HP HPE6-A47 Designing Aruba Solutions Exam Practice Test

In the event of an MM outage, MCs continue to use their existing licenses for 30 days, and the network remains up. However, you cannot change the configuration items in the controller network. In addition, the MM manages many of the higher level functions that can cause issues in the network if the MM fails. Aruba recommends a backup MM for these situations. From an economic point of view, a backup MM for a VMM is free. If a customer has a hardware MM, the customer must purchase a backup hardware MM.

https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/vrrp/conf-stby-mm-l3red.htm

For a VHD wireless network at a large events venue, the architect should ensure that the DHCP and DNS servers are carrier-grade and support a low transaction time. This is because the DHCP and DNS servers are responsible for providing IP addresses and name resolution for the wireless devices, and they need to handle a high volume of requests and responses in a short time. A low transaction time reduces the latency and improves the user experience. A carrier-grade server is a server that meets the high standards of reliability, availability, and scalability required by telecom operators and service providers. A carrier-grade server can handle a large number of concurrent connections, provide redundancy and fault tolerance, and offer high performance and security.

Option A is incorrect because the DHCP server can support a high number of scopes with a /24 size, but this does not guarantee a low transaction time or a carrier-grade service. A scope is a range of IP addresses that the DHCP server can assign to the clients. A /24 size means that each scope can have up to 254 hosts. However, the number of scopes does not affect the speed or quality of the DHCP service. Option B is incorrect because a third-party firewall integrates with ClearPass to filter the guest user traffic, but this does not affect the DHCP and DNS services. A firewall is a device that monitors and controls the network traffic based on predefined rules. ClearPass is a network access control solution that provides secure authentication and policy enforcement. A firewall integration with ClearPass can enhance the security and visibility of the guest user traffic, but it does not improve the performance or reliability of the DHCP and DNS servers. Option C is incorrect because a domain CA is set up to deploy certificates to a high volume of guest devices, but this does not affect the DHCP and DNS services. A certificate authority (CA) is an entity that issues digital certificates that verify the identity and authenticity of the devices. A domain CA is a CA that is part of a domain and can issue certificates to the domain members. A certificate deployment is a process of distributing and installing the certificates to the devices. A certificate deployment can improve the security and trust of the wireless network, but it does not improve the speed or quality of the DHCP and DNS servers. References: Aruba Validated Design: Very High Density 802.11ac Networks), Aruba Validated Design: Campus Wired LAN), Aruba Validated Design: Guest Access)

A customer who has an Instant AP deployment and needs to provide client-to-site VPN access for remote users would benefit from adding a controller to the deployment. A controller can act as a VPN concentrator that terminates the VPN tunnels from the remote clients and provides secure access to the corporate network. The controller can also apply firewall policies and role-based access control to the VPN traffic. An Instant AP deployment alone cannot provide this functionality, as it only supports site-to-site VPN between Instant AP clusters12. The other options do not require a controller, as they can be achieved with an Instant AP deployment. An Instant AP deployment can apply role-based firewall policies using the built-in stateful firewall on each Instant AP3. An Instant AP deployment can also provide a captive portal for guests using the internal orexternal web server options4. An Instant AP deployment can be managed by a cloud-based solution such as Aruba Central, which does not require a controller5. References:

• 1: Understanding IAP-VPN Architecture - Aruba
• 2: Configuring IAP-VPN - Aruba
• 3: Firewall Roles and Policies - Aruba
• 4: Configuring Captive Portal - Aruba
• 5: Managing Instant AP from Aruba Central - Aruba

The correct answer is option C, 20-25. This is because a general rule of thumb for 802.11ac wireless deployment is to have one AP for every 200 square meters (approximately 2,000 square feet) of coverage area. This assumes a moderate user density and application demand. Therefore, for a coverage area of 4,645 square meters (approximately 50,000 square feet), the architect should have in mind about 23 APs (4,645 / 200 = 23.225). This number can be adjusted based on the actual site survey and VisualRF plan, but it serves as a good starting point. References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 4: Wireless LAN Design, where the AP count estimation and site survey methods are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Fundamentals Guide

