Free Practice Questions for the HPE Networking HPE6-A90 Exam (2026 Updated)

Technical explanation

Loop protection can emit and detect dedicated loop-detection frames on ports where spanning-tree participation is unavailable or inappropriate. When the device sees its loop-detection traffic return, it can disable or otherwise isolate the problem interface according to configured action and recovery behavior. BPDU Guard requires reception of spanning-tree BPDUs; a loop formed between two ordinary edge ports or through a device that does not emit BPDUs can evade that trigger. Define recovery policy to avoid repeated flapping into an unresolved loop.

LACP bundles links but is not a general defense against accidental edge patch loops. BPDU Guard reacts to received BPDUs; a silent loop can bypass it. Loop protection tests for loopback behavior itself.

Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

From a site dashboard, open the Network planet to display the Unified Device List. Identify the switch, AP or gateway and select its troubleshooting icon to enter the device-specific diagnostic workspace. The default Tests tab exposes appropriate sourced tests; Remote Console or Commands may be available according to device and permission. The Clients and Applications planets provide useful adjacent context but are not the direct route requested for choosing an infrastructure device and launching its diagnostics.

The topology sunburst changes visual focus rather than invoking a device’s diagnostic tools. Clients and Applications planets concern endpoints or flows. The site Network planet exposes the device list and its Troubleshoot control. The documented route is Sites > [site] > Network > Unified Device List > troubleshooting icon; Tests opens by default.

Official HPE references | Viewing the Troubleshooting Page • Troubleshooting Tools | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Site scope is appropriate because the desired values are identical for switches physically assigned to that location, even when they belong to different configuration groups. Create or assign the NTP Server Profile and Syslog Server Profile, and configure a Source Interface Profile only where source-IP selection is required. Confirm the device function and effective scope assignment, as an unassigned Library profile has no deployment effect. Avoid placing genuinely site-specific addresses at Global scope, where the settings would be inherited by unrelated branches.

A device group is useful when the same settings should span several sites; the requirement instead defines one physical location. Site collection would broaden the configuration beyond the requested site. Note that syslog uses its own server profile, alongside NTP and optional source-interface settings.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

VSX preserves independent control planes and distinct management endpoints for the two aggregation peers while coordinating shared L2 behavior and downstream multi-chassis LAGs. Test failures of the ISL, keepalive path and one switch separately, because their protective actions are not identical. Static routing between unrelated switches supplies reachability but not the paired logical aggregation capabilities requested. VSF is suitable for a single-control-plane stack, but that is the opposite of the independent-control-plane design requirement. Split-brain handling, peer keepalive and ISL loss are distinct failure cases; the design review should document all three rather than assuming a single “core failed” test covers VSX behavior.

Static routes alone do not supply MC-LAG-like dual-attached switching, and VSF deliberately shares its stack control plane. VSX retains two independently managed systems and coordinates their high-availability role.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

With tunneled client forwarding, gateway policy becomes a consistent enforcement point for branch WLAN clients. Authentication, role assignment, user VLAN anchoring and traffic inspection can be coordinated centrally, while individual branches retain relatively modest local VLAN requirements. Check WAN latency, gateway cluster capacity, tunnel redundancy and failure behavior before choosing this architecture. Bridging all traffic locally can be valid in smaller branches, but it decentralizes the datapath and reduces the central inspection consistency stipulated by the scenario. A branch design using tunneled traffic also requires sufficient WAN capacity and a survivability plan. Centralized inspection is beneficial only when the gateway and transport remain appropriately available.

Bridge mode breaks out traffic at the AP and may enforce policy locally, so adding gateways without tunnel forwarding does not centralize inspection. Standalone APs lack the requested shared gateway datapath. A tunneled design consolidates enforcement at the gateway cluster.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The network overview provides initial orientation: overall sites, client health, device condition, active alerts and operational issues requiring follow-up. It supports a drill-down workflow from high-level impact to individual sites and devices. Inventory and licensing are specialized administration views; neither is a comprehensive home dashboard for network state. Operators should confirm selected tenant and workspace because administrative context determines which sites and subscriptions are visible after launching Central from GreenLake.

