HPE6-A86 HPE Network Switching Associate Exam Questions and Answers

The correct answer is A. Connect using the RJ-45 console port. To perform initial configuration on an HPE Aruba Networking CX 6200M switch, especially when configuring an SVI static IP address for in-band management, you need direct CLI access before the switch has reachable IP connectivity. The HPE Aruba Networking CX 6200 installation documentation identifies the RJ-45 console port as the local serial console connection used for direct management. HPE Aruba Networking fundamentals documentation also explains that initial configuration can be performed through the console port or management port, while VLAN 1 static IP configuration can be used for in-band management. The RJ-45 management port is for out-of-band management, but it requires management interface IP settings to be usable remotely. The Aruba mobile app and Bluetooth adapter can help with some initial setup workflows, but the question asks how to connect to configure an SVI static IP address. The most direct and expected method is to use the console connection and configure the SVI through the CLI. ( hpe.com , arubanetworking.hpe.com )

The correct answer is C. It shares the same network path as user data. HPE Aruba Networking AOS-CX documentation explains that in-band management traffic uses the same network infrastructure as user data. In-band management typically occurs through normal switch data ports using protocols such as SSH or SNMP. Because it uses the data plane and the production network, in-band management can be affected by congestion, outages, misconfiguration, or other issues impacting the user network. Option A is not the best answer because implementation complexity depends on the design, and HPE’s key distinction is not that in-band is more complex. Option B is incorrect because out-of-band management is usually preferred for better management isolation and resiliency. Option D is incorrect because if the main production network path is unavailable, in-band management can also fail. Out-of-band management uses a dedicated console, USB console, or management port path separate from the production data network.

The correct answer is B. LLDP. Link Layer Discovery Protocol, or LLDP, is the most useful feature for building a physical connectivity diagram because it helps identify directly connected neighboring devices and their interface relationships. HPE Aruba Networking Central documentation notes that LLDP is enabled by default on switches and is used to display AOS-CX switches in topology views. Aruba Central’s topology feature provides a graphical representation of the site, including the network layout and device details. This makes LLDP directly relevant to discovering and documenting physical network connections. Option A, MSTP, is a spanning tree protocol used to prevent Layer 2 loops and manage redundant paths, not to document physical connectivity. Option C, ZTP, is used for automated device provisioning, not topology discovery. Option D, L2TP, is a tunneling protocol and is unrelated to creating physical connectivity diagrams. Therefore, LLDP is the best answer because it provides neighbor discovery information that can be used to map how network devices are physically connected.

The correct answer is A. Output of show tech. HPE Aruba Networking support and diagnostics documentation commonly uses technical-support command output as a key troubleshooting artifact for TAC analysis. The documentation specifically states to check physical cabling and generate show tech when opening a TAC case. The purpose of show tech output is to collect a broad set of switch operational details, including configuration, system status, interface information, logs, and other diagnostic data that can help TAC understand the condition of the device at the time of the issue. Option B is incorrect because “generated support keys” are not the standard required item from the listed choices for opening a CX switch TAC case. Option C is incorrect because TAC does not normally require open SSH access over the Internet, and exposing management access publicly would be poor security practice. Option D is incorrect because TAC may ask for software version information, but a copy of the running firmware image itself is not the first diagnostic item to prepare. The best initial evidence is the show tech output.

The correct answer is C. Automates root cause analytics. HPE Aruba Networking AOS-CX documentation describes the Network Analytics Engine, or NAE, as a framework within AOS-CX switches that automates the detection of issues and automates root cause analysis. NAE agents monitor switch resources, events, configuration, protocol states, and other operational data to help identify issues faster. This helps administrators move from manual troubleshooting to analytics-driven troubleshooting directly on the switch. Option A is not the best answer because NAE is not simply a feature that automatically creates tech-support diagnostic files. Option B is incorrect because automated configuration backups are not the main purpose of NAE. Option D is incorrect because NAE does not primarily create support events in the HPE Aruba Networking Support Portal. Its purpose is local switch analytics, issue detection, and root cause analysis. Therefore, the best description is that NAE automates root cause analytics.

