HPE6-A90 HPE Networking Central Exam Questions and Answers

Technical explanation

Enterprise mode uses the 802.1X and Extensible Authentication Protocol exchange between the supplicant and the authentication backend. Configure the primary RADIUS authentication server or server group, a shared secret or RadSec relationship as supported, and a reachable network path from the authenticating device. Certificate trust and appropriate EAP methods are equally important. VLAN assignment rules are optional authorization refinements, while WPA3 transition mode concerns compatibility and is not the component that performs enterprise identity validation.

Dynamic VLAN rules in B can follow authentication but are not a prerequisite for establishing the enterprise 802.1X session. WPA3 transition mode in C is not the RADIUS identity service. An authentication server is the missing dependency.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

From a site dashboard, open the Network planet to display the Unified Device List. Identify the switch, AP or gateway and select its troubleshooting icon to enter the device-specific diagnostic workspace. The default Tests tab exposes appropriate sourced tests; Remote Console or Commands may be available according to device and permission. The Clients and Applications planets provide useful adjacent context but are not the direct route requested for choosing an infrastructure device and launching its diagnostics.

The topology sunburst changes visual focus rather than invoking a device’s diagnostic tools. Clients and Applications planets concern endpoints or flows. The site Network planet exposes the device list and its Troubleshoot control. The documented route is Sites > [site] > Network > Unified Device List > troubleshooting icon; Tests opens by default.

Official HPE references | Viewing the Troubleshooting Page • Troubleshooting Tools | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A guest role must implement explicit deny rules against internal RFC1918 ranges and sensitive management subnets, followed by permitted DNS, DHCP, captive portal and internet services as appropriate. Confirm the enforcement point: it may be an AP, a gateway, or a switch depending on the forwarding model. Segmentation by VLAN or VRF adds isolation, but a separate VRF is not universally mandatory when a correctly ordered stateful policy blocks east-west access. Test both DNS resolution and attempts to reach internal hosts. For validation, associate a guest device, obtain its assigned role and subnet, then test access to the internet and to an internal host on each protected network. A successful web redirect alone does not demonstrate isolation.

A mixed forwarding SSID is a traffic-location choice, not an authorization policy; bridging employees or tunneling guests does not itself deny private destinations. A distinct VRF can strengthen segmentation but is not inherently required for internet-only guest access.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

BPDU Guard is appropriate on edge interfaces that should never receive spanning-tree bridge protocol data units. If somebody connects a downstream switch or another bridge that sends a BPDU, the guard transitions the port to a protected state, limiting a potential topology disturbance. It does not detect every possible loop between ordinary ports when no BPDU is emitted; loop protection or storm control may also be required. Do not enable edge BPDU Guard on legitimate switch-to-switch uplinks.

BPDU Filter suppresses information STP needs, potentially hiding a loop. Root Guard protects bridge-root selection on specified ports, not arbitrary edge patching. BPDU Guard disables an unexpected bridge-facing edge port when a BPDU appears.

Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The AP's connectivity performance data should be read alongside its current associated-client population so an apparent throughput drop is not mistaken for reduced demand. Compare upstream and downstream rates, concurrent user count, radio-band split and temporal trends. High association count does not necessarily equal saturation; airtime consumption and retries matter more than device count alone. The health overview aggregates fault indicators, while radio optimization shows RF planning rather than the immediate per-device operational throughput requested.

The global health view is useful for finding unhealthy APs but not monitoring one radio’s live load. RF Optimization focuses on channel/power optimization. Open the individual AP context for real-time performance and client-count telemetry.

Official HPE references | AirMatch • Planets in Global Monitoring Page | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The Device Health summary provides an immediate qualitative assessment and can be expanded into the metrics or counts driving the classification. Review whether poor health is caused by uptime, hardware alarms, temperature, stack state or other supported indicators. The Hardware card exposes component detail but does not provide the same concise overall health categorization. The topology map answers where devices connect; health scoring answers which managed components require attention. Cross-check the classification against current device reachability before declaring an outage.