The subscriptions page is an administrative entitlement view, alerts show exceptions, and inventory shows the device roster. Network overview is the broader landing context for health, sites, clients, and conditions needing investigation.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

VSX joins a pair of supported AOS-CX switches with independent control and management planes while synchronizing selected L2 forwarding state across an inter-switch link. Downstream MC-LAG connections can remain forwarding through the surviving peer after failure. Configure the keepalive in a resilient and isolated path, size the ISL appropriately and verify peer consistency. VSF, by contrast, presents a stack with a single logical control plane, which does not match the independent-plane requirement despite its access-layer resiliency benefits. In a two-core VSX design, a downstream access switch can form one LACP logical interface with one member on each core chassis. Fail one VSX peer during acceptance testing and confirm traffic remains on the surviving member.

VSF makes several members a logical stack with one control plane, so option A contradicts independent control and management. VRRP/MSTP on standalone peers can supply redundancy but not VSX’s state coordination and active-active MC-LAG behavior; they are not equivalent for this design.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Split-detection mechanisms determine which VSF fragment may continue forwarding after stacking-link partition, preventing two active control domains from advertising identical management identities or gateway addresses. On supported 6200/6300 families, management ports participate in detection; certain 4100i/6100 platforms instead use a dedicated MAD VLAN with front-plane ports. The standby fragment can disable non-VSF ports when the conductor fragment remains active. MC-LAG design does not solve a split-brain event inside a VSF stack, and daisy-chain topology offers less fault tolerance than a ring where supported.

MC-LAG applies to multichassis link aggregation, not detecting a partitioned VSF stack. A daisy chain may create a single break point rather than preventing split brain. VSF split detection is built for isolating dangerous dual-active fragments.

Official HPE references | VSF Profile • VSF Split Detection | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

The timeline allows metrics and events to be viewed within the same historical period as the reported slowdown, making temporal correlation possible. Compare interface throughput, link errors, CPU alarms, client health and configuration changes for the chosen window. A coincident alert is only a lead; corroborate a causative relationship through device counters or reproducible symptoms. The Hardware card is best for component condition, and the Connectivity card may expose the metrics, but the time-range widget is what makes historical comparison practical.

Hardware inventory does not reveal the past throughput curve. Connectivity data is useful only when viewed at the required period; the Timeline widget is the explicit control for changing the observation window.

Official HPE references | Device Health Card • Troubleshooting Tools | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

A guest role must implement explicit deny rules against internal RFC1918 ranges and sensitive management subnets, followed by permitted DNS, DHCP, captive portal and internet services as appropriate. Confirm the enforcement point: it may be an AP, a gateway, or a switch depending on the forwarding model. Segmentation by VLAN or VRF adds isolation, but a separate VRF is not universally mandatory when a correctly ordered stateful policy blocks east-west access. Test both DNS resolution and attempts to reach internal hosts. For validation, associate a guest device, obtain its assigned role and subnet, then test access to the internet and to an internal host on each protected network. A successful web redirect alone does not demonstrate isolation.

A mixed forwarding SSID is a traffic-location choice, not an authorization policy; bridging employees or tunneling guests does not itself deny private destinations. A distinct VRF can strengthen segmentation but is not inherently required for internet-only guest access.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The WLAN security and access configuration defines how unauthenticated clients reach the portal, what redirect URL or hosted portal is used, and how successful authentication changes the user's role. Configure the pre-authentication role so clients can resolve DNS and reach the portal while remaining blocked from protected services. The precise wizard tab differs across Central interface versions, but the captive-portal behavior belongs to the SSID's access/authentication workflow, not merely to a VLAN definition. Validate the redirect on multiple operating systems.

