HPE6-A47 Exam Dumps - HP Aruba Certified Design Professional (ACDP) V1 Questions and Answers

This is a routed link, meaning you should only have one VLAN assigned to the link. Obvious since VLANs are terminated at a layer 3 boundary, but also right out of the curriculum.

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 5: Wired Network Design, where the VSF and VLAN design considerations are discussed. Designing Aruba Solutions Official Certification Study Guide ArubaOS-Switch and ArubaOS-CX VSF Configuration Guide

802.1X authentication without tunnelled node is a form of port-based network access control that uses the Extensible Authentication Protocol (EAP) to authenticate users and devices on a wired network. This form of authentication provides several benefits, such as:

• It enables user access control and ensures only authorized users connect. This prevents unauthorized access to the network and its resources, and enhances security and compliance.
• It allows dynamic assignment of VLANs and roles based on user identity and device type. This simplifies network management and improves user experience.
• It supports multiple authentication methods, such as certificates, passwords, tokens, or biometrics. This provides flexibility and choice for users and administrators.
• It integrates with Aruba ClearPass Policy Manager (CPPM) for centralized policy enforcement and visibility. This enables granular control and monitoring of wired user traffic and devices. References:
• Aruba 2930M Switch Series - Data sheet)
• Aruba ClearPass Policy Manager - Data sheet)
• ArubaOS-Switch Wired Access with ClearPass - Configuration guide)

To route at the core and extend some of the same VLANs in different buildings, the architect should recommend creating a backplane stack at the aggregation layer and a VSF fabric at the core. A backplane stack is a logical switch that combines multiple physical switches into a single unit, using dedicated stacking cables or ports. A VSF fabric is a virtual switch that combines multiple physical switches into a single unit, using standard Ethernet links. Both technologies provide high availability, scalability, and simplified management for the network12.

By creating a backplane stack at the aggregation layer, the architect can reduce the number of routing interfaces and routing protocols needed at the core layer, as well as simplify the configuration and maintenance of the aggregation switches. By creating a VSF fabric at the core layer, the architect can enable Layer 2 connectivity across different buildings, as well as provide redundancy and load balancing for the core switches. The VSF fabric can use Multi-Chassis Link Aggregation (MC-LAG) to extend the same VLANs to different aggregation stacks, without creating loops or blocking ports3.

The other options are not suitable for the customer’s requirements. Implementing broadcast filtering on switch-to-switch links across all of the buildings would not enable Layer 2 connectivity across different buildings, as it would prevent the propagation of Layer 2 control traffic, such as Spanning Tree Protocol (STP) and VLAN Trunking Protocol (VTP). Combining all switches in the aggregation layer and core into a single backplane stack would not be feasible, as it would require compatible switches and sufficient stacking ports or cables, as well as create a single point of failure for the entire network. Using VRRP on the core and aggregation switches, with the aggregation switches acting as standby, would not eliminate the routing at the aggregation layer, as it would still require the aggregation switches to participate in the routing process and maintain routing tables.

References:

• ArubaOS-Switch Stacking Guide
• ArubaOS-Switch Virtual Switching Framework Configuration Guide
• Aruba Validated Reference Design: Campus Wired LAN

The customer wants to use certificates to authenticate user devices, which means that they need a strong and secure method of verifying the identity of the devices that connect to the employee WLAN. The best option for this is to use EAP-TLS instead of PEAP-MSCHAPv2. EAP-TLS stands for Extensible Authentication Protocol-Transport Layer Security, and it is a protocol that uses certificates on both the client and the server side to establish a mutual authentication and a secure channel for data exchange. EAP-TLS is considered the most secure EAP method, as it prevents common attacks such as dictionary attacks, man-in-the-middle attacks, and replay attacks.

