HPE Network Campus Access Professional Architect HPE7-A11 Exam Questions

Page: 1 / 14
Total 94 questions
Question 1

XYZ Regional Hospital is an integrated healthcare system comprising hospitals, neighborhood health centers, and small doctor offices. XYZ Regional Hospital recently merged with 4x neighborhood health centers and 125 doctor branch offices. Its wireless, wired-access, and AAA solutions are outdated and must be replaced.

XYZ Regional Hospital wants to future-proof and improve efficiency across all sites by enhancing wired and wireless access and moving to centralized, unified wired/wireless and policy management that provides uninterrupted availability of all systems.

Locations:

XYZ Regional Hospital is in New York City.

Dila Health Center is in City A.

Mount Health Center is in City B.

Rock Health Center is in City C.

Branch clinics are in different locations across the United States.

Requirements:

Provide, through management software, a single pane of glass to manage wired and wireless LANs and VPNs across campus, branch, and remote locations through web/cloud architecture that delivers near-real-time insight, troubleshooting tools, and Service Level performance reporting.

Seamless integration across wired, wireless, WAN, SD-Branch, and IoT.

Provide secure wireless access for all Regional Hospital employees and partners, and provide wireless Internet access to medical citizens when they visit the facilities.

All access points must support these features and specifications: 802.11 ax (Wi-Fi 6E Certified).

Security options including WP2/WPA3 and 802.1X with Radius secure authentication.

Identify and authenticate every wireless and wired device.

End-to-end role-based security.

Seamless mobility throughout the hospital for medical teams, patients, and visitors.

Reduce Wi-Fi deployment time from days to hours and enable Zero-Touch deployments across the site.

Establish a resilient, future-ready network infrastructure with the intelligence, scalability, and intuitive toolsets to meet emerging needs.

A fully redundant branch solution with dynamic path selection to the hospital.

XYZ Regional Hospital recently acquired a new outpatient building 900 feet (275 meters) from the main hospital, with a clear line of sight but no feasible fiber connection between the buildings.

The design requirements are:

Extend the existing wireless SSIDs to the outpatient building.

Cloud-manage all wired and wireless devices across both buildings.

Which combination of products should the Network Architect recommend?



Answer : C

HPE Aruba Networking AOS-10 enterprise mesh provides a wireless connectivity solution for extending LAN services between locations where installing physical network cabling is impractical.

The hospital's new outpatient building is approximately 275 meters from the main campus and has clear line of sight, making a properly engineered wireless bridge a viable design approach.

An AOS-10 mesh architecture uses mesh portal and mesh point functions to establish secure wireless backhaul connectivity.

The mesh portal connects to the existing wired infrastructure, while the mesh point establishes a wireless connection and can bridge downstream LAN traffic.

This allows AOS-CX switches and associated wired endpoints in the outpatient building to communicate through the mesh infrastructure.

HPE Aruba Networking Central provides cloud-based management for supported AOS-10 access points and AOS-CX switches, aligning with the hospital's centralized operational requirements.

Option B introduces AirWave, which does not meet the intended cloud-native Central management architecture.

Option D uses an older Instant AOS-8 architecture, while option A does not provide the appropriate enterprise WLAN mesh design.

The architect must also perform a point-to-point RF assessment, evaluate Fresnel-zone clearance, determine backhaul capacity, and validate supported AP models.

Mesh configuration, software compatibility, and subscriptions should be confirmed before final procurement.

Official HPE Reference: HPE Aruba Networking Central --- Enterprise Mesh Network with Mesh APs; AOS-10 Architecture --- Central Management and Mesh Roles.

===============


Question 2

Manufacturing A.B.C. is a mid-sized international company that specializes in manufacturing industrial equipment. It has operated in the market for more than two decades and has become a reputable participant in its industry. However, rapid technological advances have left its existing network infrastructure outdated and unable to keep pace with modern manufacturing-process demands.

Manufacturing A.B.C.'s network combines legacy wired and wireless components from multiple vendors, resulting in frequent downtime and reduced production efficiency. The aging equipment causes slow data-transfer rates, unreliable connectivity, and greater exposure to cyber threats. Fiber cabling must also be upgraded because OM2 is used for most of it.

Further compounding the network problems, the CTO's recent departure has left the company without a clear direction for the network-refresh project. The management team lacks consensus on the upgrade's scope, budget, and timeline.

