HPE6-A90 Questions and Answers

Technical explanation

With tunneled client forwarding, gateway policy becomes a consistent enforcement point for branch WLAN clients. Authentication, role assignment, user VLAN anchoring and traffic inspection can be coordinated centrally, while individual branches retain relatively modest local VLAN requirements. Check WAN latency, gateway cluster capacity, tunnel redundancy and failure behavior before choosing this architecture. Bridging all traffic locally can be valid in smaller branches, but it decentralizes the datapath and reduces the central inspection consistency stipulated by the scenario. A branch design using tunneled traffic also requires sufficient WAN capacity and a survivability plan. Centralized inspection is beneficial only when the gateway and transport remain appropriately available.

Bridge mode breaks out traffic at the AP and may enforce policy locally, so adding gateways without tunnel forwarding does not centralize inspection. Standalone APs lack the requested shared gateway datapath. A tunneled design consolidates enforcement at the gateway cluster.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The Connections card provides connection and session context for the selected clients, including whether attempts progressed through authentication and association. Group the failures by WLAN, radio, endpoint operating system and identity backend; a common failure stage often identifies the shared dependency. When an error appears as an authentication timeout, validate AAA transport and RADIUS responsiveness rather than assuming the passwords are incorrect. The RF Health and connectivity path cards answer different questions: spectrum condition and traffic path, respectively.

RF Health may explain weak links, while Connectivity Path is primarily a network-path view. Neither is as direct as the Connections card for linking unsuccessful authentication and connection status to actual client sessions.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The Device Health card summarizes how many access points are healthy, impaired or offline within the current site or global context. Its expanded representation can break counts down by site and by device class, helping the administrator rank incidents by blast radius. Distinguish an unreachable device from one still online but reporting degraded hardware or service health. RF Optimization is for radio planning, and topology is for connectivity relationships; aggregate health counts belong to the dedicated health view.

Topology says where APs attach; RF Optimization addresses channel/power behavior. Device Health is built to aggregate operational status and direct the engineer toward offline or degraded APs.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Port Profile creation follows the functional configuration areas of general properties, VLAN/network settings, authentication/security and loop-prevention parameters. General settings include administrative status, PoE and MTU; network settings define VLAN modes; security associates relevant 802.1X or MAC-authentication policy; loop protection controls spanning-tree and safeguard behavior. The wizard's exact visual organization may evolve by Central release or switch family, but these concerns form the intended design sequence. Save the profile and associate it with the correct interface/device scope before expecting changes on hardware.

System/routing, inventory/licensing, and BFD/VRF lists describe other workflows. This question refers to the switch port profile’s general, VLAN, authentication, and loop-prevention stages—not generic onboarding or Layer 3 design.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The series shorthand is a quick screening question rather than a migration compatibility matrix. Supported AOS-10 hardware spans selected 3xx, 5xx, and 7xx families. A serial-number inventory should be matched with HPE’s model-level support table and software release before scheduling AOS-10 adoption. Some older 3xx hardware has minimum or final supported releases; family membership does not override the exact SKU restrictions.

The options name broad hardware families rather than exact SKUs. The 2xx generation is outside the supported AOS-10 set, and “4xx series” is not included in the referenced supported-series choices. A 3xx selection still demands model-level and release-level validation.

Official HPE references | Supported Access Point Platforms for AOS-10 • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Firmware policy allows administrators to select devices by deployment scope, desired image and an upgrade mechanism. A live upgrade organizes participating APs into reboot sets rather than restarting the entire RF neighborhood together. Prechecks include supported AP hardware, appropriate licensing, access to image distribution and sufficient overlapping coverage. Schedule sites in controlled waves, observe client experience between waves and retain a backout plan. BIOS-dependent transitions and unsupported combinations may require a standard maintenance-window upgrade. For forty sites, stagger upgrade waves by RF coverage and criticality; avoid putting neighboring radios into the same reboot wave. Check the actual release supports the desired live-upgrade procedure for the APs involved.

Manually touching every AP multiplies administrative effort and risk across forty sites. An unscheduled global push can take adjacent radios offline together. A planned live-upgrade sequence is designed to preserve coverage while individual APs change software.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

A sourced ping confirms IP reachability between the selected AP and destination gateway interface if ICMP is permitted. Examine packet loss, round-trip time and response patterns while validating that the source VRF or interface is correct. A successful ICMP exchange establishes basic Layer 3 reachability but does not prove that user tunnels, RADIUS exchanges or application ports are functional. Where ping is filtered, traceroute or a protocol-specific test is more informative than treating silence as conclusive path failure.

