HP HPE6-A86 HPE Network Switching Associate Exam Exam Practice Test

The correct answer is D. By default, all VLAN traffic is tagged to traverse a trunk link except the native VLAN. In HPE Aruba Networking AOS-CX, a trunk interface can carry traffic for multiple VLANs, and VLAN tagging is used to identify traffic from different VLANs across the trunk. However, the native VLAN is the exception. HPE Aruba Networking documentation explains that the native VLAN is the VLAN to which incoming untagged traffic is assigned, and by default VLAN 1 is assigned as the native VLAN for trunk interfaces. This means normal trunk behavior is that VLAN traffic is tagged, while native VLAN traffic can be untagged unless configured otherwise. Option A is incomplete because it ignores native VLAN behavior. Option B is incorrect because the native VLAN concept applies to trunk interfaces generally, not only when a port is part of a LAG. Option C is incorrect because VLAN trunking applies to Layer 2 interfaces, not routed ports. Therefore, the default trunk behavior is tagged VLAN traffic except for the native VLAN.

The correct answer is B. CX 6200. The feature being described is the HPE Aruba Networking AOS-CX Network Analytics Engine, or NAE. HPE Aruba Networking documentation states that NAE uses Python scripts to define which switch resources to monitor and optionally what actions to take when certain conditions are true. The NAE guide specifically applies to the CX 6200, 6300, 6400, 8xxx, 9300, and 10000 switch series, and the supported maximums page lists the CX 6200 as supporting up to 10 scripts and 10 agents. This makes the CX 6200 the correct choice from the available options. The CX 6000, CX 6100, and CX 4100i are lower access platforms and are not listed in the NAE guide’s supported product set for onboard NAE scripting. Therefore, for a customer with Python skills who wants to use self-made or Aruba-provided onboard analytics scripts, the CX 6200 is the appropriate recommendation.

The correct answer is D. SNMPv3. HPE Aruba Networking AOS-CX hardening documentation recommends using SNMPv3 instead of older SNMP versions because older SNMP versions are unauthenticated and unencrypted, with the community string transmitted in plaintext. The same guide states that SNMPv3 supports different users, authentication, and strong encryption. This makes SNMPv3 the secure protocol among the options. HTTP is not the best answer because standard HTTP does not encrypt management or web traffic; HTTPS would be the secure alternative. TFTP is not secure because it does not provide encryption or strong authentication for file transfers. Telnet is also not secure because it sends session traffic, including login information, in clear text; SSH is the secure alternative for CLI management. Therefore, from the listed protocols, only SNMPv3 provides security mechanisms appropriate for secure network management, including authenticated and encrypted communication.

The correct answer is B. PoE is disabled on the interface. If there are no lights on the access point, the first issue to investigate is whether the AP is receiving power. HPE Aruba Networking 550 Series installation documentation identifies Power over Ethernet as a supported power source for the AP, including IEEE 802.3bt or 802.3at PoE. HPE Aruba Networking AOS-CX documentation for the CX 6000/6100 PoE command shows that per-interface power distribution can be enabled with power-over-ethernet and disabled with no power-over-ethernet. If PoE is disabled on the switch interface, the AP will not receive power from the Ethernet cable and therefore may show no LEDs. Option A is incorrect because a missing STP configuration would not prevent the AP from powering on. Option C is incorrect because failure to reach HPE Aruba Networking Central would occur after the AP is powered and network-connected. Option D is also incorrect because a wrong VLAN can prevent management or provisioning, but it would not normally stop the AP LEDs from turning on.

The correct answer is B. TCP port. The Transport Layer, Layer 4 of the OSI model, is responsible for end-to-end transport services between hosts. TCP and UDP operate at this layer, and TCP/UDP port numbers identify application conversations on a host. A TCP port is therefore a Layer 4 item. Option A is incorrect because an IP address belongs to Layer 3, the Network Layer, where logical addressing and routing occur. Option C is incorrect because a MAC address belongs to Layer 2, the Data Link Layer, where Ethernet switching and local delivery are handled. Option D is incorrect because a physical switch port is associated with the Physical Layer interface and Layer 2 switching behavior, not the Transport Layer. In HPE Aruba Networking CX configurations, ACLs also distinguish between IP addressing and Layer 4 protocol fields such as TCP or UDP ports, reinforcing that TCP port information is transport-layer information.