ClearPass may supply identity or guest services, but merely naming its Guest role does not configure HTTP redirection. The Guest security level alone does not replace a captive-portal profile, its pre-authentication rules, or the portal URL.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

A spanning-tree profile establishes the loop-free logical forwarding topology while retaining physically redundant links. Configure the correct root bridge at the distribution or core layer, verify edge-port status and validate bridge priorities and allowed VLANs. Rapid spanning-tree variants converge faster than older timer-based designs when implemented consistently. BPDU Guard protects true edge ports, but enabling it on switch-to-switch uplinks can unnecessarily err-disable intended redundant connections. MAC authentication has no direct relationship to Layer 2 loop prevention.

BPDU Guard belongs on edge ports that must never receive BPDUs; applying it to every inter-switch port could disable valid uplinks. MAC authentication determines access identity, not loop-free path selection. STP sets the forwarding/blocking topology.

Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

An EAP timeout indicates that an expected authentication message or reply did not arrive within its timer; it is not equivalent to an explicit credential rejection. Verify that the gateway or appropriate AP can reach the configured RADIUS server over the correct network, that shared credentials are valid and that UDP 1812 or configured RadSec connectivity functions. Inspect server logs for received requests and response latency. Only after establishing transport health should you inspect user accounts, certificates or EAP-method mismatches.

An “EAP timeout” is a lack of a timely authentication response, not inherently a bad password; credential failures usually create a rejection. Replacing certificates without checking network reachability can destroy useful evidence and does not restore an unreachable server. If RADIUS requests leave the gateway but responses are absent, check firewall rules, shared-secret configuration and server processing. If a timely Access-Reject returns instead, move the investigation to credentials or authorization.

Official HPE references | Troubleshooting Tools • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

Application-aware traffic steering selects appropriate paths according to intended access: internet/SaaS sessions exit directly at the branch, while protected corporate destinations traverse a secure tunnel to the central gateway or VPNC. Define the traffic identification, routing policy and NAT behavior so enterprise prefixes are not accidentally leaked onto the public internet. Validate DNS steering and failover when the primary tunnel becomes unavailable. Full tunneling adds needless SaaS backhaul, while bridging everything removes the central enterprise inspection and reachability requested. For a SaaS call, local breakout avoids an unnecessary detour through the data center, while a private ERP connection remains tunneled. Validate DNS steering and how the return traffic selects its route.

A full tunnel hairpins SaaS traffic to the corporate gateway; pure bridging loses the desired corporate tunnel path. Application-aware split tunneling distinguishes the two destinations. VPN reachability, DNS behavior, and return routes must support both paths.

Official HPE references | Layer 3 Microbranch - Validated Solution Guide • Configuring VLANs - Microbranch | Study-guide topic: Introduction to AOS-10

Technical explanation

An 802.1Q trunk must interpret untagged frames consistently at both ends. Matching native VLAN configuration prevents an untagged frame from being mapped to different VLANs across the link. Also compare the allowed VLAN list, tagged/untagged treatment and whether the platform tags the native VLAN by explicit policy. Symmetric tagging may be valid as a separate design decision, but it is not a substitute for agreement on VLAN semantics. Test management and user reachability after any trunk change to detect silent VLAN leakage or blackholing. Native VLAN is a deliberate configuration, not something the switch dynamically chooses from broadcasts. Using different native VLANs can leak untagged traffic into unintended segments. Tagging the native VLAN on both sides is a separate compatible design, not the general consistency rule the question tests.

Official HPE references | Creating a VLAN Profile • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Build a reusable Port Profile containing interface administrative state, speed/duplex behavior, PoE settings, applicable spanning-tree options and associated VLAN/security parameters. Assign it through the appropriate Interface Profile or interface selection according to device family and UI workflow. Compare effective configuration on representative switches before deploying widely because uplinks, phones and ordinary edge hosts require different policy. A global alias without an applied profile carries no operational intent, while configuring every port independently raises drift and audit risk.