The correct answer is B. 2. The diagram shows two VLANs: VLAN 10 and VLAN 20. In Ethernet switching, each VLAN represents a separate Layer 2 broadcast domain. HPE Aruba Networking documentation defines a VLAN as a single Layer 2 network that can be partitioned to create multiple distinct broadcast domains, isolated from each other unless traffic passes through a router or Layer 3 interface. In this diagram, PCs A and B are in VLAN 10, so they share one broadcast domain. PCs C and D are in VLAN 20, so they share a second broadcast domain. The Layer 3 switch has SVIs for VLAN 10 and VLAN 20, which allow routing between the two VLANs, but the SVIs do not merge the broadcast domains. They provide Layer 3 gateways for each VLAN. Therefore, the number of broadcast domains is based on the number of VLANs shown, not the number of PCs, switch links, or SVIs. Since there are two VLANs, there are two broadcast domains.

The correct answer is B. HPE Aruba Networking Central has been manually disabled on the switch. The key line in the output is Central admin state : disabled. HPE Aruba Networking AOS-CX documentation for the show aruba-central command provides an example of a switch when Aruba Central is disabled, showing Central admin state : disabled, Central connection values as N/A, and Central support mode as disabled. This indicates that the switch’s Central administrative state is disabled, so it is not attempting to connect to HPE Aruba Networking Central. Option A is incorrect because the VRF for connection : N/A value is a result of Central being disabled, not proof that the management VRF does not exist. Option C is incorrect because this command output does not report support-contract validity. Option D is incorrect because the factory-default Central behavior is not what is being shown; the output specifically reflects Central being disabled. Therefore, the correct interpretation is that Central has been manually disabled on the switch. ( arubanetworking.hpe.com )

The correct answer is C. The wrong subnet mask has been configured. The PC is configured with IP address 10.211.55.151 and subnet mask 255.255.255.0, which is a /24 network. However, the HPE Aruba Networking CX switch SVI for VLAN 55 is configured as 10.211.55.1/25. A /25 mask divides the 10.211.55.0/24 range into two subnets: 10.211.55.0–10.211.55.127 and 10.211.55.128–10.211.55.255. The switch gateway address 10.211.55.1/25 is in the first /25 subnet, while the PC address 10.211.55.151 is in the second /25 subnet. This means the PC and its configured default gateway are not actually in the same subnet from the switch’s perspective. HPE Aruba Networking AOS-CX CLI documentation shows IP addressing on interfaces using prefix-length notation, such as /25, which defines the subnet size. Option A is incorrect because the port is configured with no shutdown and no STP error state is shown. Option B is incorrect because an access port does not require VLAN tagging from the PC. Option D is incorrect because a PC normally uses a default gateway, not a static route, for Internet access.

The correct answer is A. The CX 6300M VSF stack is the Layer 3 gateway for VLAN 200 clients, so the DHCP relay configuration must be applied to interface vlan 200, the SVI for the client VLAN. The SVI should use an address in the client subnet, such as 192.168.200.1/24, and the remote DHCP server should be defined with the AOS-CX ip helper-address command. HPE Aruba Networking AOS-CX documentation states that ip helper-address < IPV4-ADDR > defines the address of a remote DHCP server or DHCP relay agent and that the DHCP relay agent forwards DHCP client requests to the defined servers. Option B is incorrect because VLAN 1 is not the VLAN 200 client gateway. Options C and D are incorrect because dhcp-relay server is not the correct AOS-CX command shown for configuring IPv4 DHCP relay on the SVI. The correct configuration is ip helper-address 192.168.1.100 under interface vlan 200.

The correct answer is B. CX 8100 Series switches do not support VSF. The error appears because the vsf command is not valid on a platform that does not support Virtual Switching Framework. HPE Aruba Networking documentation identifies VSF as supported on specific access-switch platforms such as the CX 6200 and CX 6300 families. For higher-end aggregation and core platforms, including the CX 8100, HPE Aruba Networking uses Virtual Switching Extension, or VSX, rather than VSF. Official HPE Aruba Networking Central documentation states that VSX is supported on AOS-CX 6400, 8100, 8320, 8325, 8360, 8400, 9300, and 10000 switch series. Other AOS-CX documentation for 8xxx switch families also notes that VSF is not supported on those switches. Option A is incorrect because physical VSF links are not the reason the command is rejected. Option C is incorrect because VSF cannot be globally enabled on CX 8100. Option D is incorrect because this is a platform-support limitation, not a firmware issue.

