HPE Campus Access Switching Expert (Written) Free Sample Questions

The most scalable, secure, and precise method for controlled inter-VRF routing on ArubaOS-CX switches is using Multi-Protocol BGP (MP-BGP) with route targets (RTs). By configuring specific RTs for export on one VRF and for import on another, an administrator can selectively leak only the required routes (e.g., the monitoring service prefix) without merging the entire routing tables. Static routes are less dynamic, and PBR is more for path selection than inter-VRF routing. Merging VRFs into a global table is insecure and defeats the purpose of segmentation.

A common failure point for NAE agents is an incorrect resource URI. If the script's monitor is trying to access a path like /rest/v10.04/system/bgp/neighbors but the path is wrong, misspelled, or unsupported in the current firmware, the agent cannot retrieve data and will not trigger alerts. Another likely issue is that the condition being checked in the script logic is never met, so the alert action is never called.

Even if the agent is monitoring the correct URI, the Python logic that evaluates the data might be flawed. For example, if the script checks for neighbor_state == 'down' but the state is actually reported as 'Idle' or 'Connect', the condition will never evaluate to true, and the alert action will not be triggered. This is a common issue in script-based monitoring.

This statement is true. The VSX keepalive connection is a critical component for split-brain detection (dual-active scenario). It operates at Layer 3 and is used as a heartbeat mechanism when the Inter-Switch Link (ISL) fails. A direct point-to-point connection is the recommended and most reliable design, although routing it through an OOB management network is a possible, though less ideal, alternative.

ClearPass Profiling is the feature designed for device identification. It collects attributes from network traffic and authentication requests (like DHCP fingerprints, MAC OUI, and LLDP data) to classify endpoints. Once a device is profiled (e.g., identified as a 'Polycom IP Phone'), enforcement policies can use this profile information as a condition to return specific RADIUS attributes, such as Tunnel-Private-Group-ID, which instructs the switch to place the device in the correct VLAN.

In a VSX environment, PIM must be configured on both switches. The pim active-forwarding command should be enabled on the SVIs within the VSX pair. This allows both switches to actively forward multicast traffic, preventing traffic from being dropped and enabling efficient load balancing. PIM state is not synchronized via VSX; each switch maintains its own PIM neighbor relationships and state tables. Disabling PIM on one switch would break multicast routing.

Root Guard is the specific feature designed for this purpose. When enabled on a port, it prevents that port from becoming an STP root port. If the port receives a superior BPDU (Bridge Protocol Data Unit), Root Guard will place the port into a 'root-inconsistent' state, effectively ignoring the rogue BPDU and protecting the integrity of the STP topology. BPDU Guard would disable the port entirely, which might be too aggressive, and Loop Guard is for preventing loops when BPDUs are no longer received.

Broadcast-traffic rate limiting (often called storm control) is specifically designed to mitigate this issue. By setting a threshold (e.g., in packets-per-second or percentage of bandwidth) for broadcast traffic on switch ports, the feature can drop excessive broadcast packets, preventing them from overwhelming the switch's CPU and fabric. This directly addresses the root cause of the performance degradation. QoS would help prioritize good traffic but wouldn't stop the flood, and IGMP snooping only affects multicast traffic.

Virtual Switching Extension (VSX) is the ArubaOS-CX technology that enables two separate switches to appear as a single logical switch to downstream devices. This is the foundation for creating a multi-chassis LAG (MC-LAG). The downstream access stack forms a standard LACP LAG, with its physical members connected to each of the VSX-paired core switches. VSX ensures the two core switches coordinate to handle the LAG traffic as a single entity.

In EAP-TLS, mutual authentication occurs. The client must trust the server's certificate, and the server must trust the client's. A 'TLS session error' often indicates a failure in establishing this trust. If the RADIUS server certificate presented by ClearPass is not signed by a CA that the client trusts, the client will terminate the TLS handshake, resulting in this error. The client's supplicant must be configured to trust the CA that issued the ClearPass RADIUS certificate.

The primary function of the BGP EVPN control plane is to replace the traditional flood-and-learn mechanism of Ethernet. VTEPs (VXLAN Tunnel Endpoints) use BGP to advertise learned MAC addresses (and optionally IP addresses for ARP suppression) to other VTEPs. This allows for a more scalable and efficient fabric, as unicast traffic can be routed directly to the destination VTEP without prior flooding. Encapsulation is the role of the VXLAN data plane, not the EVPN control plane.