Auditoriums are challenging environments for wireless design, as they often have a large number of users and devices in a relatively small area, creating high demand for bandwidth and capacity. To provide adequate RF coverage and performance, auditoriums typically require a high-density AP design, which involves deploying more APs than usual, using directional antennas, reducing transmit power, and selecting non-overlapping channels12. A high-density AP design can also help mitigate interference from other sources, such as Bluetooth devices, which operate in the 2.4 GHz band3. Auditoriums do not necessarily require the use of 80 MHz channels or DFS channels, as these options depend on the availability and regulation of the spectrum, as well as the trade-off between throughput and channel reuse . References:

• 1: High Density Wi-Fi Design Principles - Aruba
• 2: Auditorium | WBDG - Whole Building Design Guide
• 3: Bluetooth and Wi-Fi Coexistence Issues and Solutions for the 2.4 GHz ISM Band - Aruba
• [4]: 802.11ac Channel Planning - Aruba
• [5]: Dynamic Frequency Selection (DFS) - Aruba

The IRIS BOM is missing stacking modules and cables for the Aruba 2930M switches. The customer wants to flatten the architecture and avoid recabling, but also maintain connectivity to the core if one link fails. To achieve this, the architect proposed to combine the switches in each Building 2 closet as a VSF fabric and establish two 10 GbE connections to the core per fabric. However, to create a VSF fabric, the switches need to have stacking modules and cables to interconnect them. The IRIS BOM does not include these items, which are required for the VSF configuration. The part numbers for the stacking modules and cables are JL325A and J9735A, respectively.

The other options are not missing from the IRIS BOM because they are either not required or already included. Stacking licenses are not required for the Aruba 2930M switches, as they support VSF natively. 10 GbE direct attach cables are already included in the IRIS BOM as part number J9283D. An uplink module for one of the switches is not required, as the customer already has enough fiber strands to connect each switch to the core. References:

• Aruba 2930M Switch Series Data Sheet (Aruba Networks)
• Designing Aruba Solutions Study Guide (HPE Press)

The solution that the architect should recommend on the 2930M switches to authenticate and control wired employee devices is 802.1X on edge ports and no tunneled node. This solution would provide strong authentication and authorization for the wired devices using certificates, which can be issued and managed by ClearPass. The 802.1X protocol would allow the switches to communicate with ClearPass and enforce user roles and policies based on the device identity and context. The no tunneled node option would allow the wired traffic to be forwarded locally on the access layer switches, as the customer prefers, without tunneling it to the MCs. This option would also reduce the bandwidth consumption and latency on the network core.

The other solutions are not optimal for the customer requirements because they either provide weak authentication or require tunneling the wired traffic to the MCs. MAC-Authon edge ports and no tunneled node would provide weak authentication based on the MAC address of the device, which can be easily spoofed or bypassed. MAC-Auth on edge ports and per-user tunneled node would also provide weak authentication and require tunneling the wired traffic to the MCs, which the customer does not want. 802.1X on edge ports and per-user tunneled node would provide strong authentication but also require tunneling the wired traffic to the MCs, which the customer does not want. References:

• Aruba 2930M Switch Series Data Sheet (Aruba Networks)
• Designing Aruba Solutions Study Guide (HPE Press)

 A collision domain is a logical area of the network where devices share the same wireless medium and may interfere with each other’s transmissions. In a WLAN, a collision domain is defined by the channel and the coverage area of an AP or a client. Devices that operate on the same channel and are within range of each other belong to the same collision domain and must contend for access to the medium using the Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) protocol. Devices that operate on different channels or are out of range of each other belong to different collision domains and do not interfere with each other.

In this scenario, the architect plans 12 APs for an auditorium that is 325 square meters (3,498 square feet). Each AP has one 2.4 GHz radio and one 5 GHz radio. Both types of radios use 20 MHz channels. Assuming that DFS channels can be used in this design, the question is how many 5 GHz collision domains does this design provide.

