiring the downstream AOS-CX switch to perform a secondary MAC authentication to re-apply the NetConductor roles.
C.The Campus AP acts as the authenticator, securely communicates with ClearPass, downloads the NetConductor Role assigned to the user, and translates this role into its numeric Group Policy Identifier (GPID).
D.Because the AP is in Bridge mode and participating in the fabric, it must embed the numerical GPID directly into the bridged 802.3 Ethernet frame before dropping it onto the local switch port (VLAN 100).
E.The Campus AP encapsulates the bridged traffic in an IPsec tunnel and forwards it directly to the Central NetConductor Orchestrator in the cloud to receive the appropriate GPID tag.

정답:

Question No : 11

A Network Compliance Auditor relies heavily on the Central performance dashboards to evaluate campus capacity planning. However, they consistently misjudge actual wireless utilization, leading to unexpected saturation events during end-of-month reporting periods.
Which TWO actions represent operational anti-patterns when utilizing Central's health and performance dashboards for long-term capacity planning? (Choose 2.)

A.Utilizing the API Gateway to programmatically export weekly performance metrics into a dedicated long-term data warehouse.
B.Reviewing the RF Health dashboard to identify areas with chronic co-channel interference before deciding to purchase and deploy additional access points.
C.Correlating the "Data Usage" metrics with the "Client Count" metrics to differentiate between high-density idle devices and high-bandwidth active clients.
D.Disabling the periodic telemetry streaming from the APs to Central in order to "save WAN bandwidth," thereby starving the dashboards of granular data.
E.Focusing exclusively on instantaneous, real-time client counts without adjusting the time-series filter to analyze peak historical trends over a 30-day period.

정답:

Question No : 12

What is a key architectural distinction between the AOS-CX 6300 and 6400 series switches when planning for access layer and distribution layer high availability?

A.The 6400 natively supports Cloud Authentication services via Aruba Central, while the 6300 requires a dedicated ClearPass Policy Manager appliance for identity management functions.
B.The 6300 uses VSF stacking for high availability; the 6400 is a modular chassis with redundant Management Modules (MMs) providing internal high availability.
C.Both switch series require centralized Aruba Mobility Controllers (MCs) to manage and synchronize their redundant control plane instances across the network.
D.The 6300 series relies on VSX for core routing tasks, whereas the 6400 series utilizes VSF to handle edge access layer connectivity requirements.

정답:

Question No : 13

In the context of HPE Aruba Networking Central, what is the foundational architectural principle of NetConductor global client roles when compared to traditional network segmentation?

A.Global client roles decouple security policy from the underlying network topology by carrying role context directly within the data plane encapsulation.
B.NetConductor requires all client traffic to be routed through a centralized physical firewall appliance to apply role-based access control policies.
C.Global client roles permanently bind a client's MAC address to a specific physical switch port to enforce strict hardware-level segmentation boundaries.
D.The architecture relies on configuring static, localized Access Control Lists (ACLs) on every individual access switch to match specific IP subnets.

정답:

Question No : 14

254.0.2 65001 0 0 00:00:00 Active
Based on the provided diagnostic output, which TWO underlying misconfigurations are preventing the EVPN control plane from establishing? (Choose 2.)

A.The EVPN-VXLAN Network Identifiers (VNIs) have not been properly mapped to the local VLANs on the edge switch.
B.The AOS-CX 6300 switch requires an Advanced subscription license to activate the OSPF underlay routing process, which has expired.
C.The edge switch has dynamically learned too many MAC addresses, exhausting the hardware CAM table and causing the BGP process to crash.
D.The Loopback interfaces used for the BGP EVPN peerings (10.254.0.1, 10.254.0.2) are not being correctly advertised into the OSPF underlay.
E.There is a BGP Autonomous System Number (ASN) mismatch or a strict firewall filter blocking TCP port 179 between the leaf and the Route Reflector.

정답:

Question No : 15

A Network Deployment Specialist is executing a complex Zero Touch Provisioning (ZTP) rollout for 300 new AOS-CX access switches. The organization has strict mandates: all switches must run an approved, hardened firmware version (10.12.xxxx) before ANY specific edge configuration (like VLANs or 802.1X ports) is applied.
The specialist configures a Central Template Group (Grp_Campus_Edge) with Firmware Compliance enabled and set to "Install and Reboot".
Template Snippet (Grp_Campus_Edge):
% if tags == 'Role: Edge' %
vlan 10,20,30
interface 1/1/1-1/1/48
vlan access 10
port-access role employee
% endif %
Which THREE statements correctly describe the sequence of events and dependencies during this integrated ZTP and Firmware Compliance workflow? (Select all that apply.)

A.If the switch fails to obtain a DHCP address on VLAN 1, the Firmware Compliance engine will utilize a localized Bluetooth beacon to push the image from a nearby administrator's mobile device.
B.The factory-default switch uses DHCP on VLAN 1 to obtain an IP address, resolve the Central URL via DNS, and establish its initial secure outbound connection to the cloud.
C.Upon joining the Grp_Campus_Edge group, Central immediately applies the Jinja2 template configuration (VLANs 10,20,30) to the switch, and then initiates the firmware download in the background.
D.Central detects the firmware version mismatch and prioritizes the compliance policy; it pushes the 10.12.xxxx firmware and forces a reboot before pushing the complex edge configuration template.
E.The switch must have a valid Foundation or Advanced subscription license assigned in HPE GreenLake before it can successfully join the group and trigger the compliance check.

정답:

HP HPE6-A90 시험