The other options are not suitable for the customer requirements:

• Option B is incorrect because TKIP encryption is weaker than AES encryption. TKIP stands for Temporal Key Integrity Protocol, and it is an older encryption method that was designed to replace WEP, which had serious security flaws. However, TKIP also has some vulnerabilities, and it is not recommended for modern WLANs. AES stands for Advanced Encryption Standard, and it is a newer and stronger encryption method that provides better security and performance for WLANs.
• Option C is incorrect because WPA2-PSK is less secure than WPA2-Enterprise. WPA2-PSK stands for Wi-Fi Protected Access 2-Pre-Shared Key, and it is a security mode that uses a common passphrase or key to authenticate all devices that connect to the WLAN. However, this passphrase or key can be easily compromised or shared, and it does not provide individual authentication or encryption for each device. WPA2-Enterprise stands for Wi-Fi Protected Access 2-Enterprise, and it is a security mode that uses a RADIUS server to authenticate each device individually and dynamically generate encryption keys for each session. WPA2-Enterprise provides better security and scalability for WLANs.
• Option D is incorrect because TTLS does not use certificates to authenticate user devices. TTLS stands for Tunneled Transport Layer Security, and it is a protocol that uses certificates only on the server side to establish a secure tunnel for data exchange. The client side can use different methods to authenticate, such as passwords, tokens, or certificates. However, TTLS does not require certificates on the client side, and it is less secure than EAP-TLS.

References:

• ArubaOS 8.5 User Guide)
• ArubaOS 8.5 Security Guide)
• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))

This is the general recommendation from the AirWave Server Sizing Guide1, which provides guidelines for selecting and configuring hardware based on the number of devices, clients, and features. The guide also lists the conditions that impact hardware sizing, such as polling frequency, RAPIDS, VisualRF, and Clarity.

References: 1: AirWave 8.2.14.0 Server Sizing Guide - Aruba, page 5.

Deployed as a purpose-built hardware or virtual machine image, each AirWave server supports up to 4,000 network devices (access points, switches, and controllers).https://www.arubanetworks.com/assets/ds/DS_AW.pdf

The Aruba MC 7010 and 7024 are both designed for small to mid-sized campuses and branches, but they have some differences in their features and specifications. One of the main differences is the number and type of ports they offer. The MC 7010 has 16 10/100/1000BASE-T ports, while the MC 7024 has 8 10/100/1000BASE-T ports and 8 1000BASE-X SFP ports1. This means that the MC 7024 can support more APs that require fiber connections, such as the AP-387 or the AP-5352. The MC 7024 also supports 10G ports, which can provide higher bandwidth and performance for the network backbone3.

Therefore, if the customer needs to connect 20 APs directly to the MC, and some of them require fiber or 10G connections, the MC 7024 is a better choice than the MC 7010. The other options (A, B, and C) are not relevant for choosing between the MC 7010 and 7024, as both models can support up to 64 APs and 4096 users or devices, and both models can provide PoE+ on 12 ports1.

References:

• Aruba 7000 Series Mobility Controllers Data Sheet
• Aruba Access Points Data Sheet
• Aruba 7000 Series Mobility Controllers and Gateways

The Virtual Switching Framework (VSF) is a technology that allows two or more Aruba switches to operate as a single logical device, providing high availability, simplified management, and increased performance. VSF is supported on Aruba 5400R zl2 switches, which are modular switches that can accommodate different types of line cards and power supplies1.

The VSF fabric requires two types of connections between the member switches: VSF links and VSF ports. VSF links are the physical connections that carry the VSF control and data traffic, while VSF ports are the logical interfaces that bundle the VSF links into a single logical link. VSF links can be either 10 GbE or 40 GbE, and VSF ports can be either 10 GbE or 40 GbE1.

To create a VSF fabric with two 5406R zl2 switches, the architect needs to ensure that the switches have the compatible modules, transceivers, and cables for the VSF links and ports. According to the ArubaOS-Switch Management and Configuration Guide1, the following requirements apply for the VSF fabric:

• The switches must have the same chassis model, the same number and type of modules, and the same firmware version.
• The switches must have at least one v3 module in slot A or B. The v3 modules are the ones with the letter “M” in the part number, such as J9990A, J9991A, and J9992A. The v2 modules are the ones with the letter “A” in the part number, such as J9534A, J9535A, and J9536A.
• The switches must have the same type of transceivers and cables for the VSF links. The supported transceivers are the Aruba 10G SFP+ LC SR, the Aruba 10G SFP+ LC LR, the Aruba 40G QSFP+ LC SR4, and the Aruba 40G QSFP+ MPO SR4. The supported cables are the Aruba 10G SFP+ to SFP+ 1m DAC Cable, the Aruba 10G SFP+ to SFP+ 3m DAC Cable, the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable, and the Aruba 40G QSFP+ to QSFP+ 3m DAC Cable.