The correct answer is B. CX 6200. The feature being described is the HPE Aruba Networking AOS-CX Network Analytics Engine, or NAE. HPE Aruba Networking documentation states that NAE uses Python scripts to define which switch resources to monitor and optionally what actions to take when certain conditions are true. The NAE guide specifically applies to the CX 6200, 6300, 6400, 8xxx, 9300, and 10000 switch series, and the supported maximums page lists the CX 6200 as supporting up to 10 scripts and 10 agents. This makes the CX 6200 the correct choice from the available options. The CX 6000, CX 6100, and CX 4100i are lower access platforms and are not listed in the NAE guide’s supported product set for onboard NAE scripting. Therefore, for a customer with Python skills who wants to use self-made or Aruba-provided onboard analytics scripts, the CX 6200 is the appropriate recommendation.

The correct answer is D. 6. In a switched Ethernet network, each individual switch link or switch port represents a separate collision domain. The diagram shows four end-user device links: PC-A to the VLAN 10 access switch, PC-B to the VLAN 10 access switch, PC-C to the VLAN 20 access switch, and PC-D to the VLAN 20 access switch. It also shows two uplinks from the access switches to the Layer 3 switch or routing switch that contains the SVIs for VLAN 10 and VLAN 20. That gives a total of six physical Ethernet links, and therefore six collision domains. The VLANs do not reduce this count to two; VLANs define Layer 2 broadcast domains, not collision domains. The SVIs also do not create one collision domain; they are Layer 3 gateway interfaces used for routing between VLANs. HPE Aruba Networking campus design documentation describes Layer 2 and Layer 3 switching technologies used in campus topologies, while HPE Aruba switch documentation treats physical switch ports as individual Ethernet interfaces. For this diagram, the collision-domain count is based on the physical switched links, so the answer is 6.

The correct answer is D. As a response to the broadcast DHCP query. DHCP clients initially do not have an IP address, so they commonly use broadcast DHCP discovery/request traffic to locate a DHCP server on the local network. HPE Aruba Networking documentation for DHCP relay explains that when a DHCP client broadcasts a request, the DHCP relay agent on the switch receives the packets and forwards them to the DHCP server as unicast requests. In this scenario, the access points are in VLAN 50, and VLAN 50 also contains DHCP servers. Because the DHCP server is on the same local management VLAN as the APs, the APs can obtain addresses through the normal DHCP broadcast process within that VLAN. Anycast and multicast are not used for the basic DHCP address request in this scenario. A unicast DHCP relay message can occur between a relay agent and a DHCP server when the server is on another subnet, but the client-side DHCP discovery begins as broadcast traffic.

The correct answer is B. A VLAN range can be created with the syntax vlan 100-110. HPE Aruba Networking AOS-CX documentation defines the VLAN creation command as vlan < VLAN-LIST > . The VLAN list can contain a single VLAN ID or multiple VLAN IDs separated by commas, dashes, or both. The documentation gives examples such as vlan 2-8,10, which creates VLANs 2 through 8 and VLAN 10. Therefore, vlan 100-110 is the correct AOS-CX syntax for creating a range of VLANs. Option A is incorrect because a colon is not the documented range separator for VLAN creation. Options C and D are incorrect because newly created VLANs are enabled by default. HPE Aruba documentation states that the VLAN is enabled by default and that the shutdown command is used to disable a VLAN. Therefore, no additional enable or no shutdown command is required after creating a VLAN.

The correct answer is B. PoE is disabled on the interface. If there are no lights on the access point, the first issue to investigate is whether the AP is receiving power. HPE Aruba Networking 550 Series installation documentation identifies Power over Ethernet as a supported power source for the AP, including IEEE 802.3bt or 802.3at PoE. HPE Aruba Networking AOS-CX documentation for the CX 6000/6100 PoE command shows that per-interface power distribution can be enabled with power-over-ethernet and disabled with no power-over-ethernet. If PoE is disabled on the switch interface, the AP will not receive power from the Ethernet cable and therefore may show no LEDs. Option A is incorrect because a missing STP configuration would not prevent the AP from powering on. Option C is incorrect because failure to reach HPE Aruba Networking Central would occur after the AP is powered and network-connected. Option D is also incorrect because a wrong VLAN can prevent management or provisioning, but it would not normally stop the AP LEDs from turning on.