The correct answers are C and D. TCP uses sequence numbers and requires an established connection. HPE Aruba Networking documentation references TCP sequence-number enforcement as a firewall/security function, which confirms that TCP traffic uses sequence numbers that can be tracked and validated. HPE Aruba documentation also describes TCP traffic with an “established” option for controlling TCP connection traffic in access control entries, which indicates that TCP is connection-oriented and maintains connection state. Option A is incorrect because TCP does support retransmission; HPE Aruba EdgeConnect documentation discusses features that avoid the need for TCP retransmission, which only makes sense because retransmission is a normal TCP behavior. Option B is incorrect because connectionless behavior describes UDP, not TCP. Option E is also incorrect because latency-sensitive traffic, such as real-time voice or video, commonly favors UDP because retransmission and connection-state handling can add delay. TCP is better suited for applications that need reliable, ordered delivery, such as web, file-transfer, or management traffic, rather than real-time latency-sensitive flows.

The correct answer is B. Light. Multi-mode cable refers to multi-mode fiber-optic cabling. In fiber-optic transmission, data is carried using light through the fiber core. HPE Aruba Networking’s transceiver documentation explains that multimode fibers have thicker fiber cores and can transport light in multiple modes. The same HPE Aruba Networking transceiver guidance discusses optical transceivers transmitting light pulses and managing light loss across fiber-optic cabling. Therefore, in the context of multi-mode fiber, the signal being modulated to represent data is light. Option A is incorrect because radio is used in wireless transmission, not fiber-optic cabling. Option C is incorrect because voltage is associated with electrical copper cabling, such as twisted-pair Ethernet, rather than optical fiber. Option D is incorrect because pressure is not used as the signaling method for standard Ethernet fiber links. This question is focused on Layer 1 media behavior, and multi-mode fiber is a Physical Layer medium that transports optical signals between network transceivers.

The correct answer is D. If the ZTP operation detects that the switch configuration is different from the factory-default configuration, the ZTP operation ends. HPE Aruba Networking AOS-CX documentation explains that the ZTP process starts when the switch boots with the factory-default configuration. During the ZTP process, if the switch detects that its configuration is different from the factory-default configuration, the ZTP operation ends and the switch must be configured at the installation site. This directly addresses the customer’s concern: ZTP is intended for new or factory-default switches, and it should not overwrite or change switches that have already been manually configured or deployed. Option A is incorrect because the end condition is not based on a TFTP server detecting a serial-number configuration file. Option B is incorrect because being added to Central is not the stated stopping condition. Option C describes force provisioning, which can intentionally start provisioning behavior, but it does not address the concern about protecting already configured switches.

The correct answer is D. QoS. Poor call quality during network congestion is commonly caused by delay, jitter, or packet loss affecting real-time voice and video traffic. HPE Aruba Networking AOS-CX Quality of Service documentation explains that QoS allows administrators to customize how different traffic types are serviced based on their characteristics and importance. QoS helps keep important traffic moving at an acceptable speed regardless of current bandwidth usage. HPE Aruba documentation also states that VoIP traffic is delay and jitter sensitive and should receive priority service for optimum transmission. Microsoft Teams voice and video traffic is latency-sensitive, so configuring QoS is the correct approach to prioritize this traffic when the network is busy. Option A, CoS, is a specific Layer 2 priority marking method that can be part of a QoS design, but the broader feature to configure is QoS. Option B, ZIP, is not relevant. Option C, IGMP, is used for multicast group management and does not solve general Teams call-quality issues.