The Hardware card examines physical components, whereas the topology view is concerned with connection relationships. Neither replaces the direct health summary used for first-pass switch triage.

Official HPE references | Device Health Card • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The client's Events card builds a chronology of connection transitions, enabling operators to correlate disassociation, failed authentication, roaming and IP address assignment. Preserve the client's MAC address and the interval under review because randomized MAC behavior can make a user appear as multiple identities. A device configuration page shows intended WLAN settings, and the RF dashboard captures environmental data, but neither provides the direct per-client event sequence. Use the timeline to identify the first failing stage before investigating downstream services.

RF Health aggregates environmental conditions; AP Configuration describes intended parameters. The client Events card is concerned with time-stamped association, authentication and disconnection activity, the sequence needed to diagnose one station.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Built-in tests run against supported Central-managed infrastructure, and available commands depend on the device type and release. APs, gateways, bridges and AOS-CX/AOS-S switches can expose appropriate ping, traceroute, DNS, cable or protocol diagnostics through their supported tools. A ClearPass appliance or arbitrary third-party firewall is not automatically a Central-managed troubleshooting endpoint. Choose the correct test origin; performing DNS resolution from an AP is not equivalent to testing client DNS access when the two paths use different policies.

Air monitors, conductors and DNS appliances are not all standard managed sources of these troubleshooting tests. Likewise, ClearPass servers and arbitrary firewalls are separate products, not automatically Central test endpoints. The capability follows supported managed device families.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The timeline allows metrics and events to be viewed within the same historical period as the reported slowdown, making temporal correlation possible. Compare interface throughput, link errors, CPU alarms, client health and configuration changes for the chosen window. A coincident alert is only a lead; corroborate a causative relationship through device counters or reproducible symptoms. The Hardware card is best for component condition, and the Connectivity card may expose the metrics, but the time-range widget is what makes historical comparison practical.

Hardware inventory does not reveal the past throughput curve. Connectivity data is useful only when viewed at the required period; the Timeline widget is the explicit control for changing the observation window.

Official HPE references | Device Health Card • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

A mixed-mode SSID supports both bridged and tunneled forwarding, selected according to the client VLAN and deployment configuration. Put POS endpoints in the locally bridged role/VLAN where latency-sensitive branch processing must remain onsite; tunnel the guest VLAN toward a DMZ gateway cluster where centralized inspection is required. Ensure guest VLANs terminate on gateways and are not accidentally carried onto the AP's local switching trunk. Mixed mode is not arbitrary per-packet application steering; the forwarding selection must match the actual WLAN/VLAN policy. Under mixed forwarding, the relevant VLAN assignment decides the datapath. Ensure POS VLANs are permitted on the local AP uplink, while the guest VLAN is present on the gateway cluster for tunneling.

All-tunnel forwarding would backhaul the POS transactions unnecessarily; all-bridge forwarding would bypass the DMZ gateway for guests. Mixed forwarding is selected per VLAN/client role, so different VLANs require the intended bridge/tunnel mapping and uplink support. The AOS-10 WLAN wizard exposes Traffic Forwarding Mode = Mixed in its VLAN settings, with a primary gateway cluster for tunneled VLANs.

Official HPE references | AOS-10 Traffic Forwarding Modes • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

An SVI is a virtual Layer 3 interface associated with a VLAN. Give it an IP address and mask from that VLAN's subnet so clients can use it as a default gateway and the switch can route toward other connected networks. Ensure IP routing is enabled, VLAN membership is correct and any VRF association is intentional. A local profile or address alias may be necessary when individual switches need distinct IPs; the basic requirement is the assigned SVI address, not the site scope itself or a static aggregate link.

