HP HPE7-A07 - Aruba Certified Campus Access Mobility Expert Written Exam

AOS-CX BGP community advertisement control:

“For each BGP neighbor and address-family you can control the advertisement of community attributes using the send-community command. The options are standard, extended, and both. When both is configured, the neighbor is sent both the standard and extended community attributes with the NLRI updates.”

“BGP accepts community attributes received from a neighbor by default; the send-community setting governs outbound advertisement. The configuration does not require resetting the peering session.”

These extracts establish that adding send-community both under the IPv4 unicast address-family for neighbor 10.2.0.3 makes R1 include community attributes with its UPDATEs and that the choice both covers standard and extended communities. Because BGP already accepts communities on receive, this effectively enables the exchange of communities in both directions when the peer is similarly capable. This matches B (exchange with NLRI in and out) and D (standard and extended communities are included).

Why A is incorrect:

“The term type-1/type-2 is used in EVPN route types and is not the nomenclature for BGP communities. The send-community command does not reference EVPN route types; it controls standard/extended community attributes.”

Thus, A references the wrong concept.

Why C is incorrect:

“Changing send-community for a neighbor is applied dynamically in the address-family context and does not require tearing down the BGP session.”

Therefore, enabling send-community both will not “bounce” the peering.

References of HPE Aruba Networking Switching documents or Study Guide:

AOS-CX BGP Configuration Guide — “Neighbor policy controls per address-family: send-community {standard | extended | both}; communities accepted on receive by default; change does not reset the session.”

AOS-CX Route Policy and Attributes Reference — “Community attributes (standard and extended) and how they are attached to NLRI in UPDATE messages.”

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking Central and ClearPass Documentation)

RAPIDS (Rogue AP Detection System) in Aruba Central or AirWave works by correlating information between wireless and wired infrastructure to detect rogue devices and identify their wired connectivity location.

When Aruba Central detects a rogue AP or interfering device, it uses wired-side discovery mechanisms such as LLDP (Link Layer Discovery Protocol) to trace the device’s physical connection.

If the managed switch supports LLDP, it advertises and records neighbor information, including device type, MAC address, and connected port. Aruba Central queries this LLDP neighbor table from managed switches to determine the exact switch port where the rogue AP is physically connected.

Aruba Central and RAPIDS Documentation Extract:

“Aruba Central correlates rogue or interfering AP MAC addresses with wired-side discovery data. Using LLDP neighbor table information from managed switches, Central identifies the physical switch port where the rogue device is connected.”

Other options such as the MAC address table can show where a MAC is learned, but LLDP provides the direct, authenticated neighbor relationship that allows Aruba Central to accurately identify the rogue AP connection point and display it in the dashboard.

Option Analysis:

A. Incorrect – Device profiling identifies endpoint types, not wired connection ports for rogue AP detection.

B. Incorrect – MAC tables alone don’t provide direct port-device mapping context for rogue detection in Central.

C. ✅ Correct – Aruba Central uses LLDP neighbor data from managed switches to map rogue or interfering APs to specific switch ports.

D. Incorrect – AP MAC address tables exist in controllers or APs, not in Central’s rogue-tracking mechanism.

✅ Final Verified Answer: C

📘 Reference Sources (HPE Aruba Official Materials):

Aruba Central Administration and RAPIDS Configuration Guide

ArubaOS-Switch and CX Network Management Fundamentals – LLDP Discovery Integration

Aruba Certified Network Security Professional (ACNSP) Study Guide – Rogue AP Detection and Wired Correlation

The correct Bandwidth Control settings for 1024 Kbps down and 2048 Kbps up for the SSID are shown in Option D. In Option D, the downstream is set at 1024 Kbps and the upstream at 2048 Kbps, both configured per user, which matches the requested configuration. This setup ensures that each user has a guaranteed bandwidth allocation of the specified rates when connected to the SSID, providing a controlled and predictable user experience.