Based on the exhibit, the architect has planned to use the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable (JH234A) for the VSF links, which is a supported option. However, the architect has also selected the Aruba 24p 10GBASE-T v2 zl Module (J9536A) and the Aruba 20p 10GbE SFP+ v2 zl Module (J9535A) for the switches, which are not compatible with the VSF fabric. The architect should change these v2 modules to v3 modules, such as the Aruba 24p 10GBASE-T v3 zl2 Module (J9996A) and the Aruba 20p 10GbE SFP+ v3 zl2 Module (J9990A), to meet the VSF requirements.

The other options are not issues with the plan. Adding two QSPF+ MP0 SR4 transceivers (A) is not necessary, as the DAC cable already provides the 40 GbE connection for the VSF links. Adding stacking modules and cables © is not required, as the VSF fabric does not use the traditional stacking technology. Changing the power supply type (D) is not relevant, as the VSF fabric does not impose any restrictions on the power supply type.

References: 1: ArubaOS-Switch Management and Configuration Guide - Aruba, Chapter 12: Virtual Switching Framework, pages 219-227.

the new 802.11ac deployment should have a capacity-based design for the best performance, but the existing deployment sounds like a coverage-based design. This is because a capacity-based design takes into account the number and type of clients, the applications they use, and the bandwidth they require. A coverage-based design only considers the signal strength and the absence of coverage holes. A site survey is desirable to determine the optimal locations for the new APs because it can help the architect to assess the current and future capacity needs, identify the sources of interference and noise, and optimize the channel and power settings for the new APs.

Option A is incorrect because an 802.11ac deployment does not necessarily work better with side-mounted APs. The mounting location of the APs depends on the antenna type, the ceiling height, and the RF environment.

Option C is incorrect because 802.11ac AP radios are not more sensitive to 2.4 GHz interference than 802.11n APs. In fact, 802.11ac APs operate in the 5 GHz band, which is less crowded and prone to interference than the 2.4 GHz band.

Option D is incorrect because 802.11ac APs cannot support a higher density of clients by being deployed farther apart. On the contrary, 802.11ac APs need to be deployed closer together to provide the higher data rates and throughput that 802.11ac clients expect.

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 4: Wireless LAN Design, where the capacity-based design and site survey methods are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Fundamentals Guide

The IRIS BOM is missing stacking modules and cables for the Aruba 2930M switches. The customer wants to flatten the architecture and avoid recabling, but also maintain connectivity to the core if one link fails. To achieve this, the architect proposed to combine the switches in each Building 2 closet as a VSF fabric and establish two 10 GbE connections to the core per fabric. However, to create a VSF fabric, the switches need to have stacking modules and cables to interconnect them. The IRIS BOM does not include these items, which are required for the VSF configuration. The part numbers for the stacking modules and cables are JL325A and J9735A, respectively.

The other options are not missing from the IRIS BOM because they are either not required or already included. Stacking licenses are not required for the Aruba 2930M switches, as they support VSF natively. 10 GbE direct attach cables are already included in the IRIS BOM as part number J9283D. An uplink module for one of the switches is not required, as the customer already has enough fiber strands to connect each switch to the core. References:

• Aruba 2930M Switch Series Data Sheet (Aruba Networks)
• Designing Aruba Solutions Study Guide (HPE Press)

 A collision domain is a logical area of the network where devices share the same wireless medium and may interfere with each other’s transmissions. In a WLAN, a collision domain is defined by the channel and the coverage area of an AP or a client. Devices that operate on the same channel and are within range of each other belong to the same collision domain and must contend for access to the medium using the Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) protocol. Devices that operate on different channels or are out of range of each other belong to different collision domains and do not interfere with each other.