Site scoping governs distribution of configuration, not whether an SVI has an IP gateway. A static LAG aggregates physical links without creating a routed VLAN interface. The SVI needs its own suitable IP address on the associated subnet.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

AI-derived RF recommendations should be assessed against channel quality, neighboring AP assignments, regulatory limits and the operational change window. AirMatch computes channel, bandwidth and power plans from aggregated AP telemetry, rather than assuming every AP requires a manual static channel. Confirm the recommendation fits the affected site's survey and any reserved channels before permitting changes. Disabling AirMatch eliminates the automation that normally manages RF resource reuse and is not a logical response to detected overlap.

Manually rebuilding every AP channel plan discards the fleet-wide context of AirMatch. Disabling AirMatch removes the optimization mechanism that can correct overlap. Check the recommendation’s assumptions and scope before applying it.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

For multiple affected users, compare Client Event Log entries for a shared SSID, RADIUS server, authentication method and time interval. Similar failures concentrated after a policy or certificate change indicate a systemic cause; only one model or supplicant version failing suggests a client compatibility issue. Check whether the log reports rejection, response timeout or association loss before changing RADIUS policies. The broader Client dashboard helps establish scale, but the per-event failure messages supply the direct diagnostic evidence requested.

The Client dashboard is the route into a particular user session, but the Client Event Log contains the concrete failure record. Site Inventory lists managed assets rather than authentication exchanges. Use multiple affected clients to determine whether the issue is shared.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Design a VSF stack with a healthy standby member and, wherever hardware allows, resilient inter-member links arranged to limit the impact of a broken stacking connection. Model both a member failure and a stacking-link failure: they have different consequences, and insufficient topology may isolate members. Enable the platform's supported split-detection mechanism to prevent dual-active fragments. MC-LAG and VSX are valuable for dual-control-plane aggregation switches, but they do not replace the VSF member-role design identified in this stack-specific scenario. The conductor-to-standby takeover test and a stacking-link partition test should be executed separately. Ring-like stacking links where supported reduce the chance that a single cable defect segments the stack.

A VRF per switch is routing separation, not stack availability. The “VSX stack with two or more members” wording is wrong: VSX is a two-peer architecture, while VSF has stack members and conductor/standby roles. Select the actual stack protection.

Official HPE references | VSF Profile • VSF Split Detection | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The client summary provides a population-level view of association and connectivity patterns within the selected time window. Narrow the view by SSID, site, AP or client identity to distinguish widespread service instability from a handful of devices. Inspect detailed client events to identify whether drops are tied to reassociation, authentication failures, DHCP renewals or AP connectivity loss. A topology map is useful for path context but not as a primary history plot; RF optimization focuses on the physical radio environment instead of user sessions.

A topology map reveals AP connectivity but does not itself chart a client’s connection history. RF Optimization diagnoses radio conditions; it cannot substitute for a time-ordered list of session drops for the specific SSID and clients.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Strong RSSI only describes received power, not usable airtime or signal quality. A busy 5 GHz channel can produce high frame retries and low throughput even with a strong signal. Compare SNR, channel occupancy, neighboring BSSs, airtime consumption, client transmit rates and upstream interface errors. Increasing every AP's EIRP creates additional co-channel overlap and can produce asymmetric uplink performance because client radios transmit at lower power. Lowering minimum data rates is likewise a design intervention, not an evidence-based first diagnostic action.

Reducing the minimum data rate can increase the airtime consumed by slower frames. Blanket power increases expand contention cells and may worsen interference. Strong RSSI paired with poor throughput is a reason to inspect airtime, retries, and neighboring radios first.

Official HPE references | AirMatch • Planets in Global Monitoring Page | Study-guide topic: Introduction to AOS-10

Technical explanation

Build a reusable Port Profile containing interface administrative state, speed/duplex behavior, PoE settings, applicable spanning-tree options and associated VLAN/security parameters. Assign it through the appropriate Interface Profile or interface selection according to device family and UI workflow. Compare effective configuration on representative switches before deploying widely because uplinks, phones and ordinary edge hosts require different policy. A global alias without an applied profile carries no operational intent, while configuring every port independently raises drift and audit risk.