To answer this question, we need to consider the following factors:

• The number of available 5 GHz channels in the regulatory domain of the auditorium. Different countries have different regulations on the use of the 5 GHz band, which affects the number and availability of channels for WLANs. For example, in the United States, there are 25 non-overlapping 20 MHz channels in the 5 GHz band, but some of them are subject to Dynamic Frequency Selection (DFS) requirements, which means that they must avoid interfering with radar systems by detecting and switching to another channel if radar signals are present. In other countries, such as Japan, there are 19 non-overlapping 20 MHz channels in the 5 GHz band, but some of them are restricted to indoor use only. Therefore, the number of available 5 GHz channels for the design depends on the regulatory domain of the auditorium.
• The channel assignment and distribution of the 12 APs in the auditorium. The channel assignment and distribution of the APs affect the number and size of the collision domains in the WLAN. Ideally, the APs should be assigned to non-overlapping channels and distributed evenly across the auditorium to provide optimal coverage and capacity, while minimizing co-channelinterference and adjacent channel interference. Co-channel interference occurs when devices on the same channel interfere with each other, while adjacent channel interference occurs when devices on nearby channels interfere with each other. Both types of interference degrade the performance and quality of the WLAN. Therefore, the channel assignment and distribution of the APs should follow the best practices of RF design, such as using a channel reuse plan, avoiding channel overlap, and adjusting the transmit power and antenna gain of the APs to match the coverage and capacity requirements of the auditorium.
• The coverage and capacity requirements of the auditorium. The coverage and capacity requirements of the auditorium affect the number and placement of the APs and the transmit power and antenna gain settings of the radios. The coverage requirement refers to the minimum signal strength and signal-to-noise ratio (SNR) that the APs and clients need to maintain a reliable wireless connection. The capacity requirement refers to the maximum number of clients and the minimum throughput and quality of service (QoS) that the APs and clients need to support the applications and services of the auditorium. The coverage and capacity requirements of the auditorium depend on the size and shape of the space, the density and distribution of the clients, the types and characteristics of the applications and services, and the performance and capabilities of the devices. Therefore, the coverage and capacity requirements of the auditorium should be determined by conducting a site survey and a network analysis, and then used to guide the design and configuration of the APs and radios.

Based on these factors, we can estimate the number of 5 GHz collision domains in the design as follows:

• Assuming that the auditorium is located in the United States and that DFS channels can be used in the design, there are 25 non-overlapping 20 MHz channels in the 5 GHz band. However, not all of them may be available or suitable for the design, depending on the presence and activity of radar systems in the area, the compatibility and support of the APs and clients, and the interference and noise level of the environment. Therefore, we will use a conservative estimate of 15 available 20 MHz channels in the 5 GHz band for the design.
• Assuming that the 12 APs are assigned to non-overlapping channels and distributed evenly across the auditorium, each AP will have its own 5 GHz collision domain, as there will be no co-channel interference or adjacent channel interference among the APs. Therefore, there will be 12 5 GHz collision domains in the design, corresponding to the 12 APs.
• Assuming that the coverage and capacity requirements of the auditorium are moderate and that the transmit power and antenna gain settings of the radios are adjusted accordingly, each AP will cover an area of about 27 square meters (290 square feet), which is roughly the size of a small classroom. This means that the APs will provide adequate signal strength and SNR for the clients, while avoiding excessive overlap and interference among the APs. Therefore, there will be no need to further divide or merge the 5 GHz collision domains in the design, as they will match the coverage and capacity requirements of the auditorium.

Hence, the number of 5 GHz collision domains in the design is 12, which is the answer option C. References:

• RF Design | Validated Solution Guide - Aruba
• Configuring 2.4 Ghz and 5 Ghz Radios - Aruba
• Chapter T-5: Understanding RF Collision Domains - Aruba
• [Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47)]

ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

• It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.
• It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.
• It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

• 1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm
• 2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf

The Aruba Mobility Master (MM) hardware appliances are designed to manage large-scale networks. The MM-HW-10K model is capable of managing up to 10,000 devices, which would be sufficient for the customer’s requirement of supporting about 1,500 client APs and a maximum of about 20,000 wireless clients1. Two MM-HW-10K appliances would allow for an active and standby deployment, providing redundancy and ensuring network reliability2.