The correct answer is B. Single-mode fiber. A 35 km connection between two sites is a long-distance optical link, and single-mode fiber is the appropriate cable type for long-haul communication. HPE Aruba Networking transceiver documentation describes single-mode fiber as having a small core size and being suitable for long-haul communication because it transmits light in one mode and suffers less intermodal dispersion than multi-mode fiber. Multi-mode fiber is used for shorter-distance links inside buildings or data centers and is not the correct choice for a 35 km site-to-site connection. UTP copper cabling cannot support a 40Gbps Ethernet connection over 35 km. ZTP is Zero Touch Provisioning, not a cable type. HPE Aruba transceiver guidance also lists long-distance optical transceivers, such as 40 km single-mode fiber options, reinforcing that long-distance high-speed links require SMF rather than MMF or copper. Therefore, for a 40Gbps link between sites 35 km apart, the required cabling is single-mode fiber. ( arubanetworking.hpe.com )

The correct answer is C. Lowest administrative distance. When a switch learns multiple possible routes to the same destination, it must select the preferred or best route to install and use for forwarding. HPE Aruba Networking documentation explains that administrative distance is one of the main criteria used to determine the preferred route when multiple paths exist to the same destination. The route with the lower administrative distance takes precedence. This is why connected routes, static routes, and dynamically learned routes can be preferred differently depending on their administrative distance values. Option A is incorrect because a default route is used only when no more specific route exists. Option B is incorrect because a static route is not automatically selected merely because it is static; it is preferred only if its administrative distance and route specificity make it the best candidate. Option D is incorrect because the highest administrative distance is less preferred, not more preferred.

The correct answer is A. On HPE Aruba Networking AOS-CX switches, the out-of-band management interface is configured under interface mgmt. For a static IPv4 address on the management interface, the correct command is ip static, not ip address. HPE Aruba Networking documentation shows the management interface configuration using interface mgmt, then ip static < address/prefix > , followed by default-gateway < gateway-address > when a gateway is required. The default-gateway command assigns the IPv4 or IPv6 default gateway to the management interface, and HPE documentation notes that an IPv4 default gateway can only be configured if a static IPv4 address has been assigned to the management interface. Option B is incorrect because ip address is used on routed interfaces or VLAN interfaces, not the CX management interface command syntax. Option C is incorrect for the same reason and because vrf attach mgmt is not required here. Option D includes unnecessary VRF configuration and the invalid vrf attach mgmt

The correct answer is A. Must be manually configured. HPE Aruba Networking AOS-CX documentation states that static routes are manually configured in the routing table. A static route defines a destination network and the next-hop address or exit interface that the switch should use to forward traffic. Static routes are useful in small, simple, or predictable networks because they are straightforward and do not require a dynamic routing protocol to exchange route information. Option B is incorrect because automatically learned routes are associated with dynamic routing protocols, such as OSPF or BGP, not static routing. Option C is incorrect because static routes usually have low processing overhead compared to dynamic routing protocols, since the switch does not need to run neighbor discovery, exchange routing updates, or calculate topology changes. Option D is incorrect because static routes do not automatically respond to network topology changes unless supported by an additional tracking mechanism or manually changed by an administrator. Therefore, the defining characteristic of a static route is manual configuration.

The correct answer is D. CX 6300M in VSF. The requirement includes stacked switches, PoE+ ports, near-zero downtime, continuous packet forwarding, and highly available hardware. HPE Aruba Networking CX 6300M switches support PoE models and are part of the CX 6300 stackable switch family. HPE’s CX 6300 QuickSpecs describe high availability by design using VSF in-service software upgrades, with no downtime or restart when upgrading within the same major release, provided there is at least a two-member VSF stack. The CX 6300 family also supports modular and fixed models in a single stack and includes PoE-capable models. Option A is incorrect because the CX 8100 uses VSX rather than VSF stacking and is not the appropriate PoE+ access stack answer. Option B is less correct because the CX 6200F is stackable with VSF but does not provide the same high-availability feature set as CX 6300M. Option C is incorrect because the CX 8320 is a VSX-capable data center/core platform, not the best PoE+ stacked access solution.

