HPE6-A86 HPE Network Switching Associate Exam Questions and Answers

The correct answer is B. The switch does not have enough PoE budget per port. The HPE Aruba Networking 580EX Series access point requires appropriate power to boot and illuminate its LEDs. HPE Aruba Networking documentation states that the 580EX Series supports 802.3bt Class 6 power or AC power. A standard HPE Aruba Networking CX 6000 48G 4SFP switch, such as the R8N86A model, is a non-PoE switch; the PoE-capable version is identified separately as the CX 6000 48G Class 4 PoE 4SFP 740W switch. Even when using a PoE-capable CX 6000 model, Class 4 PoE provides up to 30W per port, while the AP requires 802.3bt Class 6 or AC power for normal operation. Therefore, if the AP has no lights, the most likely cause from the options is insufficient or unavailable PoE power from the switch port. A wrong VLAN, missing STP configuration, or failure to connect to HPE Aruba Networking Central would not normally prevent the AP from receiving power and showing LEDs.

The correct answer is C. Automates root cause analytics. HPE Aruba Networking AOS-CX documentation describes the Network Analytics Engine, or NAE, as a framework within AOS-CX switches that automates the detection of issues and automates root cause analysis. NAE agents monitor switch resources, events, configuration, protocol states, and other operational data to help identify issues faster. This helps administrators move from manual troubleshooting to analytics-driven troubleshooting directly on the switch. Option A is not the best answer because NAE is not simply a feature that automatically creates tech-support diagnostic files. Option B is incorrect because automated configuration backups are not the main purpose of NAE. Option D is incorrect because NAE does not primarily create support events in the HPE Aruba Networking Support Portal. Its purpose is local switch analytics, issue detection, and root cause analysis. Therefore, the best description is that NAE automates root cause analytics.

The correct answer is A. A public CA signed certificate should be deployed. The browser warning appears because the captive portal is presenting a self-signed certificate that the client device does not trust. For guest access, client devices are usually unmanaged and cannot be expected to already trust an internal or self-signed certificate authority. HPE Aruba Networking documentation for captive portal deployments recommends that production environments obtain and install a certificate issued for the site or domain by a well-known Certificate Authority. This avoids browser trust warnings and gives guest users confidence that they are connecting to the correct portal. Option B is incorrect because disabling HTTPS and using HTTP would reduce security and expose portal traffic. Option C may work only for managed devices where the self-signed or private CA can be pushed into the trust store, but that is not practical for open wired guest access. Option D can be valid for internal managed users, but for guests, a public trusted CA certificate is the best answer.

A new firewall rule has been added = Cause

My email is not working = Symptom

My device says “No Internet” = Symptom

One of the DNS servers is offline = Cause

The switch firmware was upgraded = Cause

Websites are not loading = Symptom

The correct classification separates observed user impact from likely reasons for that impact. A symptom is what users or administrators observe, such as “email is not working,” “No Internet,” or “websites are not loading.” These describe the effect of the problem but do not identify why it is happening. A cause is a condition, change, or failure that could explain the symptom. A newly added firewall rule could block traffic, an offline DNS server could prevent name resolution, and a firmware upgrade could introduce a configuration, compatibility, or service-change issue. HPE Aruba Networking troubleshooting documentation commonly separates symptoms from causes and corrective actions; for example, AOS-CX troubleshooting sections describe a visible symptom, then identify the cause and action needed to resolve it. This method helps avoid guessing and keeps troubleshooting structured: first collect symptoms, then identify recent changes and infrastructure failures that could be possible causes. In this question, the user-facing service failures are symptoms, while the firewall, DNS, and firmware items are possible causes.

The correct answer is A. operators. HPE Aruba Networking AOS-CX documentation for the CX 8400 identifies built-in user groups that exist by default on the switch. These include administrators, operators, and auditors. The operators group has limited privileges, such as basic display-only CLI access and the ability to view nonsensitive switch configuration information. It does not have full switch configuration privileges. The other options—helpdesk, servicedesk, and support—are not listed as built-in default user groups for the CX 8400. Those names could be created manually as custom local user groups in some environments, but they are not default AOS-CX groups. Therefore, from the available choices, the default group is operators.