An alias does not automatically carry an entire port configuration, and editing every interface by hand invites drift. Profiles bind the required switchport intent to a reusable object; assignment to actual ports remains necessary. Open Configuration > Interfaces > Port Profile > Create profile, define the switch settings, then apply the profile from Switch Interface Configuration.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

RBAC separates identity, the abstract permission set and the resources to which those rights apply. Create roles with explicit privileges, assign those roles to users or groups and restrict scope to authorized sites or device functions. Users inherit privileges from their role membership; network devices do not inherit user access permissions from a 'role assignment' in the same sense. Validate least privilege using a test operator account rather than giving broad administrator rights simply to resolve visibility issues. In option A, devices incorrectly inherit the operator permissions. Option B attaches permissions to individual users rather than roles. Option C conflates equipment ownership with authorization. Mapping privileges to roles and roles to users is the RBAC principle.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Developer Hub provides API documentation and a live request facility. After choosing an endpoint, an operator can supply an access token and cluster and execute the API call. A GET may simply read telemetry; a write-capable request with the right privileges can modify cloud-managed objects or configuration. For that reason, the portal must be handled with the same safeguards as a production automation client. HPE’s API FAQ expressly describes execution of API calls from the API Reference page.

The sample-code-only claim in B is contradicted by the authenticated “try out” workflow. C is equally misleading: calls are real requests, although only a write-capable endpoint changes configuration. Option A therefore needs that HTTP-method qualification.

Official HPE references | Application Programming Interface (API) FAQ • Multi-Level Hierarchy | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Central's Key Management Service distributes an authenticated station record to neighboring APs. For supported fast-roaming methods, this can include the Pairwise Master Key or derived 802.11r keys, alongside the client's VLAN, role and authentication state. AirMatch supplies RF-neighbor information used to target synchronization. The destination AP can therefore complete a shortened key exchange without repeating the entire initial 802.1X transaction. The mechanism depends on supported clients and configured roaming behavior; it does not mean that all station keys are indiscriminately replicated throughout the entire enterprise. The initial 802.1X authentication establishes a cached key context; KMS distributes PMK or 802.11r-derived material plus VLAN/role information to neighbors selected using AirMatch adjacency. Clients still perform a four-way exchange during the roam.

Forcing full 802.1X authentication on every roam increases latency, and keys stored only on the old AP provide no fast key material at the new radio. KMS shares cached keying and station context with neighbors, though clients still complete the applicable handshake. The WLAN Security settings control 802.11r and related fast-roaming features; KMS supplies the station record and key material to eligible neighboring APs.

Official HPE references | Roaming and the Key Management Service • AirMatch | Study-guide topic: Introduction to AOS-10

Technical explanation

Place only the front-desk APs for the required sites in the intended configuration group or apply the WLAN profile with an equivalent targeted scope. Confirm that non-front-desk APs do not inherit the SSID inadvertently and that the SSID is enabled on the desired radios. A broadly applied global WLAN followed by manual deletions creates drift and unpredictable inheritance. Separate per-AP copies increase maintenance cost; using a common profile makes subsequent security, portal and radio-setting updates consistent.

A global SSID followed by dozens of deletions is an exception-heavy rollout; per-AP configuration is even less maintainable. A group for front-desk APs gives a stable logical targeting mechanism independent of physical site, provided only intended APs belong to it.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Introduction to AOS-10

Technical explanation

Examine stability-related insights alongside the actual reboot timestamps, reason codes, crash records and PoE history. Multiple APs rebooting after a switch power event indicate an upstream dependency; only one firmware build exhibiting exceptions suggests a software defect. Look for temperature thresholds, watchdog resets, memory exhaustion and unexpected power interruptions. A network topology view can identify a common switch, while RF Health addresses radio quality and will rarely establish why the AP operating system restarted.

