HPE6-A90 HPE Networking Central Exam Questions and Answers

Technical explanation

Application Visibility uses traffic classification, including DPI where supported, to show application families, usage and performance context rather than merely physical neighbors. Filter by site, wired/wireless client, time window and application category to identify misuse or policy-impacting traffic. Compare classified flows with user-role rules, access controls and QoS treatment. Encryption limits the visibility of payload contents, so classification often relies on signatures, protocol characteristics and metadata; it should not be confused with unrestricted decryption of every application session.

A topology diagram does not categorize application flows, and inventory only identifies assets. Application Visibility supplies classified usage information that can be compared with QoS and role-based policies, subject to the available telemetry and DPI capabilities.

Official HPE references | Application Visibility • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The switch faceplate condenses a large port table into physical positions that resemble the chassis. Link coloring distinguishes connected, down, and disabled interfaces; selecting a port exposes negotiated speed/duplex, neighboring devices and other relevant interface diagnostics. If a port unexpectedly negotiates at a lower speed, check transceiver type, auto-negotiation, cabling and peer settings. Hardware health reports CPU, fans, temperature and power supplies, which are important but do not substitute for per-interface link visibility.

The Hardware card addresses chassis components, and Device Health summarizes operational condition. Neither presents the port-by-port speed/status layout needed by operations. On AOS-CX the card also separates RJ45 and QSFP port groups. In Central, open the managed switch’s Network dashboard and expand Wired Interfaces; the faceplate hover fields include speed/duplex and PoE status.

Official HPE references | Wired Interfaces Card for Switches • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

RBAC separates identity, the abstract permission set and the resources to which those rights apply. Create roles with explicit privileges, assign those roles to users or groups and restrict scope to authorized sites or device functions. Users inherit privileges from their role membership; network devices do not inherit user access permissions from a 'role assignment' in the same sense. Validate least privilege using a test operator account rather than giving broad administrator rights simply to resolve visibility issues. In option A, devices incorrectly inherit the operator permissions. Option B attaches permissions to individual users rather than roles. Option C conflates equipment ownership with authorization. Mapping privileges to roles and roles to users is the RBAC principle.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A guest role must implement explicit deny rules against internal RFC1918 ranges and sensitive management subnets, followed by permitted DNS, DHCP, captive portal and internet services as appropriate. Confirm the enforcement point: it may be an AP, a gateway, or a switch depending on the forwarding model. Segmentation by VLAN or VRF adds isolation, but a separate VRF is not universally mandatory when a correctly ordered stateful policy blocks east-west access. Test both DNS resolution and attempts to reach internal hosts. For validation, associate a guest device, obtain its assigned role and subnet, then test access to the internet and to an internal host on each protected network. A successful web redirect alone does not demonstrate isolation.

A mixed forwarding SSID is a traffic-location choice, not an authorization policy; bridging employees or tunneling guests does not itself deny private destinations. A distinct VRF can strengthen segmentation but is not inherently required for internet-only guest access.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The network overview provides initial orientation: overall sites, client health, device condition, active alerts and operational issues requiring follow-up. It supports a drill-down workflow from high-level impact to individual sites and devices. Inventory and licensing are specialized administration views; neither is a comprehensive home dashboard for network state. Operators should confirm selected tenant and workspace because administrative context determines which sites and subscriptions are visible after launching Central from GreenLake.

The subscriptions page is an administrative entitlement view, alerts show exceptions, and inventory shows the device roster. Network overview is the broader landing context for health, sites, clients, and conditions needing investigation.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

In a Layer 3 routed Microbranch design, client source addresses remain visible end-to-end and the enterprise must advertise or otherwise route the local client subnet toward return traffic. In an L3 NATed design, the AP translates outbound sessions to a tunnel or uplink address, reducing the need to distribute a route for every branch WLAN subnet. NAT simplifies routing but can limit source-IP visibility and inbound connection behavior. Choose the mode based on enterprise identity, application reachability and route-scale requirements rather than treating both modes as equivalent forwarding. In a routed Microbranch subnet, the VPN concentrator or upstream network needs a return route toward the branch client pool. With NAT, outside services instead see the AP translated address, reducing route advertisement needs but obscuring individual client addressing.

