HPE6-A90 HPE Networking Central Exam Question and Answers

Technical explanation

A tunneled SSID sends the relevant wireless user traffic to a gateway cluster, where the gateway can evaluate its stateful role-based policies. Confirm that the client's role is assigned at authentication, that the correct rules are installed at the gateway, and that user VLANs terminate on the cluster. Bridged forwarding keeps the datapath local, so policies on a remote gateway cannot inspect those frames. Mixed mode may tunnel selected VLANs, but the simple and unambiguous choice for all affected users is tunneled forwarding. If gateway inspection is mandatory for every client in the given role, mixed forwarding introduces an avoidable bypass condition because a locally bridged VLAN can avoid the gateway datapath.

Microbranch patterns provide selective site forwarding but do not automatically place every target session in the gateway datapath. Mixed mode can bridge some clients locally, bypassing centralized inspection. Tunnel mode makes gateway-side enforcement the explicit default path.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Enterprise mode uses the 802.1X and Extensible Authentication Protocol exchange between the supplicant and the authentication backend. Configure the primary RADIUS authentication server or server group, a shared secret or RadSec relationship as supported, and a reachable network path from the authenticating device. Certificate trust and appropriate EAP methods are equally important. VLAN assignment rules are optional authorization refinements, while WPA3 transition mode concerns compatibility and is not the component that performs enterprise identity validation.

Dynamic VLAN rules in B can follow authentication but are not a prerequisite for establishing the enterprise 802.1X session. WPA3 transition mode in C is not the RADIUS identity service. An authentication server is the missing dependency.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

AI-derived RF recommendations should be assessed against channel quality, neighboring AP assignments, regulatory limits and the operational change window. AirMatch computes channel, bandwidth and power plans from aggregated AP telemetry, rather than assuming every AP requires a manual static channel. Confirm the recommendation fits the affected site's survey and any reserved channels before permitting changes. Disabling AirMatch eliminates the automation that normally manages RF resource reuse and is not a logical response to detected overlap.

Manually rebuilding every AP channel plan discards the fleet-wide context of AirMatch. Disabling AirMatch removes the optimization mechanism that can correct overlap. Check the recommendation’s assumptions and scope before applying it.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

When many access ports share the same traffic role, centrally define admin state, speed/MTU, access or trunk VLAN mode, QoS, authentication and protection in a reusable Port Profile. Association of that profile with the desired interfaces yields repeatable intent and easier compliance inspection. Separate templates should be maintained for users, voice/phones, printers and uplinks where the behavior differs. A unique or short-lived diagnostic change on one port does not justify broad profile reuse and may cause unintended outages if inherited. Under Configuration > Interfaces > Port Profile, use Create profile for the shared baseline and assign it to eligible switch interfaces.

A unique uplink or a temporary lab change needs local handling rather than a shared policy object. Reading counters and LLDP is a monitoring task, not a profile-deployment task. Profiles pay off when many ports must share a stable baseline.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

An EAP timeout indicates that an expected authentication message or reply did not arrive within its timer; it is not equivalent to an explicit credential rejection. Verify that the gateway or appropriate AP can reach the configured RADIUS server over the correct network, that shared credentials are valid and that UDP 1812 or configured RadSec connectivity functions. Inspect server logs for received requests and response latency. Only after establishing transport health should you inspect user accounts, certificates or EAP-method mismatches.

An “EAP timeout” is a lack of a timely authentication response, not inherently a bad password; credential failures usually create a rejection. Replacing certificates without checking network reachability can destroy useful evidence and does not restore an unreachable server. If RADIUS requests leave the gateway but responses are absent, check firewall rules, shared-secret configuration and server processing. If a timely Access-Reject returns instead, move the investigation to credentials or authorization.

Official HPE references | Troubleshooting Tools • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

AirMatch is the Central-hosted RF optimization service that computes channel, bandwidth and EIRP plans from aggregated radio telemetry. It can optimize neighboring radios together rather than having each AP operate on purely local observations. The service normally calculates scheduled improvements and can react to urgent RF events, subject to regulatory channel constraints and deployment settings. ARM is an earlier local RF-management approach, while ClientMatch primarily addresses client-to-AP association and steering rather than the overall channel/power plan.