The manufacturing customer's primary objectives are as follows:

Improve network performance and reliability to enhance production processes and minimize downtime.

Enhance network security to safeguard sensitive data and intellectual property.

Streamline communication and collaboration among the organization's different departments.

Ensure scalability to support future growth and technological advances.

Manufacturing A.B.C. requires a comprehensive network refresh with these components:

Upgrade the wired infrastructure to high-speed Ethernet switches to support increased data-transfer rates and reduce latency.

Implement a robust wireless solution with enterprise-grade access points that provides seamless connectivity throughout the manufacturing facility.

Use centralized network-management tools to simplify network administration and monitoring.

Expectations:

The customer expects the network-refresh project to be completed efficiently, with minimal disruption to ongoing operations. They seek a reliable, experienced network-solutions provider that understands their specific manufacturing requirements and can deliver a customized solution consistent with their budget constraints. Given the recent CTO change, the manufacturing customer is eager to receive clear project proposals and decision-making support.

As a network-solutions provider, your role is to address these concerns, provide expert guidance, and present a clearly defined plan to meet the objectives effectively.

Manufacturing A.B.C. must regulate various traffic types with QoS, and the architect chose DWRR instead of SP queuing. Which switches support DWRR?

Choose two.



Answer : A, B

Deficit Weighted Round Robin (DWRR) is a Quality of Service scheduling algorithm that distributes available transmission bandwidth among eligible queues according to configured weights.

Unlike strict priority (SP) queuing, where higher-priority queues can dominate transmission opportunities, DWRR provides proportional bandwidth allocation across multiple traffic classes.

This is useful in a manufacturing environment containing industrial control traffic, enterprise applications, monitoring systems, and other communications with different performance requirements.

The CX 6200 supports DWRR, as documented in HPE Aruba Networking's CX 6200 QuickSpecs and AOS-CX Quality of Service configuration guides.

The CX 8360 also supports DWRR and provides configurable scheduling profiles that enable bandwidth allocation using queue weights.

Options C and D are incorrect. HPE's official QoS documentation identifies CX 4100i and CX 6100 product lines as not supporting DWRR.

These platforms provide alternative traffic scheduling capabilities but do not offer the same DWRR configuration functionality.

The architect should ensure that the selected switching platform supports the QoS scheduling mechanisms required by the application design.

For Manufacturing A.B.C., DWRR can provide predictable proportional service among competing traffic classes, while strict-priority scheduling may still be appropriate for selected critical traffic requiring immediate transmission.

Official HPE Reference: HPE Aruba Networking CX 6200 QuickSpecs --- Quality of Service; AOS-CX 8360 Quality of Service Guide; HPE Aruba Networking CX QoS for Crestron NVX/NAX Products.

===============


Question 3

You are planning a secure onboarding solution for a customer's enterprise network. The plan includes HPE Aruba Networking ClearPass Policy Manager (CPPM) Onboard to simplify device onboarding and enforce security policies.

Which critical design considerations and feature recommendations should be included in your proposal to ensure a smooth, effective implementation?

Choose two.



Answer : B

HPE Aruba Networking ClearPass Onboard provides certificate lifecycle management and secure device onboarding through its integrated Certificate Authority capabilities.

Option B is correct because ClearPass Onboard supports Enrollment over Secure Transport (EST). Its EST server can issue certificates to compatible clients and support re-enrollment or renewal workflows.

HPE's ClearPass 6.11 documentation explicitly describes the EST Renew on Reenroll setting, which allows an existing certificate to be renewed or rekeyed.

This supports secure certificate-based authentication and reduces manual certificate administration.

Option C is incorrect because ClearPass Onboard supports Registration Authority mode. In this configuration, Onboard can proxy certificate requests to an external CA using SCEP.

Option A incorrectly attributes a specific OpsRamp-based third-party NAD certificate workflow to ClearPass Onboard. HPE documents certificate automation integrations, but the stated OpsRamp feature combination is not established by the ClearPass Onboard documentation.

Option D is problematic because Foundation Plus Security is associated with HPE Aruba Networking gateway subscription licensing, not a documented universal requirement for hosting multiple ClearPass Onboard certificate authorities.

Therefore, B is supported, while the remaining options do not establish a second technically valid selection.

A certification practice item requiring two answers should be corrected rather than presenting an unsupported licensing requirement as fact.