The correct answer is A. The VSF ports automatically forward the traffic for configured VLANs. In HPE Aruba Networking CX VSF, the VSF link ports are dedicated stack-fabric interfaces between VSF members. They are not configured like normal access or trunk ports for user VLAN forwarding. HPE Aruba Networking Central documentation for AOS-CX ports and LAGs notes that VLAN mode options such as access or trunk are not visible for VSF ports, which confirms that VSF ports are not manually configured as normal VLAN trunks. Once the VSF stack is formed, the stack operates as one logical switch, and the VSF links carry the necessary internal stack traffic automatically, including traffic associated with configured VLANs. Option B is incorrect because you do not configure VSF ports as trunk ports with vlan trunk allowed all. Option C is incorrect because vsf-sync is not required for VLAN forwarding across VSF links. Option D is incorrect because VLAN 4095 is not manually configured on VSF links for this purpose.

The correct answer is B. The SNMP service on the Conductor switch will respond to all SNMP queries for the stack. A CX 6200F VSF stack operates as a single logical switch. HPE Aruba Networking VSF documentation explains that one switch in the stack is the Conductor, and the Conductor runs the control-plane software and manages the ASICs of all stack members. The Standby member maintains a synchronized copy of the Conductor’s configuration database and can assume the Conductor role after a failure. HPE Aruba Networking documentation also states that configuration changes are applied on the Conductor switch and then synchronized to the Standby. Since the VSF stack is managed as one logical system, SNMP monitoring is performed against the stack through the active Conductor role, not by independently polling each member as a separate switch. Option A is incorrect because SNMP is not separately enabled per VSF member. Option C is incorrect because SNMP is not enabled by default on each OOBM port for member-specific queries. Option D is incorrect because both Conductor and Standby do not independently answer as separate stacked SNMP endpoints.

The correct answer is B. Transport Layer. Data segmentation is a Transport Layer function. At Layer 4, protocols such as TCP divide application data into smaller pieces called segments so that data can be transported between endpoints. The Transport Layer also uses TCP and UDP port numbers to identify application conversations between hosts. HPE Aruba Networking AOS-CX ACL documentation references TCP/UDP ports as Layer 4 ports, which aligns transport-layer port usage with the Transport Layer. The Application Layer provides user-facing application services, but it does not perform transport segmentation. The Network Layer handles logical IP addressing and routing. The Data Link Layer handles Ethernet framing, MAC addressing, and local delivery on a network segment. Therefore, when the question asks where data segmentation occurs in the OSI model, the correct answer is the Transport Layer. ( arubanetworking.hpe.com )

The correct answer is A. CX 6300. The configuration shown uses OSPFv2 with a process ID, redistribution of connected routes, and a route map. HPE Aruba Networking AOS-CX IP Routing documentation for the CX 6300 and related higher CX platforms includes OSPFv2 routing commands such as router ospf and redistribute connected route-map. The same command documentation shows redistribution into OSPF with a route map as a supported configuration. By contrast, the AOS-CX IP Routing Guide for lower platforms such as the 4100i, 6000, and 6100 includes OSPF command information showing platform support for OSPF on 5420 and 6200, not on the 4100i, 6000, or 6100. Therefore, from the choices provided, the CX 6300 is the switch family that supports creating this OSPF redistribution configuration. The CX 6000 and CX 6100 are access-layer switches and are not the correct choice for this OSPF route redistribution example.

The correct answer is A. Connect using the RJ-45 console port. To perform initial configuration on an HPE Aruba Networking CX 6200M switch, especially when configuring an SVI static IP address for in-band management, you need direct CLI access before the switch has reachable IP connectivity. The HPE Aruba Networking CX 6200 installation documentation identifies the RJ-45 console port as the local serial console connection used for direct management. HPE Aruba Networking fundamentals documentation also explains that initial configuration can be performed through the console port or management port, while VLAN 1 static IP configuration can be used for in-band management. The RJ-45 management port is for out-of-band management, but it requires management interface IP settings to be usable remotely. The Aruba mobile app and Bluetooth adapter can help with some initial setup workflows, but the question asks how to connect to configure an SVI static IP address. The most direct and expected method is to use the console connection and configure the SVI through the CLI. ( hpe.com , arubanetworking.hpe.com )

The correct answer is D. VSF stacking is supported within the same switch family members. HPE Aruba Networking AOS-CX VSF documentation states that a VSF stack supports combinations of models only within a supported switch family. For example, supported 6200 family models can stack with other supported 6200 family models, and supported 6300 family models can stack with other supported 6300 family models. The documentation also states that stacking is not supported across switch families. This means a VSF stack cannot mix unrelated platforms, such as chassis and fixed switches, or combine older AOS-S/Provision switches with AOS-CX switches in the same VSF stack. Option A is incorrect because VSF does not use proprietary backplane cabling; it uses supported Ethernet links, and the supported speeds depend on the switch family. Option B is incorrect because chassis and fixed platforms are not mixed in one VSF stack. Option C is incorrect because existing Provision/AOS-S switches cannot simply add CX switches as members in the same VSF stack.