An alias does not automatically carry an entire port configuration, and editing every interface by hand invites drift. Profiles bind the required switchport intent to a reusable object; assignment to actual ports remains necessary. Open Configuration > Interfaces > Port Profile > Create profile, define the switch settings, then apply the profile from Switch Interface Configuration.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

AirWave was a traditional network management and monitoring product, whereas Central consolidates broader cloud-native configuration, lifecycle management, AI insight and cross-domain operations. A migration requires checking device support, licensing, configuration equivalence and historical monitoring requirements rather than assuming a simple database replacement. ClearPass continues to provide policy and AAA services where deployed, and Mobility Controllers or gateways participate in wireless traffic forwarding; these products are not the legacy management software intended by the question. ClearPass remains an access-policy/AAA product; a Mobility Controller or VPN concentrator forwards or terminates traffic. AirWave is the legacy network-management platform whose visibility and operations Central supersedes for supported deployments.

Official HPE references | Planets in Global Monitoring Page • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A GreenLake workspace defines the organizational boundary containing services, users, resource associations and access controls. Establish the workspace, grant appropriate administrator rights and then onboard or assign devices and subscriptions to the Central application. Subscription tier selection remains an important later step but is not the organizational prerequisite asked here. Ensure that invited users and devices are associated with the correct workspace to avoid accidental cross-tenant visibility or assigning entitlements to an unintended environment.

Assigning subscriptions and enabling auto-assignment follow the existence of an organizational workspace. Compliance data upload is not the prerequisite to creating a Central service. Workspace and roles establish the management boundary first.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Application Visibility uses traffic classification, including DPI where supported, to show application families, usage and performance context rather than merely physical neighbors. Filter by site, wired/wireless client, time window and application category to identify misuse or policy-impacting traffic. Compare classified flows with user-role rules, access controls and QoS treatment. Encryption limits the visibility of payload contents, so classification often relies on signatures, protocol characteristics and metadata; it should not be confused with unrestricted decryption of every application session.

A topology diagram does not categorize application flows, and inventory only identifies assets. Application Visibility supplies classified usage information that can be compared with QoS and role-based policies, subject to the available telemetry and DPI capabilities.

Official HPE references | Application Visibility • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Central's newer configuration design uses Global, Site Collection, Site, Device and Device Group scopes to associate reusable profiles with the intended managed objects. Inheritance reduces repetitive work but introduces precedence and object-linkage considerations. A Library profile is reusable, yet it has no effective device scope until assigned appropriately. The earlier Classic Central concepts of UI groups and template groups remain relevant to migration knowledge, but they are not the distinctive structural feature of the unified multi-level model presented in this question.

UI groups/MultiEdit and templates describe older or parallel management approaches; neither defines the new multi-level configuration architecture. Scope inheritance across Global, Site Collections, Sites, Device Groups, and Devices is the characteristic being examined.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The central entity represents the context from which the operator is exploring relationships, while surrounding planets or objects provide contextual navigation to clients, devices, sites and applications. Changing the selected site or device changes the perspective, not necessarily the physical network topology. This visualization should be understood as an information-architecture mechanism rather than a literal routing map. A primary gateway, the internet edge or a severe alarm can be an object of interest, but none universally defines the central point. An internet edge, a gateway cluster, or an alert source may be visible in a given context but does not universally anchor the solar representation. The center represents the object currently being explored, allowing the surrounding relationships to shift.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A VLAN profile allows DHCP helper-address configuration to follow the VLAN's Layer 3 interface requirements rather than attaching IP relay settings to an unrelated physical access port. Ensure that an SVI exists and has Layer 3 reachability to the DHCP server; DHCP relay is meaningful on the routing device that receives the broadcast. Scope the VLAN profile to the intended site and device functions and check whether any switch needs a unique local SVI address. Validate that both request and reply traffic can traverse the VRF and ACL policies. The VLAN profile workflow starts at Configuration > VLANs & Networks > VLAN > Create Profile, with the desired scope and switch function selected.