ARM is the legacy/local RF adjustment concept, while ClientMatch steers associations among available APs. AirMatch plans channels, channel widths, and transmit powers using network-wide conditions; that is the AOS-10 RF management component.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Cloud applications, IoT sensors, mobile devices and real-time collaboration increase east-west and internet-bound dependencies across the network. The result is higher demand for secure identity-based access, predictable wireless performance, visibility and rapid incident response. Digital transformation does not eliminate routing, switching, authentication or operational telemetry; it makes availability and observability more consequential. Centralized management helps maintain consistent policies and detect cross-domain faults, especially when locations lack onsite networking specialists. Cloud adoption does not eliminate network troubleshooting; it redistributes dependencies. Applications are generally not executed on ordinary campus switches, and self-service connectivity does not remove IT responsibility for enterprise access policy and service quality.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A mixed-mode SSID supports both bridged and tunneled forwarding, selected according to the client VLAN and deployment configuration. Put POS endpoints in the locally bridged role/VLAN where latency-sensitive branch processing must remain onsite; tunnel the guest VLAN toward a DMZ gateway cluster where centralized inspection is required. Ensure guest VLANs terminate on gateways and are not accidentally carried onto the AP's local switching trunk. Mixed mode is not arbitrary per-packet application steering; the forwarding selection must match the actual WLAN/VLAN policy. Under mixed forwarding, the relevant VLAN assignment decides the datapath. Ensure POS VLANs are permitted on the local AP uplink, while the guest VLAN is present on the gateway cluster for tunneling.

All-tunnel forwarding would backhaul the POS transactions unnecessarily; all-bridge forwarding would bypass the DMZ gateway for guests. Mixed forwarding is selected per VLAN/client role, so different VLANs require the intended bridge/tunnel mapping and uplink support. The AOS-10 WLAN wizard exposes Traffic Forwarding Mode = Mixed in its VLAN settings, with a primary gateway cluster for tunneled VLANs.

Official HPE references | AOS-10 Traffic Forwarding Modes • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

An SVI is a virtual Layer 3 interface associated with a VLAN. Give it an IP address and mask from that VLAN's subnet so clients can use it as a default gateway and the switch can route toward other connected networks. Ensure IP routing is enabled, VLAN membership is correct and any VRF association is intentional. A local profile or address alias may be necessary when individual switches need distinct IPs; the basic requirement is the assigned SVI address, not the site scope itself or a static aggregate link.

Site scoping governs distribution of configuration, not whether an SVI has an IP gateway. A static LAG aggregates physical links without creating a routed VLAN interface. The SVI needs its own suitable IP address on the associated subnet.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The licensing distinction must be read against the actual entitlement matrix, not assumed from feature names. HPE lists base AI Insights under Foundation, while its official Classic Central AP license table lists Unified Communications and Collaboration (UCC) and Live Upgrades under Advanced. UCC visibility concerns voice/video collaboration experience; Live Upgrade is a firmware-maintenance orchestration capability. The test’s answer key singles out UCC, but the wording admits another Advanced-only selection in that documented matrix.

The Foundation license includes AI Insights, making C ineligible as an Advanced-only distinction. However, HPE’s official Classic Central license table places both UCC and Live Upgrades in the Advanced column. Accordingly, A is the supplied key but B also satisfies the literal wording; the question is not unambiguous as a single-choice item.

Source-specific qualification: HPE’s AP Foundation and Advanced License table places both UCC and Live Upgrades under Advanced. A single-answer interpretation of this question therefore requires the intended curriculum/release context.