References:

• System Requirements - Aruba
• Mobility Master Hardware Appliance - Aruba

An active site survey is a method of measuring and validating the wireless coverage, capacity, and performance of a network in a specific environment. It involves deploying temporary APs in the proposed locations, collecting data using a survey tool, and analyzing the results to optimize the network design. A heat map is a graphical representation of the wireless signal strength, interference, noise, or other metrics in different areas of the site. A heat map with proposed AP locations and actual tested coverage is a deliverable that shows the customer the expected performance of the new 802.11ac-based solution, and allows the architect to fine-tune the AP placement, channel selection, transmit power, and antenna orientation. This deliverable also helps the customer to verify that the network meets their requirements for coverage, capacity, and quality of service. References:

• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47) - Chapter 5)
• Aruba Validated Reference Design: Wireless LAN Site Surveys - Chapter 3)
• Aruba Validated Reference Design: 802.11ac Networks - Chapter 4)

SmartLink is a technology that provides fast failover for access switches connected to the core VSF fabric. It detects link failures on the uplink ports and switches to the backup link within 50 ms. It also shuts down the primary link to prevent loops. SmartLink works with any routing protocol and does not require any additional configuration on the core switches. OSPF graceful restart is a feature that allows OSPF to continue forwarding traffic during a planned or unplanned restart of the routing process. However, it does not provide fast failover for link or device failures. BGP is a routing protocol that is mainly used for inter-domain routing and does not provide fast failover for link or device failures. VRRP is a protocol that provides redundancy for routers by creating a virtual router with a shared IP address. However, it does not provide fast failover for link or device failures. References: ArubaOS-Switch Management and Configuration Guide for WC.16.10), Aruba Validated Design: Campus Wired LAN)

The Aruba MC 7010 and 7024 are both designed for small to mid-sized campuses and branches, but they have some differences in their features and specifications. One of the main differences is the number and type of ports they offer. The MC 7010 has 16 10/100/1000BASE-T ports, while the MC 7024 has 8 10/100/1000BASE-T ports and 8 1000BASE-X SFP ports1. This means that the MC 7024 can support more APs that require fiber connections, such as the AP-387 or the AP-5352. The MC 7024 also supports 10G ports, which can provide higher bandwidth and performance for the network backbone3.

Therefore, if the customer needs to connect 20 APs directly to the MC, and some of them require fiber or 10G connections, the MC 7024 is a better choice than the MC 7010. The other options (A, B, and C) are not relevant for choosing between the MC 7010 and 7024, as both models can support up to 64 APs and 4096 users or devices, and both models can provide PoE+ on 12 ports1.

References:

• Aruba 7000 Series Mobility Controllers Data Sheet
• Aruba Access Points Data Sheet
• Aruba 7000 Series Mobility Controllers and Gateways

it meets the customer’s requirements for wired network upgrade. By combining the switches in each Building 2 closet as a Virtual Switching Framework (VSF) fabric, the architect can reduce the number of logical devices within the network, simplifying management and reducing complexity, aligning with the goal of flattening architecture. Establishing two 10 GbE connections to the core per fabric ensures redundancy and resilience, maintaining connectivity even if one link fails, without necessitating additional cabling. This also provides sufficient bandwidth and scalability for the network traffic.

The other options are incorrect because:

• A. Using two additional 2930F switches to act as an aggregation layer for Building 2 adds another layer of devices and complexity to the network, contradicting the goal of flattening architecture. It also requires additional cabling and ports to connect the switches to the core and the access layer.
• B. Connecting each Building 2 switch directly to the core on a single fiber strand through the use of SFP±SR transceivers does not provide redundancy and resilience, as one link failure would disconnect the switch from the core. It also limits the bandwidth and scalability of the network, as each switch would have only one 10 GbE connection to the core.
• D. Extending additional fiber between the buildings so that each Building 2 switch can have a direct 10 GbE connection to the core requires recabling, which the customer wants to avoid. It also increases the cost and complexity of the network, as more fiber strands and ports would be needed.

References:

• Aruba 2930M Switch Series - Data sheet)
• Aruba Validated Reference Design: Campus Wired LAN - Chapter 3)
• ArubaOS-Switch Virtual Switching Framework - Configuration guide)

 This answer is correct because it meets the customer’s requirements for wired authentication and traffic forwarding. By assigning wired users to different VLANs from wireless users, the architect can ensure that the wired traffic is not tunneled to the MCs, but forwarded locally on the access layer switches. This reduces the load on the MCs and the network bandwidth. By using port or role assignments on the access layer switches, the architect can also implement 802.1X authentication without tunnelled node, which enables user access control and dynamic VLAN assignment based on user identity and device type. By extending the VLANs to the core, the architect can ensure that the wired users can reach the data center and other network resources through the Layer 3 switch connected to the firewall. References:

• Aruba 2930M Switch Series - Data sheet)
• Aruba ClearPass Policy Manager - Data sheet)
• ArubaOS-Switch Wired Access with ClearPass - Configuration guide)

According to the Aruba Validated Design: Campus Wireless LAN1, MCs that are in different subnets cannot form a cluster, which is a logical group of MCs that share the same configuration and provide redundancy and load balancing for each other. However, MCs that are in different subnets can still provide backup LMS (local mobility switch) functionality for each other’s APs. This means that if the primary MC that controls an AP fails, the AP can fail over to the backup MC that is in a different subnet. However, this failover is not stateful, meaning that the user sessions and firewall states are not preserved. Therefore, option D is the correct answer.