A port profile describes physical or logical interface attributes, not VLAN-specific relay across all switches. A generic System profile does not replace the VLAN/SVI-facing helper relationship; tie the helper to the routed VLAN at the intended scope. Be precise about the Layer 3 termination: DHCP relay runs where the client VLAN broadcast reaches a routed VLAN interface. Defining a helper on a switch that only transports the VLAN at Layer 2 will not relay those broadcasts.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Accept Invite begins the account activation and identity verification process for an invited GreenLake user who has not yet completed registration. The invitation associates a person with the organization's workspace but does not automatically grant administrator privileges in every Central application. Role assignment and identity-provider configuration remain separate authorization concerns. If the recipient already has an HPE identity, the exact flow can involve signing in rather than creating a duplicate account; verify the destination workspace and permitted application scopes after acceptance.

Accepting the invite is not blanket access without identity creation or sign-in, and it does not confer administrator status by default. The invited person is guided into the GreenLake account/acceptance process with separately assigned permissions.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A tunneled SSID sends the relevant wireless user traffic to a gateway cluster, where the gateway can evaluate its stateful role-based policies. Confirm that the client's role is assigned at authentication, that the correct rules are installed at the gateway, and that user VLANs terminate on the cluster. Bridged forwarding keeps the datapath local, so policies on a remote gateway cannot inspect those frames. Mixed mode may tunnel selected VLANs, but the simple and unambiguous choice for all affected users is tunneled forwarding. If gateway inspection is mandatory for every client in the given role, mixed forwarding introduces an avoidable bypass condition because a locally bridged VLAN can avoid the gateway datapath.

Microbranch patterns provide selective site forwarding but do not automatically place every target session in the gateway datapath. Mixed mode can bridge some clients locally, bypassing centralized inspection. Tunnel mode makes gateway-side enforcement the explicit default path.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The Remote Console tab creates a browser-based SSH session to a supported device through Central's diagnostic workflow. Credentials and permissions remain necessary; the service is not the same as an out-of-band Ethernet management link. Use CLI commands to inspect interface status, routes, neighbor tables and control-plane health, preferably starting with non-disruptive show commands. Save or export the session record when needed. Template MultiEdit modifies configuration at scale; it is neither a real-time interactive console nor an equivalent troubleshooting access path.

Out-of-band management is a transport/design capability rather than the named browser CLI feature. Template groups and MultiEdit configure devices at scale; they do not provide an interactive shell for incident response. Site > Network > [device] > Troubleshoot > Remote Console is the documented workflow in the new interface; access still depends on permissions and support.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Live upgrade orchestrates staged AP restarts so coverage from unaffected neighbors continues serving users. Verify AP clustering or other supported live-upgrade prerequisites, firmware path, image availability and Advanced licensing when required by the deployed platform. Schedule the execution with awareness of RF design: in a poorly overlapped area, even one AP reboot can disrupt clients. Maintain deployment monitoring and post-change authentication checks. Manually reimaging each AP or relocating devices into a test site is operationally unnecessary and introduces more risk.

Console-based reflashing does not scale to a campus fleet, and relocating APs to a test site creates monitoring and policy confusion. Live Upgrade sequences eligible APs while the remaining radios continue serving much of the coverage area.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

Firmware policy allows administrators to select devices by deployment scope, desired image and an upgrade mechanism. A live upgrade organizes participating APs into reboot sets rather than restarting the entire RF neighborhood together. Prechecks include supported AP hardware, appropriate licensing, access to image distribution and sufficient overlapping coverage. Schedule sites in controlled waves, observe client experience between waves and retain a backout plan. BIOS-dependent transitions and unsupported combinations may require a standard maintenance-window upgrade. For forty sites, stagger upgrade waves by RF coverage and criticality; avoid putting neighboring radios into the same reboot wave. Check the actual release supports the desired live-upgrade procedure for the APs involved.

Manually touching every AP multiplies administrative effort and risk across forty sites. An unscheduled global push can take adjacent radios offline together. A planned live-upgrade sequence is designed to preserve coverage while individual APs change software.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10