A throughput or speed test addresses capacity, not necessarily basic L3 reachability. The Connectivity card is observational and may aggregate several paths. Source a ping from the AP to its gateway and inspect packet loss and response time.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

For multiple affected users, compare Client Event Log entries for a shared SSID, RADIUS server, authentication method and time interval. Similar failures concentrated after a policy or certificate change indicate a systemic cause; only one model or supplicant version failing suggests a client compatibility issue. Check whether the log reports rejection, response timeout or association loss before changing RADIUS policies. The broader Client dashboard helps establish scale, but the per-event failure messages supply the direct diagnostic evidence requested.

The Client dashboard is the route into a particular user session, but the Client Event Log contains the concrete failure record. Site Inventory lists managed assets rather than authentication exchanges. Use multiple affected clients to determine whether the issue is shared.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

VSX joins a pair of supported AOS-CX switches with independent control and management planes while synchronizing selected L2 forwarding state across an inter-switch link. Downstream MC-LAG connections can remain forwarding through the surviving peer after failure. Configure the keepalive in a resilient and isolated path, size the ISL appropriately and verify peer consistency. VSF, by contrast, presents a stack with a single logical control plane, which does not match the independent-plane requirement despite its access-layer resiliency benefits. In a two-core VSX design, a downstream access switch can form one LACP logical interface with one member on each core chassis. Fail one VSX peer during acceptance testing and confirm traffic remains on the surviving member.

VSF makes several members a logical stack with one control plane, so option A contradicts independent control and management. VRRP/MSTP on standalone peers can supply redundancy but not VSX’s state coordination and active-active MC-LAG behavior; they are not equivalent for this design.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Split-detection mechanisms determine which VSF fragment may continue forwarding after stacking-link partition, preventing two active control domains from advertising identical management identities or gateway addresses. On supported 6200/6300 families, management ports participate in detection; certain 4100i/6100 platforms instead use a dedicated MAD VLAN with front-plane ports. The standby fragment can disable non-VSF ports when the conductor fragment remains active. MC-LAG design does not solve a split-brain event inside a VSF stack, and daisy-chain topology offers less fault tolerance than a ring where supported.

MC-LAG applies to multichassis link aggregation, not detecting a partitioned VSF stack. A daisy chain may create a single break point rather than preventing split brain. VSF split detection is built for isolating dangerous dual-active fragments.

Official HPE references | VSF Profile • VSF Split Detection | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Examine stability-related insights alongside the actual reboot timestamps, reason codes, crash records and PoE history. Multiple APs rebooting after a switch power event indicate an upstream dependency; only one firmware build exhibiting exceptions suggests a software defect. Look for temperature thresholds, watchdog resets, memory exhaustion and unexpected power interruptions. A network topology view can identify a common switch, while RF Health addresses radio quality and will rarely establish why the AP operating system restarted.

The topology viewer may point to a shared PoE switch but has no reboot-reason classification. RF Health is primarily a radio-quality view. Stability-related insights, complemented by reboot reason and power history, best fit repeated restarts.

Official HPE references | Device Health Card • Troubleshooting Tools | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Instant AP groups traditionally use a local elected virtual conductor or equivalent cluster coordination model. AOS-10 APs do not select a local AP conductor for these centralized functions; configuration, RF planning, neighbor coordination and key-management services are orchestrated by Central. This does not imply that an AP is helpless during a cloud outage: existing datapath and configuration continue to operate within documented survivability limits. Some new coordination operations may be deferred until Central connectivity returns, whereas previously synchronized roaming information may remain available.

An elected AP conductor is the Instant model being contrasted, not the AOS-10 architecture. Peer-only telemetry and local controller-based roaming do not describe Central’s cloud-supported services; individual APs maintain their datapaths while Central provides relevant shared services.

Official HPE references | AOS-10 Cloud Services • Roaming and the Key Management Service | Study-guide topic: Introduction to AOS-10

Technical explanation

AirMatch is the Central-hosted RF optimization service that computes channel, bandwidth and EIRP plans from aggregated radio telemetry. It can optimize neighboring radios together rather than having each AP operate on purely local observations. The service normally calculates scheduled improvements and can react to urgent RF events, subject to regulatory channel constraints and deployment settings. ARM is an earlier local RF-management approach, while ClientMatch primarily addresses client-to-AP association and steering rather than the overall channel/power plan.