The topology viewer may point to a shared PoE switch but has no reboot-reason classification. RF Health is primarily a radio-quality view. Stability-related insights, complemented by reboot reason and power history, best fit repeated restarts.

Official HPE references | Device Health Card • Troubleshooting Tools | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Each VRF owns its own forwarding and routing table, allowing Guest, IoT and Employee segments to use separate default routes and route-import policies on supported switches. Associate the corresponding SVIs or routed interfaces with the intended VRF and control any deliberate inter-VRF leakage through explicit security mechanisms. An SVI on its own creates a Layer 3 interface but not an independent routing domain. Check DHCP relay, DNS access and upstream reachability per VRF, because control-plane separation does not automatically provision the services that each tenant needs. Where guest must reach a shared DNS server, use deliberate inter-VRF route leaking or firewall-controlled service access. A VRF does not automatically create a permitted path between tenant routing tables.

Routed interfaces by themselves do not establish separate routing-table instances. A single shared SVI profile cannot isolate tenant RIBs. Multiple VRFs create independent forwarding tables, with carefully controlled route leaking if cross-tenant access is required.

Official HPE references | Creating a VLAN Profile • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Gateway clustering couples high-availability datapath behavior with user state synchronization, load distribution and WLAN mobility support. Client traffic can be anchored and balanced across available gateways, and the cluster can preserve service through supported node failures or controlled software upgrades. Confirm that enough cluster capacity remains when a member is lost and that every gateway has consistent roles and tunnel reachability. RF channel planning belongs to AirMatch; DHCP snooping and spanning-tree are separate switching/security mechanisms rather than principal gateway-cluster benefits. A cluster maintains user-to-gateway mappings and shares relevant state across peers, improving failure recovery and distributing load. A design without valid cluster connectivity cannot provide that continuity simply because two gateways are online.

RF power/channel algorithms belong to radio management, and DHCP snooping or ARP inspection belong to switch security. Spanning tree and stack monitoring are Layer 2 infrastructure functions. Cluster value is the coordinated client state and traffic continuity between gateway peers.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Run tests and, where authorized, command sessions from Troubleshooting so their timestamps, device context and results appear in History. The session record allows comparison before and after an intervention and can be exported as operational evidence. For accountability, also consult Audit Trail, which records administrative actions rather than being a substitute for diagnostic output. Preserve results externally when a regulatory or investigation retention period exceeds Central's operational history retention window. Central records troubleshooting sessions under Troubleshoot > History; select a session ID to read its outputs and any associated notes.

A configuration-change event cannot replay the output of a cable test or ping. The site timeline helps correlate incidents but is not a test archive. History contains prior sessions and can be reviewed for repeated diagnostics or handover.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Central brings network-device inventory, site topology, client experience, application visibility, firmware compliance and configuration profiles into a common operational context. Administrators can traverse from a site-level alarm to a specific access switch, AP or gateway and then launch troubleshooting workflows. The practical advantage is correlated evidence and consistent role-based workflows, not the elimination of device operating-system differences. Group and site policy must still respect device function, software release and licensed capabilities.

A controller-only interface contradicts the multi-domain requirement; inventory-only monitoring omits configuration and policy workflows. Central provides shared operational context for switches, APs, and gateways, while retaining device-specific functions.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Client load balancing steers eligible stations toward less busy APs, improving distribution of radio airtime and reducing localized saturation. Decisions depend on RF adjacency, compatible client behavior and valid coverage; it cannot force arbitrary clients to accept a particular target. Verify which APs and bands carry the imbalance, their airtime load, and whether sticky clients or roaming constraints contribute. Manually pinning channels changes RF reuse rather than station association, and lowering minimum rates can permit distant clients to occupy even more airtime.

Static channel assignment may solve a localized RF plan defect but does not distribute clients across otherwise healthy radios. Lowering minimum rates risks consuming more airtime. Load balancing acts on where suitable clients associate, subject to client roaming behavior.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10