The correct answer is C. The contents of Flash survive when a device reboots or powers down. In HPE Aruba switch operation, the active configuration used by the device while it is running is the running configuration. The startup configuration is the saved configuration that is preserved and used after reboot. HPE Aruba documentation explains that saving the running configuration writes it to the startup configuration file in Flash memory, allowing the configuration to remain after the switch reboots. This confirms that Flash is nonvolatile storage. HPE Aruba AOS-CX documentation also describes eMMC or SSD switch storage as nonvolatile memory used for persistent storage of configurations, files, databases, and scripts. Option A is incorrect because switch Flash storage is not normally expanded by adding extra Flash for configuration storage. Option B is incorrect because the running configuration is held as the active operating configuration, not simply “Flash.” Option D is incorrect because show running-config displays the current running configuration, not the saved startup configuration stored in Flash.

The correct answer is B. There are more than 8 bits in the host portion. The subnet mask 255.255.254.0 converts to a /23 prefix because the first two octets, 255.255, represent 16 network bits, and the third octet value 254 represents seven more network bits. That gives 23 network bits total. IPv4 addresses are 32 bits long, so 32 minus 23 leaves 9 host bits. Since 9 is more than 8, option B is correct. HPE Aruba Networking documentation uses prefix length as CIDR subnet-mask notation and supports IPv4 prefix lengths from 1 to 32, matching the /23 interpretation. Option A is incorrect because “10.64” alone is not the full network portion for a /23 network. The actual network range is 10.64.0.0/23. Option C is incorrect because the broadcast address for 10.64.0.0/23 is 10.64.1.255, not 10.64.0.240. Option D is incorrect because 255.255.254.0 is /23, not /25.

The correct answer is B. Request to issue the command no shutdown on the port the DAC cable is connected to. On HPE Aruba Networking CX 8100 and similar data center switch platforms, interfaces are Layer 3 and disabled by default. HPE Aruba Networking AOS-CX IP Services documentation states that, by default, all interfaces on these platforms are Layer 3 and disabled, and its examples explicitly enable the interface with no shutdown. Therefore, even if a supported 10Gb DAC cable is physically attached and the peer switch port is monitored, the link will remain down until the CX 8100 interface is administratively enabled. Option A is not the best answer because the symptom is not that the DAC is in the wrong port; the default shutdown state explains the link-down condition. Option C is incorrect because switching enable is not the AOS-CX command used to bring the port online. Option D is incorrect because DAC cables do not require manual Tx/Rx polarity swapping like separate fiber strands might. ( arubanetworking.hpe.com )

The correct answer is D. Peer device native VLAN ID is 1. The LLDP output shows Neighbor Port VLANID : 1, which identifies the VLAN ID advertised by the neighboring device for that port. HPE Aruba Networking AOS-CX documentation for show lldp neighbor-info explains that LLDP neighbor output displays information about neighboring devices and that the details vary based on the TLVs sent by the neighbor. In the Aruba examples, Neighbor Port VLAN ID and Neighbor Port VLAN Name are shown as LLDP fields, so the VLAN ID value in the output can be validated directly. Option A is not the best answer because although the VLAN name field is blank, the stronger validated configuration item is the VLAN ID value. Option B is incorrect because Neighbor MAU type : 10GIGBASER indicates a 10 Gigabit Ethernet BASE-R PHY type, not a 1 Gigabit transceiver. Option C is incorrect because Port: 1/1/25 is the local switch interface where the neighbor was discovered; the peer device’s port is shown separately as Neighbor Port-ID : 1/1/51. Therefore, the validated statement is that the peer device native VLAN ID is 1.

The correct answer is D. To configure a physical interface as a Layer 3 routed port on an HPE Aruba Networking CX 6300 switch, the interface must be placed in routing mode and assigned an IP address directly. This creates a routed interface rather than a bridged Layer 2 port. HPE Aruba Networking AOS-CX examples show routed physical interfaces configured with routing, followed by an ip address, and then no shutdown. The same examples contrast this with Layer 2 ports, which use no routing and VLAN commands such as vlan access or vlan trunk. Option A is incorrect because no routing makes the interface a Layer 2 interface, so assigning an IP address directly is not the correct routed-port configuration. Options B and C are incorrect because vlan access 1 configures the port as a bridged access port. The requirement specifically says the switch should be configured without a bridged port, so the correct CX configuration is a routed physical interface using routing with the IP address configured directly on the port.

