Free Practice Questions for HP HPE6-A47 Exam

The Aruba 7210 Mobility Controller is designed to support up to 512 APs and 16,384 simultaneous users. In contrast, the 7205 Mobility Controller supports up to 256 APs and 8,192 simultaneous users. Therefore, for a very high density (VHD) design with 128 APs supporting 12,800 devices, the 7210 controllers would be a better fit due to their higher capacity for APs and simultaneous users.

References:

Designing Aruba Solutions, Rev. 20.11, Module 4: Aruba Mobility Controller Design, page 4-16

7200 Series Controller Data Sheet, page 1

According to the Aruba documentation, Aruba AirWare Clarity is a feature that proactively analyzes end-users’ quality of experience by providing enhanced monitoring capabilities for critical network services, such as time and response failures for a mobile device to associate with a Wi-Fi radio, authenticate to a RADIUS server, obtain an IP address through DHCP, and resolve names for DNS services. This gives IT staff end-to-end visibility into problems before they escalate as metrics are monitored in real-time, and also captured through on-demand or scheduled testing for predictive insight. By assessing the times for clients to obtain DHCP and DNS services, Clarity helps staff diagnose non-WiFi related issues that may affect the network performance and user experience.

References:

Clarity - Aruba

Clarity - Aruba

A cluster is a group of MCs that work together to provide high availability, seamless roaming, and load balancing for wireless clients and APs. A cluster requires all MCs to be on the same VLAN and subnet, and to have the same software version and configuration. A cluster supports stateful failover for user connections, which means that if an MC fails, the user sessions are preserved and transferred to another MC in the cluster without any disruption. A cluster also supports hitless failover for APs, which means that if an MC fails, the APs that were connected to it automatically join another MC in the cluster without rebooting. A cluster is the recommended design for high availability for wireless services12. References:

1: Cluster Overview - Aruba

2: High Availability (SSO) Deployment Guide - Cisco

 The correct answer is option C, conversion of the existing Instant APs to campus APs (CAPs). This is because the existing Instant APs can be converted to CAPs by changing their operating mode and pointing them to the MC. This way, the customer can leverage the existing APs and avoid purchasing new ones. The MC can then provide centralized management, configuration, and control for the APs.

Option A is incorrect because the purchase of Universal APs is not necessary. Universal APs are APs that can operate in either Instant or CAP mode without requiring a conversion. However, the existing APs can be converted to CAPs without buying new ones.

Option B is incorrect because Aruba ClearPass is not required to onboard the APs as CAPs in the new MC-based deployment. Aruba ClearPass is a network access control (NAC) solution that provides authentication, authorization, and accounting (AAA) services for wired and wireless devices. It is not involved in the conversion of Instant APs to CAPs.

Option D is incorrect because a Virtual Mobility Controller (VMC) is not a valid option to control Instant APs. A VMC is a software-based MC that runs on a hypervisor. It can control CAPs, but not Instant APs. Instant APs can only be controlled by another Instant AP acting as a Virtual Controller (VC).

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 6: Wireless Network Design, where the Instant and CAP modes and the MC options are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Instant User Guide Aruba Mobility Controller Data Sheet

DSCP (Differentiated Services Code Point) is a method of marking network packets with different priorities based on the type of traffic they carry. DSCP values range from 0 to 63, with higher values indicating higher priority. DSCP values are typically mapped to one of the four WMM (Wi-Fi Multimedia) queues, which are used to prioritize wireless traffic on the access points and controllers. WMM queues are: voice, video, best effort, and background12.

The default QoS settings for Aruba APs and controllers map the DSCP values to the WMM queues as follows3:

Table

DSCP Value

WMM Queue

0-7

Background

8-23

Best Effort

24-39

Video

40-63

Voice

According to these settings, the DSCP values 46 and 34, which are assigned to voice and video traffic by Windows policies, will both be mapped to the video WMM queue. This means that both types of traffic will receive the same priority, and voice traffic will not receive the highest priority that it should. This can result in poor voice quality, increased latency, jitter, or packet loss, especially when the network is congested or bandwidth is limited. Voice traffic is more sensitive to these factors than video traffic, and requires strict QoS to ensure optimal performance and user experience4.

To avoid this potential issue, the architect should explain to the customer that they need to modify the QoS settings on the Aruba APs and controllers to match the DSCP values assigned by Windows policies. This can be done by using the following commands on the Aruba controller3:

(config) #wmm traffic-management-profile voice

(config) #dscp 46

(config) #wmm traffic-management-profile video

(config) #dscp 34

These commands will map the DSCP value 46 to the voice WMM queue, and the DSCP value 34 to the video WMM queue, ensuring that voice traffic receives the highest priority and video traffic receives the second highest priority. This will improve the QoS for the Skype for Business UC solution and enhance the end-user experience.