The correct answer is A. The VSF feature is enabled by default. The key difference is between the older AOS-Switch VSF behavior used by the 2930F and the AOS-CX VSF behavior used by the CX 6200. In AOS-Switch 2930F manual VSF configuration, each switch must be configured individually for VSF before joining the stack. In contrast, HPE Aruba Networking AOS-CX VSF documentation for CX switches states that users cannot disable VSF and that a factory-default switch boots as a VSF-enabled device with member ID 1. Therefore, when replacing 2930F switches with CX 6200 switches, the important stacking difference is that VSF is inherently enabled on the CX 6200 platform. Option B is incorrect because VSF MAD is not automatically enabled on each LAG simply because LACP active mode is configured. Option C is incorrect because it states the opposite of the CX 6200 behavior. Option D is not the key difference for CX 6200; it more closely resembles manual AOS-Switch VSF setup behavior where switches are individually prepared for VSF participation.

The correct answer is D. administrators. HPE Aruba Networking AOS-CX documentation for the 4100i, 6000, and 6100 switch series states that, in addition to user-defined local groups, there are three built-in user groups: administrators, operators, and auditors. The documentation also states that the default admin account belongs to the administrators group. This makes administrators the only valid default group among the answer choices. Option A, root, is not listed as a built-in AOS-CX user group. Option B, managers, is not one of the default AOS-CX groups. Option C, super-users, is also not listed as a built-in group. These names may appear in other systems or older platforms, but on HPE Aruba Networking CX 6100 switches, the built-in local user groups are administrators, operators, and auditors. Therefore, the correct default user group from the listed options is administrators.

The correct answer is D. CX 8400. The requirement asks for a chassis solution, 100G speeds to the aggregation layer, and a maximum size of 10U. HPE Aruba Networking describes the CX 8400 as a core and aggregation switch with line-rate 10GbE, 25GbE, 40GbE, and 100GbE connectivity in a compact 8-slot chassis. The installation guide also identifies the CX 8400 as an eight-slot chassis platform for core and aggregation switching. This satisfies both the 100G requirement and the physical-size requirement because 8U is below the 10U maximum. The CX 10000, CX 9300, and CX 8360 are fixed-form-factor platforms rather than chassis solutions, so they do not match the customer’s chassis requirement. Therefore, the best initial proposal from the listed options is the HPE Aruba Networking CX 8400.

The correct answer is C. The contents of Flash survive when a device reboots or powers down. In HPE Aruba switch operation, the active configuration used by the device while it is running is the running configuration. The startup configuration is the saved configuration that is preserved and used after reboot. HPE Aruba documentation explains that saving the running configuration writes it to the startup configuration file in Flash memory, allowing the configuration to remain after the switch reboots. This confirms that Flash is nonvolatile storage. HPE Aruba AOS-CX documentation also describes eMMC or SSD switch storage as nonvolatile memory used for persistent storage of configurations, files, databases, and scripts. Option A is incorrect because switch Flash storage is not normally expanded by adding extra Flash for configuration storage. Option B is incorrect because the running configuration is held as the active operating configuration, not simply “Flash.” Option D is incorrect because show running-config displays the current running configuration, not the saved startup configuration stored in Flash.

Built-in stateful firewall = D

400Gb port speeds = C

7–12U chassis form factor = A

8U chassis form factor = B

The correct matches are CX 10000 for built-in stateful firewall, CX 9300 for 400Gb port speeds, CX 6400 for the 7–12U chassis form factor, and CX 8400 for the 8U chassis form factor. HPE Aruba Networking documentation describes the CX 10000 Distributed Services Switch as including stateful firewall capabilities through its distributed services architecture, making it the correct match for built-in stateful firewall. The CX 9300 is identified by HPE Aruba Networking as a high-density 100G/400G switch platform, so it matches the 400Gb port-speed feature. The CX 6400 is a modular chassis family available in 5-slot and 10-slot models; HPE QuickSpecs describe these as compact 7 RU and 12 RU chassis models, matching the 7–12U chassis form factor. The CX 8400 is a modular campus core and aggregation switch described by HPE as a compact 8-slot, 8U chassis, which matches the 8U chassis form factor. These four features are product-line differentiators and should not be interchanged.

The correct answer is A. A public CA signed certificate should be deployed. The browser warning appears because the captive portal is presenting a self-signed certificate that the client device does not trust. For guest access, client devices are usually unmanaged and cannot be expected to already trust an internal or self-signed certificate authority. HPE Aruba Networking documentation for captive portal deployments recommends that production environments obtain and install a certificate issued for the site or domain by a well-known Certificate Authority. This avoids browser trust warnings and gives guest users confidence that they are connecting to the correct portal. Option B is incorrect because disabling HTTPS and using HTTP would reduce security and expose portal traffic. Option C may work only for managed devices where the self-signed or private CA can be pushed into the trust store, but that is not practical for open wired guest access. Option D can be valid for internal managed users, but for guests, a public trusted CA certificate is the best answer.

