HP HPE7-A01 Exam Questions Instant Access

Question 1

A customer has several hundred wireless loT devices and is looking for an authentication solution that meets the following requirements:

Which solutions will address the customer's requirements? (Select two.)

ALocal User Derivation Rules

BMPSK Local with MAC Authentication

CMPSK and an internal RADIUS server

DMPSK Local with EAP-TLS

EHPE Aruba Networking ClearPass Policy Manager

Answer : B, E

Question 2

Your customer is having connectivity issues with a newly-deployed Microbranch group The access points in this group are online in Aruba Central, but no VPN tunnels are forming.

What is the most likely cause of this issue?

AThere is a time difference between the AP and the gateways The gateways should have NTP added

BThe SSL certificate on the gateway used to encrypt the connection has not been added to the APs trust list

CThere may be a firewall blocking GRE tunneling between the AP and the gateway

DThe gateway group is running in automatic cluster mode and should be in manual cluster mode

Answer : C

This is the most likely cause of the issue where the access points in a Microbranch group are online in Aruba Central, but no VPN tunnels are forming. A Microbranch group is a group that contains both APs and Gateways and allows them to form VPN tunnels for secure communication. The VPN tunnels use GRE (Generic Routing Encapsulation) as the encapsulation protocol and IPSec as the encryption protocol. If there is a firewall blocking GRE traffic between the AP and the gateway, the VPN tunnels cannot be established. The other options are incorrect because they either do not affect the VPN tunnel formation or do not apply to a Microbranch group. Reference: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/gateways/microbranch.htm https://www.arubanetworks.com/assets/tg/TB_ArubaGateway.pdf

Question 3

You are proposing new CX 8360 VSX switches to replace a customer's existing core switches. The customer is concerned about the possibility of a split-brain scenario between the VSX pair.

How is the VSX pair affected when the ISL is down and keepalive is up?

AThe VSX pair is out-of-sync.

BThe VSX pair nodes are still forwarding traffic.

CThe VSX LAGs are in a degraded state.

DThe VSX pair is not at risk.

Answer : D

Question 4

You are proposing new CX 8360 VSX switches to replace a customers existing core switches. The customer Is concerned about the possibility of a split-brain scenario between the VSX pair. How Is the VSX pair affected when the ISL is down 3nd keepalive is down?

AThe VSX node with lower system-id continues forwarding.

BBoth VSX nodes will automatically reboot and keep LAG interfaces shutdown.

CBoth VSX nodes still forward tame

DThe VSX node with higher uptime continues forwarding.

Answer : C

Question 5

You are configuring Policy Based Routing (PBR) for a subnet that will be used to test a new default route for your network Traffic originating from 10.2.250.0/24 should use a new default route to 10.1.1.253. Other non-default routes for this subnet should not be affected by this change.

What are two parts of the solution for these requirements? (Select two.)

AOption A

BOption B

COption C

DOption D

EOption E

Answer : C, E

Two parts of the solution for these requirements are Option C and Option E.

Option C is a part of the solution because it defines a policy-based routing action list named route_test, which specifies the next hop IP address as 10.1.1.253 for the matching traffic. This is the new default route that the user wants to use for the subnet 10.2.250.0/24. The interface null parameter indicates that the traffic will be routed to the next hop without using a specific interface1.

Option E is a part of the solution because it applies the policy-based routing action list route_test to the VLAN interface 250, which has an IP address of 10.2.250.1/24. This is the subnet that the user wants to test the new default route for. The apply policy command enables policy-based routing on the interface and associates it with the action list2.

Option A is not a part of the solution because it defines a policy-based routing action list named route_test, but does not specify the next hop IP address as 10.1.1.253, which is the new default route that the user wants to use. Instead, it specifies a next hop IP address of 10.1.1.254, which is different from the requirement.

Option B is not a part of the solution because it defines a policy-based routing action list named route_test, but does not specify any next hop IP address at all, which is necessary for policy-based routing to work. Instead, it specifies an interface null parameter without any IP address, which is invalid.

Option D is not a part of the solution because it applies the policy-based routing action list route_test to the VLAN interface 200, which has an IP address of 10.2.200.1/24. This is not the subnet that the user wants to test the new default route for, but a different subnet that should not be affected by this change.

Question 6

A customer wants to provide wired security as close to the source as possible The wired security must meet the following requirements:

-allow ping from the IT management VLAN to the user VLAN

-deny ping sourcing from the user VLAN to the IT management VLAN

The customer is using Aruba CX 6300s

What is the correct way to implement these requirements?

AApply an outbound ACL on the user VLAN allowing temp echo-reply traffic toward the IT management VLAN

BApply an inbound ACL on the user VLAN allowing icmp echo-reply traffic toward the IT management VLAN

CApply an inbound ACL on the user VLAN denying icmp echo traffic toward the IT management VLAN

DApply an outbound ACL on the user VLAN denying icmp echo traffic toward the IT management VLAN

Answer : C

An inbound ACL is applied to traffic entering a port or VLAN.An outbound ACL is applied to traffic leaving a port or VLAN4. To deny ping sourcing from the user VLAN to the IT management VLAN, an inbound ACL on the user VLAN should be used to filter icmp echo traffic toward the IT management VLAN.Icmp echo-reply traffic is not needed to be allowed because it is already permitted by default5. Reference:4https://techhub.hpe.com/eginfolib/Aruba/OS-CX_10.04/5200-6692/GUID-9B8F6E8F-9C7A-4F0D-AE7B-9D8E6C5B6A7F.html5https://techhub.hpe.com/eginfolib/Aruba/OS-CX_10.04/5200-6692/GUID-0C3A9D0F-6E5B-4E1A-AF3C-8D8B2F9C1A7B.html

Question 7

You need to have different routing-table requirements with Aruba CX 6300 VSF configuration

Assuming the correct layer-2 VLAN already exists how would you create a new OSPF configuration for a separate routing table?

ACreate a new OSPF area, and attach VRF name.

BCreate a new OSPF process ID with vrf name.

CAttach a new OSFP process ID with a custom routing table

DAttach OSPF process ID in the VRF configuration.

Answer : B

To create a new OSPF configuration for a separate routing table, you need to create a new OSPF process ID with vrf name. This will create a new OSPF instance that is associated with the specified VRF and its routing table. The other options are incorrect because they either do not create a new OSPF instance or do not associate it with a VRF. Reference: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch02.html https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch03.html

HP Aruba Certified Campus Access Professional HPE7-A01 Exam Questions