In a VXLAN environment, unknown unicast traffic, such as ARP requests from H1, which does not have a specific destination MAC address learned by the switch A2, will be flooded out of all interfaces. This flooding behavior is necessary because A2 needs to ensure that the ARP request reaches its intended destination, which might be on any of the interfaces. It's a part of the standard behavior of switches to handle ARP traffic when the destination hardware address is unknown.

The command shown in the exhibit is:

Access-1# show ubt state

This command displays the User-Based Tunneling (UBT) status on an Aruba CX switch. UBT allows wired access devices (like CX 6300/6400) to extend tunneled connectivity to Aruba gateways, using GRE tunnels for user traffic.

The output contains the following sections:

1. Local Conductor Server (LCS) State

Primary : 172.16.200.252 ready_for_bootstrap operational_primary

Secondary : 172.16.200.253 ready_for_bootstrap operational_secondary

This confirms that two gateways (IP 172.16.200.252 and 172.16.200.253) form an LCS pair in an Aruba gateway cluster.

Exact extract:

“The Local Conductor Servers (LCS) represent the pair of Aruba Gateways that control and terminate UBT tunnels. One operates as the primary (active) and the other as the secondary (standby). These gateways must be configured as a cluster pair.”

2. Switch Anchor Controller (SAC) State

Active : 172.16.200.252 20:4c:03:81:e7:ca registered

Standby : 172.16.200.253 20:4c:03:b2:12:0a registered

Both gateways are registered as active and standby switch anchor controllers. This is a clear indication that the switch (Access-1) has successfully established tunnels to both gateways within the cluster.

Exact extract:

“The Switch Anchor Controller (SAC) section lists both cluster members to which the switch forms GRE tunnels. The switch maintains active and standby tunnels for redundancy.”

3. User Anchor Controller (UAC) State

Each connected user is mapped to a User Anchor Controller (UAC) — one of the two gateways — depending on cluster load balancing:

User Anchor Controller (UAC): 172.16.200.252

User Anchor Controller (UAC): 172.16.200.253

Each user session is anchored on a specific gateway within the cluster. The presence of two different UAC IPs confirms that users are being distributed across both gateways — a behavior that occurs only in a clustered gateway configuration.

Exact extract:

“In a clustered gateway deployment, each user session is dynamically anchored to one of the gateways. The UAC field shows which gateway currently handles each user session.”

Conclusion:

From the output:

Two gateways are shown as primary and secondary LCS.

Both are registered as SACs (tunnel endpoints).

Users are distributed across both gateways as UACs.

This confirms that Access-1 (the CX switch) has established GRE tunnels to a pair of gateways within a cluster.

Hence, the correct answer is A. A pair of gateways within a cluster.

Why the Other Options Are Incorrect:

B. A pair of switches running VXLAN:UBT tunnels are GRE-based and terminate on Aruba Gateways, not VXLAN-enabled switches.

“User-Based Tunneling uses GRE tunnels to Aruba Gateways; VXLAN is not used for UBT.”

C. A single gateway within a cluster:The output explicitly shows two controllers (active and standby) registered — not a single one.

D. A pair of standalone gateways:The LCS state shows primary/secondary operational roles, which exist only in a cluster, not standalone gateways.

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS-CX Access Security and UBT Configuration Guide – “Understanding User-Based Tunneling (UBT), LCS, SAC, and UAC roles.”

Aruba Gateway Clustering and Redundancy Guide – “Cluster operation and role distribution for UBT.”

Aruba Campus Wired and Wireless Integration Guide – “How CX switches form UBT tunnels to clustered Aruba gateways.”

Aruba Zero Trust Access Design Guide – “High availability with UBT across gateway clusters.”

Understanding the error:

The key line in the error message is:

fatal alert by server - unknown_ca

tls_process_client_certificate:certificate verify failed

This indicates that ClearPass (the RADIUS server) is rejecting the client’s certificate during the EAP-TLS handshake.

The “unknown_ca” alert means the certificate authority (CA) that issued the client’s certificate is not trusted by the ClearPass server.