Official HPE Reference: HPE Aruba Networking ClearPass Guest 6.11 --- Editing Certificate Authority Settings; Creating a New Certificate Authority; ClearPass 6.11 Release Notes --- EST Renewal.

===============


Question 4

Which platforms can be used to demonstrate your solution to a customer?

Choose two.



Answer : C, E

HPE Aruba Networking provides practical demonstration environments that allow customers to evaluate product functionality before making purchasing or deployment decisions.

Option C is correct because the HPE Demo Experience Platform (DXP) provides access to interactive networking demonstrations. Customers and partners can explore HPE Aruba Networking Central, cloud-based management, SD-WAN capabilities, monitoring dashboards, and other supported functions.

The platform enables architects to demonstrate operational workflows and management features without constructing a complete physical network environment.

Option E is also correct because the AOS-CX Switch Simulator provides a virtual switching environment in which engineers can demonstrate supported AOS-CX configuration and operational commands.

This is useful for explaining switching functionality, CLI syntax, interface configuration, routing behavior, and selected network services.

Option A, Solution Exchange, is primarily associated with software integrations, scripts, and extensions rather than a dedicated customer demonstration environment.

Option B, Innovation Zone, is identified by HPE as a mechanism for submitting product improvement ideas and enhancement requests, not as the principal demonstration platform.

Option D, Support Portal, provides technical documentation, software, downloads, and support resources.

The architect should select the demonstration environment according to whether the customer needs to evaluate management workflows or switching configurations.

Official HPE Reference: HPE Demo Experience Platform; HPE Aruba Networking AOS-CX Switch Simulator; Central --- Onboarding and Access FAQ.

===============


Question 5

You are the lead network architect completing the Bill of Materials (BoM) for a new HPE Aruba Networking ClearPass Policy Manager (CPPM) deployment that must support the following environment:

3,000 wired IoT devices using MAC authentication.

2,000 wireless IoT devices using MPSK.

12,000 corporate laptops---a mix of Windows 11 Desktop PCs and Surface Pro devices---joined to Active Directory and authenticating through EAP-TLS, with posture assessments required through a ClearPass client agent.

1,000 BYOD users, each onboarding 2--3 personal devices and receiving certificates through ClearPass Onboard.

Up to 2,500 guest users per day, using ClearPass Guest with sponsor-based registration.

Which HPE Aruba Networking ClearPass license combination most accurately reflects what should be included in the IRIS-generated Bill of Materials to support this deployment?



Answer : D

ClearPass licensing must be calculated separately for Access, OnGuard, and Onboard because each license category uses a different consumption model.

Access licenses are consumed by authenticated endpoint sessions. The deployment includes 3,000 wired IoT devices, 2,000 wireless IoT devices, and 12,000 corporate endpoints, establishing a baseline of 17,000 authenticated devices.

The 1,000 BYOD users contribute another 2,000--3,000 authenticated devices if all personal devices are connected.

Guest access adds further consumption according to actual concurrent authenticated sessions, not simply the number of visitors recorded throughout a day.

OnGuard licenses are required for the 12,000 corporate endpoints because these devices must perform posture assessments.

Onboard licensing is based on unique users with active Onboard-generated certificates. Consequently, the 1,000 BYOD users require 1,000 Onboard licenses, even though each user may enroll multiple personal devices.

Option D correctly identifies the 12,000 OnGuard and 1,000 Onboard quantities.

Its 22,000 Access licenses are a plausible planning estimate, but the theoretical peak could reach 22,500 if every BYOD user connects three devices and all 2,500 guest users authenticate simultaneously.

Therefore, the final Access quantity must be validated against peak concurrent authentication demand before procurement.

Official HPE Reference: ClearPass Policy Manager 6.11 --- License Management; HPE Aruba Networking ClearPass Scaling and Ordering Guide.

===============


Question 6

A large multinational financial institution has engaged you to design a new full-stack wired and wireless network for its new 6-story regional office building. The facility's bottom two floors will be retail space for a large banking branch. The upper floors will be carpeted corporate office space, with each floor approximately 100,000 sq ft (9290 sq m). Data centers are all offsite and are outside this project's scope. The customer is underserved by its current L2-based network infrastructure and wants to use modern best practices in the new design. The network must be fully resilient and fault-tolerant, with dynamic segmentation at the edge.