ARM is the legacy/local RF adjustment concept, while ClientMatch steers associations among available APs. AirMatch plans channels, channel widths, and transmit powers using network-wide conditions; that is the AOS-10 RF management component.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Troubleshooting History preserves the session identifier, device context, executed test and results so a diagnostic run can be compared with earlier observations. Operators can export relevant records for incident notes or maintenance evidence. Historical tests reveal changes in latency, reachability or cable status, whereas an audit trail primarily records who performed an action and when. Retention is version-dependent, so export sessions that must survive the platform's history window and record the requested time range in the incident ticket. From a site, open Network, select the device, launch Troubleshoot, then choose History to reopen earlier sessions.

Audit Trail answers who changed configuration; it is not the archive of test output. A Network overview Events card records network events, not earlier diagnostic command results. History in Troubleshoot is where a second engineer retrieves a prior session.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A global firmware policy captures the intended version and device-function targeting so compliance can be monitored consistently across the managed estate. Confirm model compatibility, exceptions, upgrade scheduling and whether the hardware supports the selected image before enforcement. Sites with specialized requirements may need explicit model or scope exceptions; forcing an incompatible universal version would undermine standardization. AI Insights may recommend remediation but should not be treated as a silent, universal firmware installer. Inspect deployment state and post-upgrade reachability in the policy workflow.

AI Insights does not silently enforce a software version. A general system profile governs operating settings, not the firmware lifecycle. A Global firmware policy defines the target release and enforcement schedule, unless a more specific scope overrides it. For the common target version, use Menu > Firmware Management > Manage > Global > Create Firmware Policy. Define the device function, version and schedule.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

An AOS-10 gateway cluster coordinates user anchoring, tunnel termination, client-state synchronization and resilience across eligible members. A client session can be maintained by another cluster gateway during a supported failure or live-upgrade operation, subject to design and software capabilities. Verify tunnel reachability, cluster membership, role policy equivalence and available forwarding capacity on the surviving peer. VRRP provides a redundant virtual IP for certain designs but does not by itself reproduce all of the stateful mobility and gateway-cluster services involved in wireless user continuity.

VRRP protects a virtual default-gateway address but is not equivalent to AOS-10 gateway-cluster client-state orchestration. LACP cannot form a valid logical bundle between unrelated, unlinked gateways. Cluster membership supplies the stateful failover context. Check active tunnel and user-session state before simulating peer loss. A virtual IP floating between standalone routers is not proof that tunneled wireless client sessions survive a gateway failure.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Creating an SVI directly for a particular switch requires a device-appropriate local profile so its unique routed address is not unintentionally imposed on every switch that shares the VLAN definition. Reusable VLAN identity and shared subnet policy can remain centrally defined while the interface IP is assigned locally or through a device-specific alias. Validate address uniqueness and routing adjacency after deployment. A Library object cannot independently carry a unique per-device address without appropriate scope or alias resolution, and disabling the VLAN defeats the logical SVI's Layer 2 association.

A Library profile is normally a reusable template, not the place for every switch’s unique SVI address. Disabling the VLAN destroys the L3 VLAN interface’s purpose. The Switch Interface Configuration profile is related to applying profiles to interfaces, but the per-switch IP is entered as local SVI configuration.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Live upgrade orchestrates staged AP restarts so coverage from unaffected neighbors continues serving users. Verify AP clustering or other supported live-upgrade prerequisites, firmware path, image availability and Advanced licensing when required by the deployed platform. Schedule the execution with awareness of RF design: in a poorly overlapped area, even one AP reboot can disrupt clients. Maintain deployment monitoring and post-change authentication checks. Manually reimaging each AP or relocating devices into a test site is operationally unnecessary and introduces more risk.

Console-based reflashing does not scale to a campus fleet, and relocating APs to a test site creates monitoring and policy confusion. Live Upgrade sequences eligible APs while the remaining radios continue serving much of the coverage area.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

Strong RSSI only describes received power, not usable airtime or signal quality. A busy 5 GHz channel can produce high frame retries and low throughput even with a strong signal. Compare SNR, channel occupancy, neighboring BSSs, airtime consumption, client transmit rates and upstream interface errors. Increasing every AP's EIRP creates additional co-channel overlap and can produce asymmetric uplink performance because client radios transmit at lower power. Lowering minimum data rates is likewise a design intervention, not an evidence-based first diagnostic action.

Reducing the minimum data rate can increase the airtime consumed by slower frames. Blanket power increases expand contention cells and may worsen interference. Strong RSSI paired with poor throughput is a reason to inspect airtime, retries, and neighboring radios first.