Option A reverses source translation and route-advertisement behavior. Option C concerns gateway-client balancing, not Microbranch routing modes, and D incorrectly assumes corporate DHCP/L2 simulation is intrinsic to both L3 modes. The deciding factor is whether upstream networks see the client subnet or an AP-translated address.

Official HPE references | Layer 3 Microbranch - Validated Solution Guide • Configuring VLANs - Microbranch | Study-guide topic: Introduction to AOS-10

Technical explanation

A managed device needs an administrative location and a policy context so Central can place it in the correct monitoring and configuration population. Site assignment supports local health, geographical grouping and reporting; Device Group associates consistent configurations across devices that may occupy separate sites. Check inventory ownership, valid subscription, device function, reachability and the intended scope before activation. SNMPv3 credentials and management VRFs are optional design elements, not universal onboarding prerequisites for every AP, switch and gateway.

SNMPv3 profiles are not universal onboarding prerequisites, and many sites do not use a management VRF. Correct site/group association gives devices configuration and operational context; the exact order of assignment can depend on the onboarding workflow.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Central's Key Management Service distributes an authenticated station record to neighboring APs. For supported fast-roaming methods, this can include the Pairwise Master Key or derived 802.11r keys, alongside the client's VLAN, role and authentication state. AirMatch supplies RF-neighbor information used to target synchronization. The destination AP can therefore complete a shortened key exchange without repeating the entire initial 802.1X transaction. The mechanism depends on supported clients and configured roaming behavior; it does not mean that all station keys are indiscriminately replicated throughout the entire enterprise. The initial 802.1X authentication establishes a cached key context; KMS distributes PMK or 802.11r-derived material plus VLAN/role information to neighbors selected using AirMatch adjacency. Clients still perform a four-way exchange during the roam.

Forcing full 802.1X authentication on every roam increases latency, and keys stored only on the old AP provide no fast key material at the new radio. KMS shares cached keying and station context with neighbors, though clients still complete the applicable handshake. The WLAN Security settings control 802.11r and related fast-roaming features; KMS supplies the station record and key material to eligible neighboring APs.

Official HPE references | Roaming and the Key Management Service • AirMatch | Study-guide topic: Introduction to AOS-10

Technical explanation

The AP's connectivity performance data should be read alongside its current associated-client population so an apparent throughput drop is not mistaken for reduced demand. Compare upstream and downstream rates, concurrent user count, radio-band split and temporal trends. High association count does not necessarily equal saturation; airtime consumption and retries matter more than device count alone. The health overview aggregates fault indicators, while radio optimization shows RF planning rather than the immediate per-device operational throughput requested.

The global health view is useful for finding unhealthy APs but not monitoring one radio’s live load. RF Optimization focuses on channel/power optimization. Open the individual AP context for real-time performance and client-count telemetry.

Official HPE references | AirMatch • Planets in Global Monitoring Page | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Port Profile creation follows the functional configuration areas of general properties, VLAN/network settings, authentication/security and loop-prevention parameters. General settings include administrative status, PoE and MTU; network settings define VLAN modes; security associates relevant 802.1X or MAC-authentication policy; loop protection controls spanning-tree and safeguard behavior. The wizard's exact visual organization may evolve by Central release or switch family, but these concerns form the intended design sequence. Save the profile and associate it with the correct interface/device scope before expecting changes on hardware.