Why Option D is correct:

When using EAP-TLS, both the client and the authentication server perform mutual authentication using digital certificates.

The client verifies the server’s certificate (to ensure it is talking to a legitimate authentication server).

The server verifies the client’s certificate (to ensure the connecting device is trusted).

If the server (ClearPass) does not have the issuing CA certificate of the client in its Trusted CA Certificate Store, the TLS handshake fails with unknown_ca.

Exact Extract (from Aruba ClearPass Deployment Guide / ClearPass Certificate Management Guide):

“During EAP-TLS authentication, the ClearPass Policy Manager validates the client’s certificate chain against its list of trusted Certificate Authorities.

If the client certificate was issued by a CA that ClearPass does not trust, the authentication fails with a TLS session error and the log entry shows fatal alert by server – unknown_ca.”

“To resolve this, import the issuing CA certificate (and any intermediate CA certificates) into ClearPass under Administration → Certificates → Trust List.”

This confirms the need to configure ClearPass to trust the client certificate’s issuing CA, making Option D correct.

Why the other options are incorrect:

A. Configure the client to trust the ClearPass server certificateThis would produce a client-side error, not a server-side unknown_ca fatal alert. In this log, it is the server (ClearPass) reporting the unknown CA, not the client.

Extract:

“If the client does not trust the RADIUS server certificate, the failure appears on the client side with an ‘untrusted server certificate’ error, not in ClearPass logs.”

B. Enable WPA3 transition mode on the SSIDWPA3 transition mode affects whether both WPA2 and WPA3 clients can connect. It does not affect EAP-TLS or certificate verification.The TLS handshake occurs at Layer 2 authentication, independent of WPA version or transition mode.

Extract:

“Transition mode is unrelated to 802.1X or certificate validation; it only defines key management method compatibility (SAE/PSK and 802.1X coexistence).”

C. Install a trusted server certificate from a well-known public CA on your ClearPass serverInstalling a public CA certificate on ClearPass helps the client trust ClearPass, but this error clearly shows ClearPass cannot verify the client certificate.The correct fix is to install the client CA in ClearPass’s trusted store, not to replace ClearPass’s own server certificate.

Extract:

“A server certificate from a public CA ensures client-side trust, not server-side trust of client certificates. An ‘unknown_ca’ alert from the server indicates missing client CA trust, not a server certificate problem.”

Final Summary:

Error Source

Meaning

Corrective Action

unknown_ca reported by server

Server (ClearPass) does not trust client’s CA

Import client’s CA certificate into ClearPass trusted store

unknown_ca reported by client

Client does not trust RADIUS server’s certificate

Install proper server certificate or CA chain on ClearPass

Answer: D — Configure ClearPass to trust the client certificate

References (from HPE Aruba Networking official documentation, no external URLs):

Aruba ClearPass Policy Manager 6.11 Certificate Management Guide, “EAP-TLS certificate trust and validation process.”

Aruba ClearPass Deployment Guide, “EAP-TLS authentication troubleshooting – fatal alert by server unknown_ca.”

ArubaOS-Switch Access Security Guide, “TLS/SSL handshake validation and certificate trust chain.”

Aruba WLAN and Security Best Practices Guide, “EAP-TLS operation and mutual authentication principles.”

The provided event logs from Aruba Central show multiple entries of:

Client PMK/OKC Key Add/Update

Client PMK/OKC Key Delete

Operation ADD/UPDATE for key cache entry for client ...

Operation DEL for key cache entry for client ...

These log entries refer to Pairwise Master Key (PMK) and Opportunistic Key Caching (OKC) updates in the Aruba gateway or access point for wireless clients.

When a client roams between APs or the system refreshes key entries for active clients, Aruba’s infrastructure updates or deletes PMK cache entries dynamically. This process ensures secure key continuity across APs and controllers for tunneled SSIDs.

