HPE7-A06 HPE Campus Access Switching Expert (Written) Practice Questions

User-Based Tunneling (UBT), also known as Dynamic Segmentation, is the Aruba technology designed for this exact purpose. When a user authenticates, ClearPass assigns them a user role. This role is downloaded to the ArubaOS-CX switch, which then tunnels the user's traffic to a central enforcement point (an Aruba Gateway or another switch). The role contains the policy (ACLs, QoS, etc.) that is applied to the user's traffic, providing consistent enforcement based on identity, not physical location.

When a route is redistributed from an IGP (like OSPF) into BGP, the OSPF metric is, by default, carried over into the BGP Multi-Exit Discriminator (MED) attribute. Assuming other higher-priority BGP attributes (like Weight, Local Preference, AS_PATH) are equal, the BGP best path algorithm will use the MED to break the tie. It will prefer the path with the lower MED value, which corresponds to the lower OSPF cost, making it the 'closest' exit point from the BGP domain.

The OSPF Init state means a router is receiving Hello packets from a neighbor but does not see its own Router ID in those packets, indicating a one-way communication problem. Since physical and IP connectivity are confirmed, a common cause is an ACL blocking the return OSPF traffic. The core switch can send Hellos, but the distribution switches' Hellos are being blocked by an inbound ACL on the core switch. This prevents the core switch from seeing its own ID in the neighbor's Hello packet, so the state never progresses to 2-Way.

Bridge mode is the ideal forwarding mode for this scenario. In bridge mode, the AP bridges the guest clients' traffic directly onto the local wired network segment it is connected to. This allows the guest traffic to be placed on a dedicated guest VLAN at the access layer, which can then be routed directly to the internet firewall, completely bypassing the corporate network and the mobility conductors. Tunnel mode would send the traffic back to the conductor, which is not desired for guest traffic isolation.

The order of methods in the aaa authentication command defines the sequence in which the switch attempts authentication. The command aaa authentication login default group tacacs local instructs the switch to first attempt authentication against the configured TACACS+ server group. If all servers in that group are unreachable (timeout), it will then fall back to using the locally configured user database. This provides the desired behavior of central authentication with a local fallback.

The most scalable, secure, and precise method for controlled inter-VRF routing on ArubaOS-CX switches is using Multi-Protocol BGP (MP-BGP) with route targets (RTs). By configuring specific RTs for export on one VRF and for import on another, an administrator can selectively leak only the required routes (e.g., the monitoring service prefix) without merging the entire routing tables. Static routes are less dynamic, and PBR is more for path selection than inter-VRF routing. Merging VRFs into a global table is insecure and defeats the purpose of segmentation.

A common failure point for NAE agents is an incorrect resource URI. If the script's monitor is trying to access a path like /rest/v10.04/system/bgp/neighbors but the path is wrong, misspelled, or unsupported in the current firmware, the agent cannot retrieve data and will not trigger alerts. Another likely issue is that the condition being checked in the script logic is never met, so the alert action is never called.

Even if the agent is monitoring the correct URI, the Python logic that evaluates the data might be flawed. For example, if the script checks for neighbor_state == 'down' but the state is actually reported as 'Idle' or 'Connect', the condition will never evaluate to true, and the alert action will not be triggered. This is a common issue in script-based monitoring.

This statement is true. The VSX keepalive connection is a critical component for split-brain detection (dual-active scenario). It operates at Layer 3 and is used as a heartbeat mechanism when the Inter-Switch Link (ISL) fails. A direct point-to-point connection is the recommended and most reliable design, although routing it through an OOB management network is a possible, though less ideal, alternative.

ClearPass Profiling is the feature designed for device identification. It collects attributes from network traffic and authentication requests (like DHCP fingerprints, MAC OUI, and LLDP data) to classify endpoints. Once a device is profiled (e.g., identified as a 'Polycom IP Phone'), enforcement policies can use this profile information as a condition to return specific RADIUS attributes, such as Tunnel-Private-Group-ID, which instructs the switch to place the device in the correct VLAN.

In a VSX environment, PIM must be configured on both switches. The pim active-forwarding command should be enabled on the SVIs within the VSX pair. This allows both switches to actively forward multicast traffic, preventing traffic from being dropped and enabling efficient load balancing. PIM state is not synchronized via VSX; each switch maintains its own PIM neighbor relationships and state tables. Disabling PIM on one switch would break multicast routing.