System/routing, inventory/licensing, and BFD/VRF lists describe other workflows. This question refers to the switch port profile’s general, VLAN, authentication, and loop-prevention stages—not generic onboarding or Layer 3 design.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Gateway clustering couples high-availability datapath behavior with user state synchronization, load distribution and WLAN mobility support. Client traffic can be anchored and balanced across available gateways, and the cluster can preserve service through supported node failures or controlled software upgrades. Confirm that enough cluster capacity remains when a member is lost and that every gateway has consistent roles and tunnel reachability. RF channel planning belongs to AirMatch; DHCP snooping and spanning-tree are separate switching/security mechanisms rather than principal gateway-cluster benefits. A cluster maintains user-to-gateway mappings and shares relevant state across peers, improving failure recovery and distributing load. A design without valid cluster connectivity cannot provide that continuity simply because two gateways are online.

RF power/channel algorithms belong to radio management, and DHCP snooping or ARP inspection belong to switch security. Spanning tree and stack monitoring are Layer 2 infrastructure functions. Cluster value is the coordinated client state and traffic continuity between gateway peers.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

In the global or site context, Device Health counts APs, switches, gateways and bridges by health classification. Expand the card to compare the same metrics by site and select the affected location for a closer device list. Health aggregation helps prioritize teams and incidents by location but should not be interpreted as identifying the underlying fault. Inventory primarily lists assets and assignment, while AI Insights investigates patterns and anomalies; the health card is the direct summary requested.

Inventory can count devices but is not organized around their assessed health; AI Insights explains anomalies rather than serving as the core device-count summary. The Device Health card answers the operational question directly.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

An EAP timeout indicates that an expected authentication message or reply did not arrive within its timer; it is not equivalent to an explicit credential rejection. Verify that the gateway or appropriate AP can reach the configured RADIUS server over the correct network, that shared credentials are valid and that UDP 1812 or configured RadSec connectivity functions. Inspect server logs for received requests and response latency. Only after establishing transport health should you inspect user accounts, certificates or EAP-method mismatches.

An “EAP timeout” is a lack of a timely authentication response, not inherently a bad password; credential failures usually create a rejection. Replacing certificates without checking network reachability can destroy useful evidence and does not restore an unreachable server. If RADIUS requests leave the gateway but responses are absent, check firewall rules, shared-secret configuration and server processing. If a timely Access-Reject returns instead, move the investigation to credentials or authorization.

Official HPE references | Troubleshooting Tools • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

AirMatch is the Central-hosted RF optimization service that computes channel, bandwidth and EIRP plans from aggregated radio telemetry. It can optimize neighboring radios together rather than having each AP operate on purely local observations. The service normally calculates scheduled improvements and can react to urgent RF events, subject to regulatory channel constraints and deployment settings. ARM is an earlier local RF-management approach, while ClientMatch primarily addresses client-to-AP association and steering rather than the overall channel/power plan.

ARM is the legacy/local RF adjustment concept, while ClientMatch steers associations among available APs. AirMatch plans channels, channel widths, and transmit powers using network-wide conditions; that is the AOS-10 RF management component.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The Device Health summary provides an immediate qualitative assessment and can be expanded into the metrics or counts driving the classification. Review whether poor health is caused by uptime, hardware alarms, temperature, stack state or other supported indicators. The Hardware card exposes component detail but does not provide the same concise overall health categorization. The topology map answers where devices connect; health scoring answers which managed components require attention. Cross-check the classification against current device reachability before declaring an outage.

The Hardware card examines physical components, whereas the topology view is concerned with connection relationships. Neither replaces the direct health summary used for first-pass switch triage.

Official HPE references | Device Health Card • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

A static route is entered deliberately by an administrator. Its next hop and destination do not update through routing-protocol advertisements. If the interface disappears, the route may become inactive, but it has not learned an alternative path the way OSPF or BGP can. Static routes do not learn topology changes from protocol updates. Their administrative overhead is not universally greater than a dynamic protocol’s, and multicast capability is irrelevant. Static entries are intentionally configured and changed by administrators.