References:

1: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/qos.htm

2: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/wmm.htm

3: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/qos-mapping.htm

4: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/qos-voice.htm

According to the Designing Aruba Solutions course, dedicated Air Monitors (AMs) are APs that are configured to scan all channels for wireless threats and perform wireless intrusion prevention system (WIPS) functions. One of the advantages of using dedicated AMs over APs that are doing WIPS in AP mode (hybrid) is that AMs can implement wireless containment on any channel on which they detect a threat without affecting the service of legitimate clients. Wireless containment is a technique that prevents rogue APs or clients from communicating with the network by sending deauthentication or disassociation frames to them. However, if an AP that is serving clients performs wireless containment on a different channel, it will have to switch channels frequently, which will degrade the performance and user experience of the clients. Therefore, dedicated AMs are recommended for customers who need effective and efficient wireless containment without compromising client service.

References:

Designing Aruba Solutions, Rev. 20.11, Module 5: Aruba Security Design, page 5-13

Aruba Validated Reference Design: Wireless Intrusion Prevention System, page 10

The traditional guideline limits a wired VLAN to a /24 subnet, which provides enough IP addresses for 253 endpoints. You might have suggested one of three approaches: one VLAN per floor, one VLAN per building, or one VLAN per campus. The one VLAN per floor approach is not recommended because it interferes with roaming and adds complexity. If you did take this approach, the /24 subnets are not large enough for the requirements on every floor. You would need to ask for /23 subnets. The one VLAN per building approach would work if you considered each building its own RF domain. It provides roaming within a building and, if you are using a single cluster at the data center, between buildings. Ifyou deployed two MCs or clusters, one at each building, though, GRE tunneling would be required to support roaming between buildings.

The minimum acceptable signal for an active site survey depends on the type of applications and the data rates that the users require. For 802.11ac, which operates in the 5 GHz band, Aruba recommends a signal of -65 dBm or better for high-performance applications such as voice and video, and a signal of -72 dBm or better for basic applications such as Web and email1. These values are based on the receiver sensitivity of typical 802.11ac clients and the expected signal-to-noise ratio (SNR) for different modulation and coding schemes (MCS). A higher SNR means a higher data rate and a better user experience.

Therefore, the architect should look for a signal of -65 dBm in the 5 GHz band to determine the test AP range for 802.11ac, assuming that the users run high-performance applications. A signal of -75 dBm in the 5 GHz band might be too weak to support the desired data rates and quality of service. A signal of -65 dBm or -75 dBm in the 2.4 GHz band is irrelevant for 802.11ac, as it does not operate in that band.

References:

Aruba Validated Reference Design: 802.11ac Networks

Best Practices for Monitoring and Troubleshooting 802.11ac Networks

The customer wants to use certificates to authenticate user devices, which means that they need a strong and secure method of verifying the identity of the devices that connect to the employee WLAN. The best option for this is to use EAP-TLS instead of PEAP-MSCHAPv2. EAP-TLS stands for Extensible Authentication Protocol-Transport Layer Security, and it is a protocol that uses certificates on both the client and the server side to establish a mutual authentication and a secure channel for data exchange. EAP-TLS is considered the most secure EAP method, as it prevents common attacks such as dictionary attacks, man-in-the-middle attacks, and replay attacks.

The other options are not suitable for the customer requirements:

Option B is incorrect because TKIP encryption is weaker than AES encryption. TKIP stands for Temporal Key Integrity Protocol, and it is an older encryption method that was designed to replace WEP, which had serious security flaws. However, TKIP also has some vulnerabilities, and it is not recommended for modern WLANs. AES stands for Advanced Encryption Standard, and it is a newer and stronger encryption method that provides better security and performance for WLANs.

Option C is incorrect because WPA2-PSK is less secure than WPA2-Enterprise. WPA2-PSK stands for Wi-Fi Protected Access 2-Pre-Shared Key, and it is a security mode that uses a common passphrase or key to authenticate all devices that connect to the WLAN. However, this passphrase or key can be easily compromised or shared, and it does not provide individual authentication or encryption for each device. WPA2-Enterprise stands for Wi-Fi Protected Access 2-Enterprise, and it is a security mode that uses a RADIUS server to authenticate each device individually and dynamically generate encryption keys for each session. WPA2-Enterprise provides better security and scalability for WLANs.

Option D is incorrect because TTLS does not use certificates to authenticate user devices. TTLS stands for Tunneled Transport Layer Security, and it is a protocol that uses certificates only on the server side to establish a secure tunnel for data exchange. The client side can use different methods to authenticate, such as passwords, tokens, or certificates. However, TTLS does not require certificates on the client side, and it is less secure than EAP-TLS.

References:

ArubaOS 8.5 User Guide)

ArubaOS 8.5 Security Guide)

Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))