The correct answer is B. There are more than 8 bits in the host portion. The subnet mask 255.255.254.0 converts to a /23 prefix because the first two octets, 255.255, represent 16 network bits, and the third octet value 254 represents seven more network bits. That gives 23 network bits total. IPv4 addresses are 32 bits long, so 32 minus 23 leaves 9 host bits. Since 9 is more than 8, option B is correct. HPE Aruba Networking documentation uses prefix length as CIDR subnet-mask notation and supports IPv4 prefix lengths from 1 to 32, matching the /23 interpretation. Option A is incorrect because “10.64” alone is not the full network portion for a /23 network. The actual network range is 10.64.0.0/23. Option C is incorrect because the broadcast address for 10.64.0.0/23 is 10.64.1.255, not 10.64.0.240. Option D is incorrect because 255.255.254.0 is /23, not /25.

The correct answers are A and E. HPE Aruba Networking AOS-CX switches support RADIUS and TACACS+ for controlling administrative access. HPE Aruba Networking security documentation describes remote AAA authentication and authorization using RADIUS or TACACS+ servers. These protocols allow administrative logins and command authorization to be managed centrally instead of relying only on local switch users. RADIUS is commonly used for authentication, authorization, and accounting services, while TACACS+ is especially useful for administrative access control because it can provide command authorization and accounting. LDAP, Diameter, and SAML are not the correct answers for the AOS-CX administrative access control protocols listed in this question. LDAP is a directory protocol, Diameter is an AAA protocol used in other service-provider contexts, and SAML is commonly used for web-based single sign-on, but they are not the two AOS-CX switch administrative access protocols being tested here. ( arubanetworking.hpe.com )

The correct answers are B and E. On HPE Aruba Networking AOS-CX switches, configuration changes are made to the running configuration. To ensure those changes persist after a reboot, the running configuration must be saved to the startup configuration. HPE Aruba Networking documentation states that write memory saves the running configuration to the startup configuration and is an alias of copy running-config startup-config. The copy running-config startup-config command copies the current running configuration into the startup configuration, overwriting the existing startup configuration if one is already present. Option A, commit confirm, is not the AOS-CX command used to save the current running configuration for reboot persistence. Option C, save force, is not the correct AOS-CX command for this task. Option D is the reverse operation; copy startup-config running-config would copy the saved startup configuration into the active running configuration rather than saving current changes for the next reboot. Therefore, the two valid commands are write memory and copy running-config startup-config.

The correct answer is B. HPE Aruba Networking Central has been manually disabled on the switch. The key line in the output is Central admin state : disabled. HPE Aruba Networking AOS-CX documentation for the show aruba-central command provides an example of a switch when Aruba Central is disabled, showing Central admin state : disabled, Central connection values as N/A, and Central support mode as disabled. This indicates that the switch’s Central administrative state is disabled, so it is not attempting to connect to HPE Aruba Networking Central. Option A is incorrect because the VRF for connection : N/A value is a result of Central being disabled, not proof that the management VRF does not exist. Option C is incorrect because this command output does not report support-contract validity. Option D is incorrect because the factory-default Central behavior is not what is being shown; the output specifically reflects Central being disabled. Therefore, the correct interpretation is that Central has been manually disabled on the switch. ( arubanetworking.hpe.com )

The correct answer is D. Allowed VLANs between access switches. The diagram shows Server-1 connected to Access-2 in VLAN 20 and PC-1 connected to Access-1. The inter-switch link between Access-1 and Access-2 is shown as a trunk carrying VLANs 1, 10, and 20. If users on Access-1 cannot reach Server-1 in VLAN 20 after a recent change, while devices directly connected to Access-2 are not affected, the most likely issue is that VLAN 20 is not being correctly carried across the trunk between the access switches. HPE Aruba Networking AOS-CX documentation states that vlan trunk allowed defines which VLAN traffic is allowed across a trunk interface. It also explains that allowed VLANs are the VLANs that can be transported by the trunk; if a required VLAN is missing from the allowed list, that VLAN’s traffic will not traverse the trunk. Option A is less likely because devices directly connected to Access-2 can access Server-1, indicating Server-1’s local VLAN placement is probably correct. Option B is unlikely because a down trunk would affect more VLANs than just access to VLAN 20. Option C is not supported by the symptom pattern.