Official HPE references | Creating a VLAN Profile • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

A cloud-native management plane integrates deployment, monitoring, troubleshooting, security posture and software maintenance across geographically separated sites. AI-based correlations help focus investigations, while APIs allow authorized external workflows to inventory devices, retrieve statistics or make controlled configuration updates. Unified operation does not depend on SNMPv3 alone; SNMP is one management protocol and cannot supply all policy, firmware and client-experience functions. Workspaces govern administrative organization and delegation, but they do not themselves replace the multi-site management architecture.

A workspace defines organizational separation, not by itself an operating model for coordinated multi-site management. SNMPv3 secures one management protocol but does not produce Central’s configuration inheritance, AI analysis, and cross-domain workflows.

Official HPE references | Application Programming Interface (API) FAQ • Multi-Level Hierarchy | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A connection-path visualization relates the client to relevant network nodes and may reveal which hop or service segment reports impaired connectivity. Use it as a structured investigative starting point, then corroborate packet loss using sourced ping, path tests, interface-drop counters and device logs. A logical path diagram is not a packet capture and may omit details of transient ECMP or tunneling behavior. Distinguish RF frame loss on the client/AP link from packet drops on a wired uplink or gateway datapath before applying a fix.

An alert summary merely declares a condition and compliance tracks intended state, not packet forwarding. Connection Path helps narrow which segment of the client experience is impaired, but it should not be treated as proof of every dropped hop without corroborating tests.

Official HPE references | Troubleshooting Tools • Application Visibility | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

If the WLAN uses EAP-TLS, validate certificate issuance, identity mapping, chain of trust, validity dates and the server certificate's extended key usage. Also verify that clients trust the RADIUS server and that the authentication backend permits the negotiated TLS version and cipher suites. WPA3-Enterprise does not inherently require EAP-TLS in every deployment; the first check depends on the actual EAP method selected. A personal-mode preshared key and captive portal are not substitutes for an enterprise 802.1X authentication exchange. A server presenting an expired leaf certificate or an intermediate CA missing from the client trust store can fail even when RADIUS reachability is healthy. Compare the EAP method negotiated by the supplicant with the authentication server policy.

A PSK is irrelevant to 802.1X enterprise key exchange. Captive portal is a web authorization stage, not an EAP-TLS handshake repair. Certificate checks are decisive only when this SSID actually uses EAP-TLS; with PEAP or another EAP method, inspect that method instead.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

An SVI is a virtual Layer 3 interface associated with a VLAN. Give it an IP address and mask from that VLAN's subnet so clients can use it as a default gateway and the switch can route toward other connected networks. Ensure IP routing is enabled, VLAN membership is correct and any VRF association is intentional. A local profile or address alias may be necessary when individual switches need distinct IPs; the basic requirement is the assigned SVI address, not the site scope itself or a static aggregate link.

Site scoping governs distribution of configuration, not whether an SVI has an IP gateway. A static LAG aggregates physical links without creating a routed VLAN interface. The SVI needs its own suitable IP address on the associated subnet.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

A mixed-mode SSID supports both bridged and tunneled forwarding, selected according to the client VLAN and deployment configuration. Put POS endpoints in the locally bridged role/VLAN where latency-sensitive branch processing must remain onsite; tunnel the guest VLAN toward a DMZ gateway cluster where centralized inspection is required. Ensure guest VLANs terminate on gateways and are not accidentally carried onto the AP's local switching trunk. Mixed mode is not arbitrary per-packet application steering; the forwarding selection must match the actual WLAN/VLAN policy. Under mixed forwarding, the relevant VLAN assignment decides the datapath. Ensure POS VLANs are permitted on the local AP uplink, while the guest VLAN is present on the gateway cluster for tunneling.