Official HPE references | AP Foundation and Advanced License – HPE Aruba Networking Central • Dynamic Application Prioritization Profile | Study-guide topic: Introduction to AOS-10

Technical explanation

The central entity represents the context from which the operator is exploring relationships, while surrounding planets or objects provide contextual navigation to clients, devices, sites and applications. Changing the selected site or device changes the perspective, not necessarily the physical network topology. This visualization should be understood as an information-architecture mechanism rather than a literal routing map. A primary gateway, the internet edge or a severe alarm can be an object of interest, but none universally defines the central point. An internet edge, a gateway cluster, or an alert source may be visible in a given context but does not universally anchor the solar representation. The center represents the object currently being explored, allowing the surrounding relationships to shift.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Interpret the card as a triage tool: percentages place the sites with more severe health impact at the top, so an administrator can focus on locations needing action. The underlying site-health computation combines device health with client experience, rather than relying solely on offline device counts. A site without active clients may be evaluated using device health alone. When comparing apparently similar sites, open the underlying health bar and examine affected populations before prioritizing remediation exclusively from the ordering.

Option A puts alphabetic order before health severity; C moves names ahead of fair-health severity; D ranks fair above poor. The specified sort is severity-first, fair-health second, then name to resolve the remaining tie.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Central's Key Management Service distributes an authenticated station record to neighboring APs. For supported fast-roaming methods, this can include the Pairwise Master Key or derived 802.11r keys, alongside the client's VLAN, role and authentication state. AirMatch supplies RF-neighbor information used to target synchronization. The destination AP can therefore complete a shortened key exchange without repeating the entire initial 802.1X transaction. The mechanism depends on supported clients and configured roaming behavior; it does not mean that all station keys are indiscriminately replicated throughout the entire enterprise. The initial 802.1X authentication establishes a cached key context; KMS distributes PMK or 802.11r-derived material plus VLAN/role information to neighbors selected using AirMatch adjacency. Clients still perform a four-way exchange during the roam.

Forcing full 802.1X authentication on every roam increases latency, and keys stored only on the old AP provide no fast key material at the new radio. KMS shares cached keying and station context with neighbors, though clients still complete the applicable handshake. The WLAN Security settings control 802.11r and related fast-roaming features; KMS supplies the station record and key material to eligible neighboring APs.

Official HPE references | Roaming and the Key Management Service • AirMatch | Study-guide topic: Introduction to AOS-10

Technical explanation

RBAC separates identity, the abstract permission set and the resources to which those rights apply. Create roles with explicit privileges, assign those roles to users or groups and restrict scope to authorized sites or device functions. Users inherit privileges from their role membership; network devices do not inherit user access permissions from a 'role assignment' in the same sense. Validate least privilege using a test operator account rather than giving broad administrator rights simply to resolve visibility issues. In option A, devices incorrectly inherit the operator permissions. Option B attaches permissions to individual users rather than roles. Option C conflates equipment ownership with authorization. Mapping privileges to roles and roles to users is the RBAC principle.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Place only the front-desk APs for the required sites in the intended configuration group or apply the WLAN profile with an equivalent targeted scope. Confirm that non-front-desk APs do not inherit the SSID inadvertently and that the SSID is enabled on the desired radios. A broadly applied global WLAN followed by manual deletions creates drift and unpredictable inheritance. Separate per-AP copies increase maintenance cost; using a common profile makes subsequent security, portal and radio-setting updates consistent.

A global SSID followed by dozens of deletions is an exception-heavy rollout; per-AP configuration is even less maintainable. A group for front-desk APs gives a stable logical targeting mechanism independent of physical site, provided only intended APs belong to it.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Introduction to AOS-10

Technical explanation

Site scope is appropriate because the desired values are identical for switches physically assigned to that location, even when they belong to different configuration groups. Create or assign the NTP Server Profile and Syslog Server Profile, and configure a Source Interface Profile only where source-IP selection is required. Confirm the device function and effective scope assignment, as an unassigned Library profile has no deployment effect. Avoid placing genuinely site-specific addresses at Global scope, where the settings would be inherited by unrelated branches.