Official HPE references | AirMatch • Planets in Global Monitoring Page | Study-guide topic: Introduction to AOS-10

Technical explanation

Create a VSX pair in the aggregation tier and a VSX LAG/MC-LAG extending to each aggregation member, while the access stack uses LACP toward the two peers. The access device sees a single logical bundle even though the links terminate on different chassis. Correct ISL, peer keepalive, VLAN membership and LACP settings are essential for deterministic failover. Separate unaffiliated access ports force spanning-tree or routed-design considerations and do not deliver the same active-active link aggregation behavior.

Two independent access ports are not an LACP bundle across two chassis. Making a separate VRF for each link only isolates routing state. VSX with a multi-chassis LAG supports forwarding on both uplinks while preserving peer independence. For acceptance, disconnect each upstream aggregation peer in turn and confirm the LACP bundle remains up on the other peer. An undersized VSX ISL or incorrectly routed keepalive can defeat the intended resilience.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

WPA3-Enterprise enables 802.1X/EAP-based per-user authentication rather than a shared preshared key. Select EAP-TLS when the policy mandates client certificates; provision trusted PKI roots, server certificates, identity mappings and renewal procedures. EAP-TLS offers mutual certificate-based validation and avoids the password-only model, but WPA3-Enterprise is the WLAN security family and EAP-TLS is the specific authentication method. WPA3-Personal is password-oriented, and transition mode or RadSec transport alone does not impose employee certificate authentication.

WPA3-Personal relies on SAE with a shared passphrase, not enterprise EAP-TLS identity. WPA3 transition options address interoperability and RadSec secures RADIUS transport; neither alone establishes the requested client-certificate mode.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Gateway clustering couples high-availability datapath behavior with user state synchronization, load distribution and WLAN mobility support. Client traffic can be anchored and balanced across available gateways, and the cluster can preserve service through supported node failures or controlled software upgrades. Confirm that enough cluster capacity remains when a member is lost and that every gateway has consistent roles and tunnel reachability. RF channel planning belongs to AirMatch; DHCP snooping and spanning-tree are separate switching/security mechanisms rather than principal gateway-cluster benefits. A cluster maintains user-to-gateway mappings and shares relevant state across peers, improving failure recovery and distributing load. A design without valid cluster connectivity cannot provide that continuity simply because two gateways are online.

RF power/channel algorithms belong to radio management, and DHCP snooping or ARP inspection belong to switch security. Spanning tree and stack monitoring are Layer 2 infrastructure functions. Cluster value is the coordinated client state and traffic continuity between gateway peers.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

A guest role must implement explicit deny rules against internal RFC1918 ranges and sensitive management subnets, followed by permitted DNS, DHCP, captive portal and internet services as appropriate. Confirm the enforcement point: it may be an AP, a gateway, or a switch depending on the forwarding model. Segmentation by VLAN or VRF adds isolation, but a separate VRF is not universally mandatory when a correctly ordered stateful policy blocks east-west access. Test both DNS resolution and attempts to reach internal hosts. For validation, associate a guest device, obtain its assigned role and subnet, then test access to the internet and to an internal host on each protected network. A successful web redirect alone does not demonstrate isolation.

A mixed forwarding SSID is a traffic-location choice, not an authorization policy; bridging employees or tunneling guests does not itself deny private destinations. A distinct VRF can strengthen segmentation but is not inherently required for internet-only guest access.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The client summary provides a population-level view of association and connectivity patterns within the selected time window. Narrow the view by SSID, site, AP or client identity to distinguish widespread service instability from a handful of devices. Inspect detailed client events to identify whether drops are tied to reassociation, authentication failures, DHCP renewals or AP connectivity loss. A topology map is useful for path context but not as a primary history plot; RF optimization focuses on the physical radio environment instead of user sessions.

A topology map reveals AP connectivity but does not itself chart a client’s connection history. RF Optimization diagnoses radio conditions; it cannot substitute for a time-ordered list of session drops for the specific SSID and clients.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The timeline allows metrics and events to be viewed within the same historical period as the reported slowdown, making temporal correlation possible. Compare interface throughput, link errors, CPU alarms, client health and configuration changes for the chosen window. A coincident alert is only a lead; corroborate a causative relationship through device counters or reproducible symptoms. The Hardware card is best for component condition, and the Connectivity card may expose the metrics, but the time-range widget is what makes historical comparison practical.

Hardware inventory does not reveal the past throughput curve. Connectivity data is useful only when viewed at the required period; the Timeline widget is the explicit control for changing the observation window.

Official HPE references | Device Health Card • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central