All-tunnel forwarding would backhaul the POS transactions unnecessarily; all-bridge forwarding would bypass the DMZ gateway for guests. Mixed forwarding is selected per VLAN/client role, so different VLANs require the intended bridge/tunnel mapping and uplink support. The AOS-10 WLAN wizard exposes Traffic Forwarding Mode = Mixed in its VLAN settings, with a primary gateway cluster for tunneled VLANs.

Official HPE references | AOS-10 Traffic Forwarding Modes • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

Select the interval matching the overnight complaint and inspect event timestamps against authentication failures, DHCP activity, uplink transitions, AP restarts and configuration pushes. Correlating several event categories avoids mistaking the symptom for its cause. For example, multiple client disconnects coinciding with a PoE switch reboot indicate a likely shared infrastructure problem, not dozens of individual WLAN faults. Remember that dashboards may aggregate or delay telemetry; use raw device logs or system audit records when minute-level ordering matters.

A neighbor count reports adjacency, not the precise start and end of an incident. Subscription expiry is useful for licensing administration but cannot explain a ten-minute night-time interruption unless associated with specific device events.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The WLAN security and access configuration defines how unauthenticated clients reach the portal, what redirect URL or hosted portal is used, and how successful authentication changes the user's role. Configure the pre-authentication role so clients can resolve DNS and reach the portal while remaining blocked from protected services. The precise wizard tab differs across Central interface versions, but the captive-portal behavior belongs to the SSID's access/authentication workflow, not merely to a VLAN definition. Validate the redirect on multiple operating systems.

ClearPass may supply identity or guest services, but merely naming its Guest role does not configure HTTP redirection. The Guest security level alone does not replace a captive-portal profile, its pre-authentication rules, or the portal URL.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Anomaly detection compares observed telemetry against baselines rather than relying exclusively on static thresholds. Recurrent association failures, unusual RF retries, interface errors and abnormal device restarts can then be surfaced before incident volume grows. AI Insights should be treated as a prioritized diagnostic hypothesis: verify affected sites and devices, inspect contributing evidence, and implement a controlled corrective change. Not every recommendation is executed automatically; change control and operational ownership remain with administrators.

B reduces the platform to ticket creation, ignoring telemetry correlation and recommendations. C incorrectly portrays hardware replacement as a standard autonomous step. Engineers still assess whether an insight points to RF conditions, authentication, software, or failing hardware.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The rule is a logarithmic shortcut. A 3 dB gain multiplies linear power by 10^(3/10), approximately 1.995, so 1 mW becomes about 2 mW. In dBm, that is 0 dBm to roughly +3 dBm. A tenfold power increase requires +10 dB, not +3 dB. Negative 3 dB approximately halves power; negative 10 dB reduces it to one-tenth. The question is about power ratio, not a guarantee of twice the Wi-Fi range.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Site scope is appropriate because the desired values are identical for switches physically assigned to that location, even when they belong to different configuration groups. Create or assign the NTP Server Profile and Syslog Server Profile, and configure a Source Interface Profile only where source-IP selection is required. Confirm the device function and effective scope assignment, as an unassigned Library profile has no deployment effect. Avoid placing genuinely site-specific addresses at Global scope, where the settings would be inherited by unrelated branches.

A device group is useful when the same settings should span several sites; the requirement instead defines one physical location. Site collection would broaden the configuration beyond the requested site. Note that syslog uses its own server profile, alongside NTP and optional source-interface settings.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Enterprise mode uses the 802.1X and Extensible Authentication Protocol exchange between the supplicant and the authentication backend. Configure the primary RADIUS authentication server or server group, a shared secret or RadSec relationship as supported, and a reachable network path from the authenticating device. Certificate trust and appropriate EAP methods are equally important. VLAN assignment rules are optional authorization refinements, while WPA3 transition mode concerns compatibility and is not the component that performs enterprise identity validation.

Dynamic VLAN rules in B can follow authentication but are not a prerequisite for establishing the enterprise 802.1X session. WPA3 transition mode in C is not the RADIUS identity service. An authentication server is the missing dependency.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10