A device group is useful when the same settings should span several sites; the requirement instead defines one physical location. Site collection would broaden the configuration beyond the requested site. Note that syslog uses its own server profile, alongside NTP and optional source-interface settings.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The client summary provides a population-level view of association and connectivity patterns within the selected time window. Narrow the view by SSID, site, AP or client identity to distinguish widespread service instability from a handful of devices. Inspect detailed client events to identify whether drops are tied to reassociation, authentication failures, DHCP renewals or AP connectivity loss. A topology map is useful for path context but not as a primary history plot; RF optimization focuses on the physical radio environment instead of user sessions.

A topology map reveals AP connectivity but does not itself chart a client’s connection history. RF Optimization diagnoses radio conditions; it cannot substitute for a time-ordered list of session drops for the specific SSID and clients.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

AirWave was a traditional network management and monitoring product, whereas Central consolidates broader cloud-native configuration, lifecycle management, AI insight and cross-domain operations. A migration requires checking device support, licensing, configuration equivalence and historical monitoring requirements rather than assuming a simple database replacement. ClearPass continues to provide policy and AAA services where deployed, and Mobility Controllers or gateways participate in wireless traffic forwarding; these products are not the legacy management software intended by the question. ClearPass remains an access-policy/AAA product; a Mobility Controller or VPN concentrator forwards or terminates traffic. AirWave is the legacy network-management platform whose visibility and operations Central supersedes for supported deployments.

Official HPE references | Planets in Global Monitoring Page • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Accept Invite begins the account activation and identity verification process for an invited GreenLake user who has not yet completed registration. The invitation associates a person with the organization's workspace but does not automatically grant administrator privileges in every Central application. Role assignment and identity-provider configuration remain separate authorization concerns. If the recipient already has an HPE identity, the exact flow can involve signing in rather than creating a duplicate account; verify the destination workspace and permitted application scopes after acceptance.

Accepting the invite is not blanket access without identity creation or sign-in, and it does not confer administrator status by default. The invited person is guided into the GreenLake account/acceptance process with separately assigned permissions.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A cable test interrogates physical copper pairs for conditions such as opens, shorts, unexpected length and other faults when supported on that port. Run the test from the interface's troubleshooting tools and assess the result alongside link-flap timing, CRC counters, negotiated speed and transceiver diagnostics. Confirm whether the test is disruptive before using it on a production connection. Resetting the port conceals the symptom temporarily without isolating a fault; client-experience analytics are too far removed from the physical layer for a first check.

Resetting the switchport may briefly hide the symptom without locating its cause, while client health metrics reflect downstream impact rather than pair integrity. Cable testing is the test directed at copper defects, assuming the interface supports it.

Official HPE references | Troubleshooting Tools • Wired Interfaces Card for Switches | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Select the interval matching the overnight complaint and inspect event timestamps against authentication failures, DHCP activity, uplink transitions, AP restarts and configuration pushes. Correlating several event categories avoids mistaking the symptom for its cause. For example, multiple client disconnects coinciding with a PoE switch reboot indicate a likely shared infrastructure problem, not dozens of individual WLAN faults. Remember that dashboards may aggregate or delay telemetry; use raw device logs or system audit records when minute-level ordering matters.

A neighbor count reports adjacency, not the precise start and end of an incident. Subscription expiry is useful for licensing administration but cannot explain a ten-minute night-time interruption unless associated with specific device events.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

An AOS-10 gateway cluster coordinates user anchoring, tunnel termination, client-state synchronization and resilience across eligible members. A client session can be maintained by another cluster gateway during a supported failure or live-upgrade operation, subject to design and software capabilities. Verify tunnel reachability, cluster membership, role policy equivalence and available forwarding capacity on the surviving peer. VRRP provides a redundant virtual IP for certain designs but does not by itself reproduce all of the stateful mobility and gateway-cluster services involved in wireless user continuity.