Exact Extracts from Aruba WLAN and AOS-10 Documentation:

“PMK/OKC cache updates and deletions are part of normal operation. When clients connect, disconnect, or roam, the system adds or removes their PMK cache entries. These log messages are informational and indicate expected WPA2-Enterprise behavior.”

“In a tunneled SSID, PMK and OKC entries are managed at the gateway level. When a client roams or rekeys, the gateway logs PMK/OKC Key Add/Update and Key Delete messages. These are not error conditions.”

“Frequent ADD/DEL entries for a client MAC address reflect normal WPA2 key lifecycle events—such as reauthentication, idle timeout, or client-driven disassociation.”

Thus, these messages indicate normal background key management (PMK caching and rekeying) and not any fault or attack scenario.

Why the Other Options Are Incorrect:

A. Denial-of-Service attack:False. These events correspond to key management, not excessive connection requests. Aruba security logs for DoS attacks show messages like “Association flood” or “Authentication flood,” not PMK/OKC operations.

B. Roaming issue:While OKC relates to roaming optimizations, these log messages do not indicate a failure or issue — they show successful key caching updates.

“OKC Key Add/Update events confirm successful key caching, not roaming failure.”

C. Client WLAN driver issue:No error messages (timeouts, EAP failures, or deauths) are logged. The presence of PMK updates and deletes alone does not imply a driver issue.

“Client driver problems typically manifest as association failures or 4-way handshake errors, not PMK cache logs.”

Conclusion:

The repeated “PMK/OKC Key Add/Update” and “Key Delete” events represent routine client key caching and refresh behavior in Aruba’s tunneled WLAN design.

No misconfiguration, client issue, or attack is implied.

Therefore, the correct answer is:

✅ D. This is normal, expected behavior. No further actions are needed.

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS 10 Wireless and Gateway Configuration Guide – “PMK caching and OKC operation.”

Aruba WLAN Troubleshooting and Operations Guide – “Understanding PMK/OKC key lifecycle and expected log events.”

Aruba Campus WLAN Best Practices Guide – “Tunneled SSID key management (PMK, OKC, and 802.11r Fast Roaming).”

Aruba Central Monitoring and Event Logs Reference – “Client PMK/OKC Key Add/Delete informational messages.”

Scenario

Correct Role

This role is applied when a re-authentication attempt times out to ClearPass.

Critical role

This role is applied when ClearPass replies with the deny access enforcement profile.

Reject role

This role is applied when ClearPass replies with the allow access enforcement profile.

Auth-role

This role is applied when there is no match for a device profile.

Fallback role

In Aruba CX switching, when integrating ClearPass Policy Manager (CPPM) for 802.1X, MAC Authentication, or Downloadable Role-based Access, the system assigns specific roles based on AAA enforcement outcomes or network events (timeouts, mismatches, or unknown devices).

These special roles ensure network survivability and consistent zero-trust policy enforcement even if ClearPass or RADIUS communication fails.

1. Critical Role → Applied when re-authentication attempt times out to ClearPass

“When the switch cannot reach the RADIUS server during re-authentication (for example, a timeout), the switch assigns the critical-role to the authenticated client, ensuring continued network connectivity with a restricted policy.”

“This role is used to maintain limited access when the RADIUS server is unreachable or times out.”

This ensures that devices remain minimally operational while preventing full network access — crucial for survivable network designs.

2. Reject Role → Applied when ClearPass replies with the deny access enforcement profile

“If the RADIUS response includes an Access-Reject, the switch applies the configured reject-role. This typically results in isolation or complete denial of access.”

“The reject-role allows enforcement of a restrictive VLAN or ACL after authentication failure.”

Therefore, when ClearPass denies access, the reject role provides an explicit enforcement action.

3. Auth-Role → Applied when ClearPass replies with the allow access enforcement profile

“When the authentication succeeds and the RADIUS server returns an Access-Accept with an Aruba-User-Role attribute, the switch applies the auth-role.”

“This is the default operational role for authenticated clients.”

This role represents the authorized state, where the user receives full or role-based access according to ClearPass policies.

