Aruba Campus Access Mobility Expert (Written) Free Sample Questions

The recommended best practice for handling BUM traffic in an EVPN-VXLAN fabric is to use multicast in the underlay network, specifically PIM-SM. This allows VTEPs to join multicast groups corresponding to VNIs, ensuring BUM traffic is efficiently forwarded only to VTEPs that need it, rather than flooding it across the entire underlay. Static replication is not scalable, ingress replication relies on the control plane which can be less efficient for high BUM rates, and IGMP snooping operates at Layer 2 within a VLAN, not in the Layer 3 underlay for VXLAN.

Dynamic Segmentation relies on a centralized policy engine (ClearPass) to assign roles and a network device (Aruba Gateway) to enforce them. ClearPass authenticates the user and, based on its own policies, returns the 'Student' role name via a RADIUS enforcement profile. The Aruba Gateway, having received this role, applies its locally configured 'Student' user role, which contains the specific ACLs to permit internet/portal access and deny access to the research subnet. VSX provides redundancy but doesn't define the policy, and NetConductor is for fabric orchestration.

For VSX synchronization to function correctly, both switches in the pair must be running the exact same ArubaOS-CX software version. A mismatch in firmware will prevent the configuration synchronization protocol from working, leading to a persistent 'sync-loss' state even if the ISL and keepalive links are healthy. While NTP is a best practice, minor time drifts won't block synchronization. The ISL uses LACP which negotiates link parameters, and the keepalive should not be routed through the ISL.

This statement is true. The core principle of a Distributed Anycast Gateway (DAG) is that every leaf switch (VTEP) that serves as a gateway for a particular subnet (VNI) presents the identical default gateway IP and MAC address to the connected hosts. This allows hosts to send traffic to their local leaf for routing, enabling optimal egress traffic paths and seamless host mobility within the fabric.

In EAP-TLS, the RADIUS server must trust the Certificate Authority (CA) that issued the client's certificate. If the root or intermediate CA certificate is not imported into the ClearPass Trust List, ClearPass cannot validate the client's certificate chain and will reject the authentication attempt. The rejection happening immediately after the Client Hello suggests the server cannot even begin to validate the client's presented identity, which points directly to a trust list issue. An expired client certificate or untrusted server certificate would cause failure at a later stage of the TLS handshake.

Routes originated locally within the BGP process on the Aruba CX switch will have an empty AS-Path. Routes learned from other internal BGP (iBGP) peers or external BGP (eBGP) peers will have one or more AS numbers in the path. To advertise only locally originated routes, the administrator should create a route map that permits routes matching an empty AS-Path (often represented by the regex ^$) and denies all others. MED and Local Preference are used for influencing inbound traffic, and weight is for local path selection.

Virtual Switching Extension (VSX) is Aruba's virtualization technology that allows two supported switches to appear as a single logical device to the rest of the network. It provides active-active forwarding paths, enabling the use of all available bandwidth and eliminating the need for Spanning Tree Protocol (STP) between the core and access layers through multi-chassis link aggregation (MC-LAG). VSX is designed for high availability with sub-second failover. VRF is for network segmentation, VRRP is for active-standby gateway redundancy, and VSF is a stacking technology for different switch models.

AirWave's Configuration Audit and Compliance feature is specifically designed for this purpose. It allows administrators to define a 'golden' or desired configuration template and then audit devices against it. The compliance engine can flag any deviations, such as the use of a forbidden authentication method like PSK, and can be configured to automatically remediate the configuration. Triggers and Alerts are for monitoring device status, VisualRF is for location and heatmaps, and RAPIDS is for rogue AP detection.

The EVPN Type 5 route, or IP Prefix Route, is specifically used to advertise IP prefixes (routes) between different VNIs, enabling Layer 3 routing across the fabric. Type 2 routes advertise MAC and IP addresses of hosts within a single VNI for Layer 2 forwarding. Type 3 routes are used for BUM traffic handling. Type 1 routes are for auto-discovery and multihoming. Therefore, Type 5 is the correct answer for inter-VNI routing.

When diagnosing RF performance issues, SNR, PHY Rate, and Retransmission Rate are the most critical metrics. A low SNR indicates a poor quality signal. A low PHY (data) rate indicates the client and AP have negotiated a slow connection speed, often due to poor signal. A high Retransmission Rate (Retries) indicates that frames are being corrupted in transit, usually due to interference or weak signal, which severely impacts throughput. Association Time and IP address are relevant for connectivity but not primary indicators of RF performance.