VRRP protects a virtual default-gateway address but is not equivalent to AOS-10 gateway-cluster client-state orchestration. LACP cannot form a valid logical bundle between unrelated, unlinked gateways. Cluster membership supplies the stateful failover context. Check active tunnel and user-session state before simulating peer loss. A virtual IP floating between standalone routers is not proof that tunneled wireless client sessions survive a gateway failure.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

AOS-10 APs send operating state, radio channel and transmit-power parameters, RF noise/retry indicators, client counts and related performance telemetry to Central. Analytics services aggregate these measurements for RF optimization, health scoring, anomaly detection and troubleshooting. Authentication secrets are not normal monitoring telemetry, and AP reporting is not a replacement for extracting arbitrary upstream router tables. When connectivity to Central is disrupted, APs can continue their currently applied forwarding and RF plans, although cloud-dependent optimizations may be delayed. A useful operational validation is to compare AP-reported RF counters and connectivity status before and after a known interference or availability event. The resulting time-series permits trend diagnosis without copying authentication credentials into the management platform.

DHCP lease information and learned routes can exist elsewhere in the topology but are not the defining AOS-10 AP telemetry category. Secret authentication material is not a routine performance-telemetry feed. Radios report operational metrics used in health and RF decisions.

Official HPE references | AOS-10 Cloud Services • Roaming and the Key Management Service | Study-guide topic: Introduction to AOS-10

Technical explanation

WPA3-Enterprise enables 802.1X/EAP-based per-user authentication rather than a shared preshared key. Select EAP-TLS when the policy mandates client certificates; provision trusted PKI roots, server certificates, identity mappings and renewal procedures. EAP-TLS offers mutual certificate-based validation and avoids the password-only model, but WPA3-Enterprise is the WLAN security family and EAP-TLS is the specific authentication method. WPA3-Personal is password-oriented, and transition mode or RadSec transport alone does not impose employee certificate authentication.

WPA3-Personal relies on SAE with a shared passphrase, not enterprise EAP-TLS identity. WPA3 transition options address interoperability and RadSec secures RADIUS transport; neither alone establishes the requested client-certificate mode.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The AP's connectivity performance data should be read alongside its current associated-client population so an apparent throughput drop is not mistaken for reduced demand. Compare upstream and downstream rates, concurrent user count, radio-band split and temporal trends. High association count does not necessarily equal saturation; airtime consumption and retries matter more than device count alone. The health overview aggregates fault indicators, while radio optimization shows RF planning rather than the immediate per-device operational throughput requested.

The global health view is useful for finding unhealthy APs but not monitoring one radio’s live load. RF Optimization focuses on channel/power optimization. Open the individual AP context for real-time performance and client-count telemetry.

Official HPE references | AirMatch • Planets in Global Monitoring Page | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Gateway clustering couples high-availability datapath behavior with user state synchronization, load distribution and WLAN mobility support. Client traffic can be anchored and balanced across available gateways, and the cluster can preserve service through supported node failures or controlled software upgrades. Confirm that enough cluster capacity remains when a member is lost and that every gateway has consistent roles and tunnel reachability. RF channel planning belongs to AirMatch; DHCP snooping and spanning-tree are separate switching/security mechanisms rather than principal gateway-cluster benefits. A cluster maintains user-to-gateway mappings and shares relevant state across peers, improving failure recovery and distributing load. A design without valid cluster connectivity cannot provide that continuity simply because two gateways are online.

RF power/channel algorithms belong to radio management, and DHCP snooping or ARP inspection belong to switch security. Spanning tree and stack monitoring are Layer 2 infrastructure functions. Cluster value is the coordinated client state and traffic continuity between gateway peers.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Application Visibility uses traffic classification, including DPI where supported, to show application families, usage and performance context rather than merely physical neighbors. Filter by site, wired/wireless client, time window and application category to identify misuse or policy-impacting traffic. Compare classified flows with user-role rules, access controls and QoS treatment. Encryption limits the visibility of payload contents, so classification often relies on signatures, protocol characteristics and metadata; it should not be confused with unrestricted decryption of every application session.

A topology diagram does not categorize application flows, and inventory only identifies assets. Application Visibility supplies classified usage information that can be compared with QoS and role-based policies, subject to the available telemetry and DPI capabilities.

Official HPE references | Application Visibility • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central