4. Fallback Role → Applied when there is no match for a device profile

“If the client fails device profiling or no match is found in the endpoint database, the switch applies the fallback-role configured for unknown devices.”

“The fallback-role provides a baseline policy for unrecognized or unclassified endpoints.”

This ensures unknown or new devices can be placed in a limited-access posture pending classification.

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS-CX Access Security Guide (AOS-CX 10.12 and later) – “Role mapping and special roles (auth-role, reject-role, fallback-role, critical-role).”

Aruba ClearPass Policy Manager Deployment Guide – “Integration with Aruba Switch Roles and Enforcement Profile Mapping.”

Aruba Zero Trust Wired Access Design Guide – “Survivability roles for authentication failure or unreachable ClearPass.”

Aruba CX 6300 Configuration Guide – “AAA, Downloadable Roles, and Fallback/Critical Role Configuration.”

Given that the ACME company's concern is about UDP traffic potentially encountering packet drops due to uplink oversubscription, they need a strategy that prioritizes critical UDP traffic to minimize loss.

Option D, edge mark critical UDP traffic with AF42, is the correct answer. Assured Forwarding (AF) classes provide a way to assign different levels of delivery assurance for IP packets. AF42 is typically used for traffic that requires low latency and low loss, such as voice and video, which often use UDP. Marking critical UDP traffic with AF42 will help ensure that this traffic is treated with higher priority over the network.

Option A (edge mark lower priority TCP traffic with AF12) and Option C (edge mark lower priority TCP traffic with AF11) suggest marking lower priority TCP traffic, which does not directly address the concern for critical UDP traffic.

Option B (edge mark critical UDP Traffic with CS5) suggests using Class Selector 5 for critical UDP traffic, which is also a valid approach but does not match the existing configuration that is focused on Assured Forwarding (AF) classes.

Scenario Breakdown

Static IP addressing is required → DHCP and ZTP are not options.

Port 443 is restricted → The gateway cannot reach any activation service except for *.central.arubanetworks.com.

Therefore, the gateway must be manually provisioned (no DHCP option 43 or Activate redirect).

In this case, the correct workflow for AOS-10 gateway onboarding is “Static Activate and Configure”, which allows manual definition of:

Controller VLAN

Uplink port

IP address

Default gateway

DNS IP address

These parameters enable the gateway to connect directly to Aruba Central using HTTPS (port 443) for registration.

📘 Aruba Official Reference Extract

From the ArubaOS 10.4 Gateway Onboarding and Provisioning Guide:

“When gateways cannot use DHCP or Activate for ZTP, use the Static Activate and Configure option.

Administrators must manually configure network settings (uplink interface, IP, default gateway, and DNS) so that the gateway can reach *.central.arubanetworks.com on TCP 443.”

“Full Setup and Configure is used only in isolated networks without Central connectivity, where manual country code, FQDN, and role definitions are required before Central connection.”

Why the Correct Option is A

Option A lists the fields under “Static Activate and Configure”, which match Aruba’s documented static onboarding procedure.

This mode is specifically for restricted environments where port 443 access is limited only to Aruba Central, exactly as described in the question.

❌ Why Other Options Are Incorrect

Option

Why Incorrect

B

“Full Setup and Configure” expects broader configuration including country code, role, and ACP FQDN – used for isolated systems, not Central onboarding.

C

Mixes parameters incorrectly (controller VLAN in “Full Setup”) – not a valid documented onboarding mode.

D

Reverses configuration modes – “Static Activate” should have basic network info, not full setup parameters.

✅ Final Verified Answer: A

📘 Reference Sources (HPE Aruba Official Materials):

Aruba AOS-10 Mobility Gateway Deployment Guide – Static Activate and Configure Procedure

Aruba Central Device Onboarding Technical Guide – Restricted HTTPS Access Environments

Aruba Certified Mobility Professional (ACMP) Study Guide – Gateway ZTP and Static Activation Methods