In this scenario, the architect plans 12 APs for an auditorium that is 325 square meters (3,498 square feet). Each AP has one 2.4 GHz radio and one 5 GHz radio. Both types of radios use 20 MHz channels. Assuming that DFS channels can be used in this design, the question is how many 5 GHz collision domains does this design provide.

To answer this question, we need to consider the following factors:

• The number of available 5 GHz channels in the regulatory domain of the auditorium. Different countries have different regulations on the use of the 5 GHz band, which affects the number and availability of channels for WLANs. For example, in the United States, there are 25 non-overlapping 20 MHz channels in the 5 GHz band, but some of them are subject to Dynamic Frequency Selection (DFS) requirements, which means that they must avoid interfering with radar systems by detecting and switching to another channel if radar signals are present. In other countries, such as Japan, there are 19 non-overlapping 20 MHz channels in the 5 GHz band, but some of them are restricted to indoor use only. Therefore, the number of available 5 GHz channels for the design depends on the regulatory domain of the auditorium.
• The channel assignment and distribution of the 12 APs in the auditorium. The channel assignment and distribution of the APs affect the number and size of the collision domains in the WLAN. Ideally, the APs should be assigned to non-overlapping channels and distributed evenly across the auditorium to provide optimal coverage and capacity, while minimizing co-channelinterference and adjacent channel interference. Co-channel interference occurs when devices on the same channel interfere with each other, while adjacent channel interference occurs when devices on nearby channels interfere with each other. Both types of interference degrade the performance and quality of the WLAN. Therefore, the channel assignment and distribution of the APs should follow the best practices of RF design, such as using a channel reuse plan, avoiding channel overlap, and adjusting the transmit power and antenna gain of the APs to match the coverage and capacity requirements of the auditorium.
• The coverage and capacity requirements of the auditorium. The coverage and capacity requirements of the auditorium affect the number and placement of the APs and the transmit power and antenna gain settings of the radios. The coverage requirement refers to the minimum signal strength and signal-to-noise ratio (SNR) that the APs and clients need to maintain a reliable wireless connection. The capacity requirement refers to the maximum number of clients and the minimum throughput and quality of service (QoS) that the APs and clients need to support the applications and services of the auditorium. The coverage and capacity requirements of the auditorium depend on the size and shape of the space, the density and distribution of the clients, the types and characteristics of the applications and services, and the performance and capabilities of the devices. Therefore, the coverage and capacity requirements of the auditorium should be determined by conducting a site survey and a network analysis, and then used to guide the design and configuration of the APs and radios.

Based on these factors, we can estimate the number of 5 GHz collision domains in the design as follows:

• Assuming that the auditorium is located in the United States and that DFS channels can be used in the design, there are 25 non-overlapping 20 MHz channels in the 5 GHz band. However, not all of them may be available or suitable for the design, depending on the presence and activity of radar systems in the area, the compatibility and support of the APs and clients, and the interference and noise level of the environment. Therefore, we will use a conservative estimate of 15 available 20 MHz channels in the 5 GHz band for the design.
• Assuming that the 12 APs are assigned to non-overlapping channels and distributed evenly across the auditorium, each AP will have its own 5 GHz collision domain, as there will be no co-channel interference or adjacent channel interference among the APs. Therefore, there will be 12 5 GHz collision domains in the design, corresponding to the 12 APs.
• Assuming that the coverage and capacity requirements of the auditorium are moderate and that the transmit power and antenna gain settings of the radios are adjusted accordingly, each AP will cover an area of about 27 square meters (290 square feet), which is roughly the size of a small classroom. This means that the APs will provide adequate signal strength and SNR for the clients, while avoiding excessive overlap and interference among the APs. Therefore, there will be no need to further divide or merge the 5 GHz collision domains in the design, as they will match the coverage and capacity requirements of the auditorium.

Hence, the number of 5 GHz collision domains in the design is 12, which is the answer option C. References:

• RF Design | Validated Solution Guide - Aruba
• Configuring 2.4 Ghz and 5 Ghz Radios - Aruba
• Chapter T-5: Understanding RF Collision Domains - Aruba
• [Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47)]