The correct answer is C. Input errors have occurred. The interface output shows CRC/FCS errors with a value of 1254 under the RX column. CRC/FCS errors are receive-side frame check errors, so they indicate that the switch has received corrupted frames on this interface. HPE Aruba Networking AOS-CX show interface documentation lists interface statistics including packets, bytes, dropped frames, pause frames, errors, CRC/FCS, collisions, runts, and giants, which confirms that CRC/FCS is part of the interface error statistics. Option A is incorrect because the output says VLAN Mode: access and Access VLAN: 90; an access VLAN is untagged toward the endpoint, not an 802.1Q tagged trunk VLAN. Option B is incorrect because the MTU is shown as 1500, and the Jumbos counter is 0, so the output does not indicate jumbo-frame use. Option D is incorrect because the shown output does not state that PoE is disabled. The key troubleshooting clue is the nonzero receive CRC/FCS counter. ( arubanetworking.hpe.com )

The correct answers are B and E. On HPE Aruba Networking AOS-CX switches, configuration changes are made to the running configuration. To ensure those changes persist after a reboot, the running configuration must be saved to the startup configuration. HPE Aruba Networking documentation states that write memory saves the running configuration to the startup configuration and is an alias of copy running-config startup-config. The copy running-config startup-config command copies the current running configuration into the startup configuration, overwriting the existing startup configuration if one is already present. Option A, commit confirm, is not the AOS-CX command used to save the current running configuration for reboot persistence. Option C, save force, is not the correct AOS-CX command for this task. Option D is the reverse operation; copy startup-config running-config would copy the saved startup configuration into the active running configuration rather than saving current changes for the next reboot. Therefore, the two valid commands are write memory and copy running-config startup-config.

The correct answer is A. The VSF ports automatically forward the traffic for configured VLANs. In HPE Aruba Networking CX VSF, the VSF link ports are dedicated stack-fabric interfaces between VSF members. They are not configured like normal access or trunk ports for user VLAN forwarding. HPE Aruba Networking Central documentation for AOS-CX ports and LAGs notes that VLAN mode options such as access or trunk are not visible for VSF ports, which confirms that VSF ports are not manually configured as normal VLAN trunks. Once the VSF stack is formed, the stack operates as one logical switch, and the VSF links carry the necessary internal stack traffic automatically, including traffic associated with configured VLANs. Option B is incorrect because you do not configure VSF ports as trunk ports with vlan trunk allowed all. Option C is incorrect because vsf-sync is not required for VLAN forwarding across VSF links. Option D is incorrect because VLAN 4095 is not manually configured on VSF links for this purpose.

The correct answer is D. SNMPv3. HPE Aruba Networking AOS-CX hardening documentation recommends using SNMPv3 instead of older SNMP versions because older SNMP versions are unauthenticated and unencrypted, with the community string transmitted in plaintext. The same guide states that SNMPv3 supports different users, authentication, and strong encryption. This makes SNMPv3 the secure protocol among the options. HTTP is not the best answer because standard HTTP does not encrypt management or web traffic; HTTPS would be the secure alternative. TFTP is not secure because it does not provide encryption or strong authentication for file transfers. Telnet is also not secure because it sends session traffic, including login information, in clear text; SSH is the secure alternative for CLI management. Therefore, from the listed protocols, only SNMPv3 provides security mechanisms appropriate for secure network management, including authenticated and encrypted communication.

The correct answer is A. SNMP v3. HPE Aruba Networking AOS-CX hardening documentation recommends using SNMPv3 instead of older SNMP versions. Older SNMP versions are unauthenticated and unencrypted, and the community string is transmitted in plaintext. SNMPv3 supports users, authentication, and strong encryption, including stronger authentication and privacy protocols. This makes SNMPv3 the correct version when the requirement is to monitor switches with encrypted SNMP data. Option B and option C are incorrect because SNMPv2 and SNMPv2c do not provide the same authentication and encryption protections required by the question. Option D is incorrect because SNMPv4 is not a valid SNMP version used for this purpose on HPE Aruba Networking CX switches. Therefore, the secure SNMP monitoring choice is SNMPv3.