The correct answer is C. The port is removed from the switch’s data plane. On HPE Aruba Networking CX switches that support VSF, including the CX 6200 family, VSF ports are dedicated to the VSF stack fabric. HPE Aruba Networking’s AOS-CX VSF documentation explains that when an interface becomes part of a VSF link, no standard network-layer protocol or standard feature can run on that interface because it becomes part of the VSF stack fabric. This means the interface is no longer used like a normal front-panel data port for regular switching or routing traffic. Option A is incorrect because a VSF port does not become a routed port. Option B is incorrect because the statement is not the general rule for CX 6200 VSF ports. Option D is incorrect because ISL LAG terminology is associated with VSX designs, not VSF stacking. VSF uses VSF links to combine supported switches into a single logical switch with one control and management plane.

The correct answer is C. Customers that do not allow cloud connectivity. HPE Aruba Networking Central On-Premises is intended for organizations that need Aruba Central-style management capabilities but cannot or do not want to place management data in the public cloud. Official HPE Aruba Networking Central On-Premises documentation describes it as a variant of HPE Aruba Networking Central that is deployed in the customer’s own environment, while the Validated Solution Guide states that Central On-Premises is appropriate when security requirements disallow Internet connectivity. This makes it suitable for organizations with strict regulatory, security, data sovereignty, or internal policy requirements that prevent cloud-managed network infrastructure. Option A is incorrect because using hyperscaler-hosted server resources does not, by itself, require Central On-Premises. Option B is incorrect because a SaaS-maintained management platform describes the cloud version of HPE Aruba Networking Central, not the on-premises deployment. Option D is not the best answer because geographical redundancy is not the primary use case described for choosing Central On-Premises.

The correct answer is B. Authentication, Authorization, and Accounting. HPE Aruba Networking AOS-CX documentation defines AAA as the security framework used to manage user access, enforce privileges, and log user access records. Authentication identifies users and validates their credentials. Authorization determines what authenticated users are allowed to do, such as which commands or services they can access. Accounting records user activity, access events, or resource usage for auditing and tracking. AAA can use local user accounts or remote authentication services such as RADIUS and TACACS+, depending on the switch configuration and security design. Option A is incorrect because AAA does not stand for Aruba Authentication Algorithm. Option C is not the correct expansion of the acronym. Option D uses similar-sounding terms but is not the official meaning. In HPE Aruba Networking documentation, AAA means Authentication, Authorization, and Accounting.

The correct answer is C. Input errors have occurred. The interface output shows CRC/FCS errors with a value of 1254 under the RX column. CRC/FCS errors are receive-side frame check errors, so they indicate that the switch has received corrupted frames on this interface. HPE Aruba Networking AOS-CX show interface documentation lists interface statistics including packets, bytes, dropped frames, pause frames, errors, CRC/FCS, collisions, runts, and giants, which confirms that CRC/FCS is part of the interface error statistics. Option A is incorrect because the output says VLAN Mode: access and Access VLAN: 90; an access VLAN is untagged toward the endpoint, not an 802.1Q tagged trunk VLAN. Option B is incorrect because the MTU is shown as 1500, and the Jumbos counter is 0, so the output does not indicate jumbo-frame use. Option D is incorrect because the shown output does not state that PoE is disabled. The key troubleshooting clue is the nonzero receive CRC/FCS counter. ( arubanetworking.hpe.com )

The correct answer is A. A link between members 1 and 3 needs to be disconnected. The output shows that the current three-member VSF stack is built as a ring: member 1 connects to member 2, member 2 connects to member 3, and member 3 connects back to member 1. To insert an additional member into an existing physical ring, one of the ring links must be opened so the new switch can be cabled between the two existing members. In this case, disconnecting the link between members 1 and 3 allows the new member to be added between those members, preserving the ring topology after the new connections are made. HPE Aruba Networking VSF documentation states that VSF supports 6200F stacks in chain and ring topologies, with ring topology recommended for resiliency because each member has VSF link connectivity to two other members. Option B is incorrect because changing to chain topology is not required or preferred. Option C is incorrect because the existing VSF links are already being used for the ring. Option D is incorrect because the standby role is determined within the stack; the new member is not pre-provisioned as standby.