The correct answer is C. Customers that do not allow cloud connectivity. HPE Aruba Networking Central On-Premises is intended for organizations that need Aruba Central-style management capabilities but cannot or do not want to place management data in the public cloud. Official HPE Aruba Networking Central On-Premises documentation describes it as a variant of HPE Aruba Networking Central that is deployed in the customer’s own environment, while the Validated Solution Guide states that Central On-Premises is appropriate when security requirements disallow Internet connectivity. This makes it suitable for organizations with strict regulatory, security, data sovereignty, or internal policy requirements that prevent cloud-managed network infrastructure. Option A is incorrect because using hyperscaler-hosted server resources does not, by itself, require Central On-Premises. Option B is incorrect because a SaaS-maintained management platform describes the cloud version of HPE Aruba Networking Central, not the on-premises deployment. Option D is not the best answer because geographical redundancy is not the primary use case described for choosing Central On-Premises.

Built-in stateful firewall = D

400Gb port speeds = C

7–12U chassis form factor = A

8U chassis form factor = B

The correct matches are CX 10000 for built-in stateful firewall, CX 9300 for 400Gb port speeds, CX 6400 for the 7–12U chassis form factor, and CX 8400 for the 8U chassis form factor. HPE Aruba Networking documentation describes the CX 10000 Distributed Services Switch as including stateful firewall capabilities through its distributed services architecture, making it the correct match for built-in stateful firewall. The CX 9300 is identified by HPE Aruba Networking as a high-density 100G/400G switch platform, so it matches the 400Gb port-speed feature. The CX 6400 is a modular chassis family available in 5-slot and 10-slot models; HPE QuickSpecs describe these as compact 7 RU and 12 RU chassis models, matching the 7–12U chassis form factor. The CX 8400 is a modular campus core and aggregation switch described by HPE as a compact 8-slot, 8U chassis, which matches the 8U chassis form factor. These four features are product-line differentiators and should not be interchanged.

The correct answer is B. 2. The diagram shows two VLANs: VLAN 10 and VLAN 20. In Ethernet switching, each VLAN represents a separate Layer 2 broadcast domain. HPE Aruba Networking documentation defines a VLAN as a single Layer 2 network that can be partitioned to create multiple distinct broadcast domains, isolated from each other unless traffic passes through a router or Layer 3 interface. In this diagram, PCs A and B are in VLAN 10, so they share one broadcast domain. PCs C and D are in VLAN 20, so they share a second broadcast domain. The Layer 3 switch has SVIs for VLAN 10 and VLAN 20, which allow routing between the two VLANs, but the SVIs do not merge the broadcast domains. They provide Layer 3 gateways for each VLAN. Therefore, the number of broadcast domains is based on the number of VLANs shown, not the number of PCs, switch links, or SVIs. Since there are two VLANs, there are two broadcast domains.

The correct answer is A. CX 6300. The requirement asks for a fixed 1U access switch that can support 25G speeds toward the aggregation layer. HPE Aruba Networking CX 6300 switches are described as stackable switches suitable for enterprise access, aggregation, core, and data center top-of-rack deployments. HPE QuickSpecs for the CX 6300 list 1U models with SFP/SFP+/SFP28/SFP56 transceiver support, including 1G, 10G, 25G, and 50G uplink capability depending on the model. This makes the CX 6300 the best fit among the options. The CX 6400 is not the best answer because it is a modular chassis platform, not a fixed 1U switch. The CX 6100 is an entry-level Layer 2 access switch with 10G uplinks, not 25G. The CX 6200 supports access switching with uplinks up to 10G, so it also does not satisfy the 25G uplink requirement. Therefore, the initial proposal should be the CX 6300 family.