Option A is incorrect because the MCs can provide some level of redundancy for each other without being in the same subnet, as explained above. Option B is incorrect because VRRP is not required to provide redundancy for MCs that are in different subnets. VRRP is a protocol that provides redundancy for routers by creating a virtual router with a shared IP address. However, MCs do not act as routers, and they do not need a shared IP address to provide backup LMS functionality. Option C is incorrect because the MCs cannot be in a cluster if they are in different subnets, as explained above. Therefore, the cluster will not support any features, such as stateful failover, load balancing, or centralized configuration. References: Aruba Validated Design: Campus Wireless LAN)

The specifications for the AP models are in the format of Tx:Rx:SU-MIMO:MU-MIMO:MU-MIMO clients, where Tx is the number of transmit antennas, Rx is the number of receive antennas, SU-MIMO is the number of spatial streams supported in single-user MIMO mode, MU-MIMO is the number of spatial streams supported in multi-user MIMO mode, and MU-MIMO clients is the number of MU-MIMO clients that can be served simultaneously.

The customer requirements are:

• Support for MU-MIMO: This means the AP must have a MU-MIMO value greater than 1, as MU-MIMO is a technique that allows multiple spatial streams to be transmitted to different clients at the same time.
• Support for up to four spatial streams, both when MU-MIMO is used and when it is not used: This means the AP must have a SU-MIMO value and a MU-MIMO value of 4, as spatial streams are independent data streams that can be transmitted or received by an antenna.
• Support for transmissions to up to three MU-MIMO clients at the same time: This means the AP must have a MU-MIMO clients value of 3, as this indicates the maximum number of clients that can receive MU-MIMO transmissions from the AP at the same time.

Based on these criteria, only the AP 335 meets the customer requirements, as it has a specification of 4x4:4:4:4:3, which means it has 4 transmit and receive antennas, 4 spatial streams in both SU-MIMO and MU-MIMO modes, and can serve 3 MU-MIMO clients simultaneously. The AP 325 does not meet the customer requirements, as it has a specification of 4x4:4:4:3:3, which means it has only 3 spatial streams in MU-MIMO mode, and can only serve 2 MU-MIMO clients simultaneously.

References:

• Aruba AP-335 Wireless Access Point | Aruba
• Aruba AP-325 Wireless Access Point | Aruba
• Multi-User MIMO in WiFi 6 - Arista Networks

The customer needs to upgrade their wireless network, which has a single large building with four floors. The customer requires 30 APs on each floor, totaling 120 APs for the whole building. The customer also wants to use a MM-based architecture, and deployone Aruba 7030 MC on each floor, with the MCs combined in a cluster for seamless client failover and roaming. However, the proposed solution does not meet the customer’s requirements, because the Aruba 7030 MC does not support enough APs for the customer’s needs. Each Aruba 7030 MC can only support up to 64 APs, which means that deploying one on each floor would not be enough to support all the required APs. The architect should explain this limitation to the customer, and suggest a different solution that can support more APs, such as using a higher-capacity MC model, or deploying more MCs per floor.

References:

• Aruba 7000 Series Mobility Controllers Data Sheet)
• ArubaOS 8.5 User Guide)
• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))

This is the general recommendation from the AirWave Server Sizing Guide1, which provides guidelines for selecting and configuring hardware based on the number of devices, clients, and features. The guide also lists the conditions that impact hardware sizing, such as polling frequency, RAPIDS, VisualRF, and Clarity.

References: 1: AirWave 8.2.14.0 Server Sizing Guide - Aruba, page 5.

Deployed as a purpose-built hardware or virtual machine image, each AirWave server supports up to 4,000 network devices (access points, switches, and controllers).https://www.arubanetworks.com/assets/ds/DS_AW.pdf