The retail space will provide public guest Wi-Fi access. Retail associates will use corporate tablets for customer service, and the retail floors will contain a mixture of wired and wireless devices. Corporate users will primarily connect wirelessly, although several wired clients, printers, and hard VoIP phones will be used.

The customer also plans to renovate the corporate office space to take advantage of 'smart office' technology. These upgrades will enable blue-dot wayfinding, presence analytics, and other location-based services.

After further discussions with the customer, the team determined that EVPN-VXLAN will provide dynamic segmentation. The customer wants to ensure that a particular VNI is present only when it is used on that switch.

Which solution is valid and meets this technical requirement?



Answer : A

EVPN-VXLAN provides scalable network segmentation by separating the routed IP underlay from the logical overlay used to transport endpoint traffic.

Option A uses CX 6300 VSF stacks as access-layer VXLAN Tunnel Endpoints (VTEPs), with a redundant CX 8325 VSX distribution pair.

The CX 6300 supports EVPN-VXLAN functionality, allowing endpoint traffic to be encapsulated at the access layer rather than relying entirely on centralized overlay termination.

Through the EVPN control plane, VTEPs exchange endpoint reachability information and participate in VXLAN forwarding relationships for the relevant network identifiers.

HPE's EVPN-VXLAN documentation states that VXLAN data-plane tunnels form between VTEPs interested in the same VXLAN Network Identifier.

This supports the customer's objective of avoiding unnecessary VXLAN forwarding relationships for network segments that are not relevant to a particular VTEP.

Option B places VTEP functionality on the CX 8320 distribution switches instead of the CX 6300 access stacks, reducing the distributed edge functionality required by the design.

Option C is invalid because the CX 6100 does not provide the required EVPN-VXLAN VTEP capabilities, and the proposed CX 6300 VSX configuration is unsupported.

Option D incorrectly describes a four-member virtual chassis of CX 8325 switches.

The selected architecture should also validate route-reflector connectivity, overlay VLAN/VNI mappings, and supported software versions.

Official HPE Reference: HPE Aruba Networking AOS-CX 10.12 EVPN-VXLAN Guide --- Supported VTEP Platforms, EVPN Peering and VNI-Based Tunnel Formation.

Aruba Networks

===============


Question 7

A colleague has produced a proposed design for a large enterprise customer that uses HPE Aruba Networking AOS-CX 6300 switches at the wired access layer. The customer requires a secure, scalable solution founded on Zero Trust Security (ZTS) principles.

In the current environment, endpoint devices connected to access switches are configured to transmit 802.1Q-tagged frames, and the new design plans to tunnel traffic from the switches to an AOS-10 Gateway cluster by using User-Based Tunneling (UBT) in its default mode.

During a design review, you are asked to determine whether this solution supports the customer requirement to retain endpoint VLAN tags across the tunnel.

You recommend a modification, explaining that the proposed default configuration will not satisfy the customer's technical requirement.

Which UBT configuration would support the customer requirement to preserve VLAN tagging from the endpoints across the UBT tunnel to the gateway?



Answer : A

HPE Aruba Networking User-Based Tunneling extends centralized policy enforcement to wired clients by forwarding their traffic through GRE tunnels to an AOS-10 gateway.

The UBT operating mode determines how VLAN assignments are applied and whether tagged traffic can be supported.

In reserved VLAN or local VLAN mode, the switch uses an internal reserved VLAN to handle the tunneled client traffic.

The gateway performs the effective client VLAN assignment, and this mode supports untagged UBT clients rather than the required tagged endpoint behavior.

VLAN Extend mode provides different functionality.

HPE's official AOS-CX Security Guide states that VLAN Extend supports both tagged and untagged UBT users.

In this mode, the switch is aware of the user-role VLAN, and the VLAN must be configured on the switch.

The corresponding gateway-side VLAN configuration must also support the required client traffic.

Option A therefore provides the correct configuration approach.

Options B and C use reserved VLAN mode, which cannot satisfy the tagged-client requirement.

Option D is incorrect because the required VLAN cannot exist exclusively on the gateway when VLAN Extend mode depends on switch-side VLAN awareness.

The architect should validate VLAN assignments, downloadable user roles, tunneling profiles, and gateway policies before enabling the configuration in production.

Official HPE Reference: HPE Aruba Networking AOS-CX Security Guide --- Comparison Between UBT Local VLAN and VLAN Extend Modes; Central UBT Profile Configuration.

===============


Page:    1 / 14   
Total 94 questions