The correct answer is D. The link on interface 1/1/16 is not established. The output clearly states Interface 1/1/16 is down, Admin state is up, and State information: Waiting for link. This means the port is enabled administratively, but the physical link is not up. HPE Aruba Networking AOS-CX show interface documentation displays these fields to show operational and administrative interface status, including examples where the interface is down while the admin state remains up. Option A is incorrect because the output says qos trust dscp, which trusts Layer 3 DSCP markings, not Layer 2 CoS markings. Option B is incorrect because Admin state is up; an administratively disabled interface would be shut down. Option C is incorrect because the output shows VLAN Mode: native-untagged and Native VLAN: 10; native VLAN 10 is untagged, while the allowed VLAN list shows VLANs permitted on the trunk. Since the port is waiting for link, the immediate verified issue is that the physical link is not established

The correct answer is A. A link between members 1 and 3 needs to be disconnected. The output shows that the current three-member VSF stack is built as a ring: member 1 connects to member 2, member 2 connects to member 3, and member 3 connects back to member 1. To insert an additional member into an existing physical ring, one of the ring links must be opened so the new switch can be cabled between the two existing members. In this case, disconnecting the link between members 1 and 3 allows the new member to be added between those members, preserving the ring topology after the new connections are made. HPE Aruba Networking VSF documentation states that VSF supports 6200F stacks in chain and ring topologies, with ring topology recommended for resiliency because each member has VSF link connectivity to two other members. Option B is incorrect because changing to chain topology is not required or preferred. Option C is incorrect because the existing VSF links are already being used for the ring. Option D is incorrect because the standby role is determined within the stack; the new member is not pre-provisioned as standby.

The correct answer is B. TCP port. The Transport Layer, Layer 4 of the OSI model, is responsible for end-to-end transport services between hosts. TCP and UDP operate at this layer, and TCP/UDP port numbers identify application conversations on a host. A TCP port is therefore a Layer 4 item. Option A is incorrect because an IP address belongs to Layer 3, the Network Layer, where logical addressing and routing occur. Option C is incorrect because a MAC address belongs to Layer 2, the Data Link Layer, where Ethernet switching and local delivery are handled. Option D is incorrect because a physical switch port is associated with the Physical Layer interface and Layer 2 switching behavior, not the Transport Layer. In HPE Aruba Networking CX configurations, ACLs also distinguish between IP addressing and Layer 4 protocol fields such as TCP or UDP ports, reinforcing that TCP port information is transport-layer information.

The correct answer is B. You need to specify the mgmt VRF at the end of the ping command. On HPE Aruba Networking CX switches, the out-of-band management interface uses the management VRF. If you issue a normal ping 10.1.50.11 command without specifying the management VRF, the switch attempts to send the ping using the default routing context rather than the out-of-band management interface. HPE Aruba Networking AOS-CX documentation for the ping command shows that the command supports the optional vrf < vrfname > parameter. The AOS-CX diagnostics documentation also specifically lists this as a cause of ping failure: the user intended to ping through the management VRF but forgot to add vrf mgmt to the command. The correct command would therefore be similar to ping 10.1.50.11 vrf mgmt. Option A is incorrect because the management interface can reach routed destinations if the management VRF has the proper route. Option C is incorrect because the management VRF already exists. Option D is incorrect because ping is supported.

The correct answer is A. Change the hash algorithm. In a LAG, traffic is not normally split packet-by-packet across every member link. Instead, the switch uses a hashing method to choose which physical interface in the aggregate should transmit each flow. The output shows that the current hash is l3-src-dst, which means the load-balancing calculation uses Layer 3 source and destination IP information. If many flows share the same source and destination IP pair, traffic can be unevenly distributed, causing one link to become congested while another link is lightly used. HPE Aruba Networking AOS-CX documentation states that the lacp hash command controls the selection of an interface in an aggregate group and supports Layer 2, Layer 3, and Layer 4 source/destination hash options. Changing the hash algorithm, for example to include Layer 4 source and destination TCP/UDP ports, can improve distribution when Layer 3 values alone are not diverse enough. Changing LACP mode, configuring static LAG, or changing LACP heartbeat rate would not directly fix uneven traffic distribution.

The correct answer is A. API. HPE Aruba Networking Fabric Composer is an orchestration and management platform for supported AOS-CX switches. HPE Aruba Networking Fabric Composer documentation describes Fabric Composer as managing and orchestrating HPE Aruba Networking AOS-CX switch fabrics and includes an API Explorer containing Fabric Composer API documentation. The Fabric Composer guide also describes system settings for switch polling, switch events through a web socket connection, and enhanced logging of API calls. This aligns with Fabric Composer using API-based communication and orchestration rather than traditional CLI-only management. SSH can be used for direct administrator access to a switch, but it is not the best answer for Fabric Composer’s switch-management communication method. Telnet is insecure and not appropriate. SNMPv3 is useful for secure monitoring, but it is not the protocol used by Fabric Composer for configuration orchestration of CX switches. Therefore, the correct option is API.