Free HP HPE6-A90 Practice Exam with Questions & Answers | Set: 3

Technical explanation

Firmware policy allows administrators to select devices by deployment scope, desired image and an upgrade mechanism. A live upgrade organizes participating APs into reboot sets rather than restarting the entire RF neighborhood together. Prechecks include supported AP hardware, appropriate licensing, access to image distribution and sufficient overlapping coverage. Schedule sites in controlled waves, observe client experience between waves and retain a backout plan. BIOS-dependent transitions and unsupported combinations may require a standard maintenance-window upgrade. For forty sites, stagger upgrade waves by RF coverage and criticality; avoid putting neighboring radios into the same reboot wave. Check the actual release supports the desired live-upgrade procedure for the APs involved.

Manually touching every AP multiplies administrative effort and risk across forty sites. An unscheduled global push can take adjacent radios offline together. A planned live-upgrade sequence is designed to preserve coverage while individual APs change software.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

With tunneled client forwarding, gateway policy becomes a consistent enforcement point for branch WLAN clients. Authentication, role assignment, user VLAN anchoring and traffic inspection can be coordinated centrally, while individual branches retain relatively modest local VLAN requirements. Check WAN latency, gateway cluster capacity, tunnel redundancy and failure behavior before choosing this architecture. Bridging all traffic locally can be valid in smaller branches, but it decentralizes the datapath and reduces the central inspection consistency stipulated by the scenario. A branch design using tunneled traffic also requires sufficient WAN capacity and a survivability plan. Centralized inspection is beneficial only when the gateway and transport remain appropriately available.

Bridge mode breaks out traffic at the AP and may enforce policy locally, so adding gateways without tunnel forwarding does not centralize inspection. Standalone APs lack the requested shared gateway datapath. A tunneled design consolidates enforcement at the gateway cluster.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

WPA3-Enterprise enables 802.1X/EAP-based per-user authentication rather than a shared preshared key. Select EAP-TLS when the policy mandates client certificates; provision trusted PKI roots, server certificates, identity mappings and renewal procedures. EAP-TLS offers mutual certificate-based validation and avoids the password-only model, but WPA3-Enterprise is the WLAN security family and EAP-TLS is the specific authentication method. WPA3-Personal is password-oriented, and transition mode or RadSec transport alone does not impose employee certificate authentication.

WPA3-Personal relies on SAE with a shared passphrase, not enterprise EAP-TLS identity. WPA3 transition options address interoperability and RadSec secures RADIUS transport; neither alone establishes the requested client-certificate mode.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

A global firmware policy captures the intended version and device-function targeting so compliance can be monitored consistently across the managed estate. Confirm model compatibility, exceptions, upgrade scheduling and whether the hardware supports the selected image before enforcement. Sites with specialized requirements may need explicit model or scope exceptions; forcing an incompatible universal version would undermine standardization. AI Insights may recommend remediation but should not be treated as a silent, universal firmware installer. Inspect deployment state and post-upgrade reachability in the policy workflow.

AI Insights does not silently enforce a software version. A general system profile governs operating settings, not the firmware lifecycle. A Global firmware policy defines the target release and enforcement schedule, unless a more specific scope overrides it. For the common target version, use Menu > Firmware Management > Manage > Global > Create Firmware Policy. Define the device function, version and schedule.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

An AOS-10 gateway cluster coordinates user anchoring, tunnel termination, client-state synchronization and resilience across eligible members. A client session can be maintained by another cluster gateway during a supported failure or live-upgrade operation, subject to design and software capabilities. Verify tunnel reachability, cluster membership, role policy equivalence and available forwarding capacity on the surviving peer. VRRP provides a redundant virtual IP for certain designs but does not by itself reproduce all of the stateful mobility and gateway-cluster services involved in wireless user continuity.

VRRP protects a virtual default-gateway address but is not equivalent to AOS-10 gateway-cluster client-state orchestration. LACP cannot form a valid logical bundle between unrelated, unlinked gateways. Cluster membership supplies the stateful failover context. Check active tunnel and user-session state before simulating peer loss. A virtual IP floating between standalone routers is not proof that tunneled wireless client sessions survive a gateway failure.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

For multiple affected users, compare Client Event Log entries for a shared SSID, RADIUS server, authentication method and time interval. Similar failures concentrated after a policy or certificate change indicate a systemic cause; only one model or supplicant version failing suggests a client compatibility issue. Check whether the log reports rejection, response timeout or association loss before changing RADIUS policies. The broader Client dashboard helps establish scale, but the per-event failure messages supply the direct diagnostic evidence requested.

The Client dashboard is the route into a particular user session, but the Client Event Log contains the concrete failure record. Site Inventory lists managed assets rather than authentication exchanges. Use multiple affected clients to determine whether the issue is shared.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Loop protection can emit and detect dedicated loop-detection frames on ports where spanning-tree participation is unavailable or inappropriate. When the device sees its loop-detection traffic return, it can disable or otherwise isolate the problem interface according to configured action and recovery behavior. BPDU Guard requires reception of spanning-tree BPDUs; a loop formed between two ordinary edge ports or through a device that does not emit BPDUs can evade that trigger. Define recovery policy to avoid repeated flapping into an unresolved loop.

LACP bundles links but is not a general defense against accidental edge patch loops. BPDU Guard reacts to received BPDUs; a silent loop can bypass it. Loop protection tests for loopback behavior itself.

Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The network overview provides initial orientation: overall sites, client health, device condition, active alerts and operational issues requiring follow-up. It supports a drill-down workflow from high-level impact to individual sites and devices. Inventory and licensing are specialized administration views; neither is a comprehensive home dashboard for network state. Operators should confirm selected tenant and workspace because administrative context determines which sites and subscriptions are visible after launching Central from GreenLake.

The subscriptions page is an administrative entitlement view, alerts show exceptions, and inventory shows the device roster. Network overview is the broader landing context for health, sites, clients, and conditions needing investigation.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The WLAN security and access configuration defines how unauthenticated clients reach the portal, what redirect URL or hosted portal is used, and how successful authentication changes the user's role. Configure the pre-authentication role so clients can resolve DNS and reach the portal while remaining blocked from protected services. The precise wizard tab differs across Central interface versions, but the captive-portal behavior belongs to the SSID's access/authentication workflow, not merely to a VLAN definition. Validate the redirect on multiple operating systems.

ClearPass may supply identity or guest services, but merely naming its Guest role does not configure HTTP redirection. The Guest security level alone does not replace a captive-portal profile, its pre-authentication rules, or the portal URL.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

An SVI is a virtual Layer 3 interface associated with a VLAN. Give it an IP address and mask from that VLAN's subnet so clients can use it as a default gateway and the switch can route toward other connected networks. Ensure IP routing is enabled, VLAN membership is correct and any VRF association is intentional. A local profile or address alias may be necessary when individual switches need distinct IPs; the basic requirement is the assigned SVI address, not the site scope itself or a static aggregate link.

Site scoping governs distribution of configuration, not whether an SVI has an IP gateway. A static LAG aggregates physical links without creating a routed VLAN interface. The SVI needs its own suitable IP address on the associated subnet.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central