The correct answer is B. To find the destination MAC address for a specific IP address. ARP, or Address Resolution Protocol, is used on IPv4 Ethernet networks to map a Layer 3 IPv4 address to a Layer 2 MAC address. HPE Aruba Networking AOS-CX documentation states that ARP maps network addresses assigned to devices to physical addresses, and specifically maps IPv4 network addresses to Layer 2 MAC addresses on Ethernet networks. When a host wants to send traffic to another IPv4 device on the same local network, or to its default gateway, it must know the destination MAC address to build the Ethernet frame. If the MAC address is not already in its ARP table, it sends an ARP request asking which device owns the target IP address. Option A is incorrect because ARP is not used to find a source IP address. Option C is incorrect because the device already knows its own source MAC address. Option D describes reverse mapping, which is not the purpose of a normal ARP request.

The correct answer is A. operators. HPE Aruba Networking AOS-CX documentation for the CX 8400 identifies built-in user groups that exist by default on the switch. These include administrators, operators, and auditors. The operators group has limited privileges, such as basic display-only CLI access and the ability to view nonsensitive switch configuration information. It does not have full switch configuration privileges. The other options—helpdesk, servicedesk, and support—are not listed as built-in default user groups for the CX 8400. Those names could be created manually as custom local user groups in some environments, but they are not default AOS-CX groups. Therefore, from the available choices, the default group is operators.

The correct answer is C. Automates root cause analytics. HPE Aruba Networking AOS-CX documentation describes the Network Analytics Engine, or NAE, as a framework within AOS-CX switches that automates the detection of issues and automates root cause analysis. NAE agents monitor switch resources, events, configuration, protocol states, and other operational data to help identify issues faster. This helps administrators move from manual troubleshooting to analytics-driven troubleshooting directly on the switch. Option A is not the best answer because NAE is not simply a feature that automatically creates tech-support diagnostic files. Option B is incorrect because automated configuration backups are not the main purpose of NAE. Option D is incorrect because NAE does not primarily create support events in the HPE Aruba Networking Support Portal. Its purpose is local switch analytics, issue detection, and root cause analysis. Therefore, the best description is that NAE automates root cause analytics.

The correct matches are 802.3af for 15.4W, 802.3at for 30W, 802.3bt Type 3 for 60W, and 802.3bt Type 4 for 90W. HPE Aruba Networking AOS-CX PoE documentation explains that PoE powered devices are divided into different types and classes according to their power requirements. It identifies Type 1 as supplying a maximum of 15.4W from the power sourcing equipment, which corresponds to IEEE 802.3af. Type 2 supplies a maximum of 30W, which corresponds to IEEE 802.3at. Type 3 supplies a maximum of 60W and Type 4 supplies a maximum of 90W, both under IEEE 802.3bt. These values are important when selecting switch PoE capability for devices such as access points, cameras, sensors, phones, and other powered devices. The switch must have both the per-port PoE capability and enough total PoE power budget to support the connected devices.

The correct answer is A. API. HPE Aruba Networking Fabric Composer is an orchestration and management platform for supported AOS-CX switches. HPE Aruba Networking Fabric Composer documentation describes Fabric Composer as managing and orchestrating HPE Aruba Networking AOS-CX switch fabrics and includes an API Explorer containing Fabric Composer API documentation. The Fabric Composer guide also describes system settings for switch polling, switch events through a web socket connection, and enhanced logging of API calls. This aligns with Fabric Composer using API-based communication and orchestration rather than traditional CLI-only management. SSH can be used for direct administrator access to a switch, but it is not the best answer for Fabric Composer’s switch-management communication method. Telnet is insecure and not appropriate. SNMPv3 is useful for secure monitoring, but it is not the protocol used by Fabric Composer for configuration orchestration of CX switches. Therefore, the correct option is API.