The Aruba Certified Campus Access Professional Exam (HPE7-A01)

Authentication survivability is a feature that allows the device to remain operational when a remote link failure occurs between a Gateway cluster and a RADIUS server that is either in the cloud or a datacenter. Authentication survivability enables the Gateway cluster to cache successful authentication requests from the RADIUS server and use them to authenticate clients when the RADIUS server is unreachable. Authentication survivability also allows clients to use MAC caching or MAC authentication bypass (MAB) methods to access the network when the RADIUS server is down. References: https://www.arubanetworks.com/assets/tg/TG_AuthSurvivability.pdf

This is the most likely cause of the issue where the access points in a Microbranch group are online in Aruba Central, but no VPN tunnels are forming. A Microbranch group is a group that contains both APs and Gateways and allows them to form VPN tunnels for secure communication. The VPN tunnels use GRE (Generic Routing Encapsulation) as the encapsulation protocol and IPSec as the encryption protocol. If there is a firewall blocking GRE traffic between the AP and the gateway, the VPN tunnels cannot be established. The other options are incorrect because they either do not affect the VPN tunnel formation or do not apply to a Microbranch group. References: https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/gateways/microbranch.htm https://www.arubanetworks.com/assets/tg/TB_ArubaGateway.pdf

This is because option C shows how to create a single group in Central with different configuration methods defined for each device type. For example, you can create a group with the name Group1, and within this group, you can enable template-based configuration method for switches and UI-based configuration method for Instant APs and Gateways. Aruba Central identifies both these groups under a single name (Group1). If a device type in the group is marked for template-based configuration method, the group name is prefixed with TG (TG Group1).  You can use Group1 as the group ID for workflows such as user management, monitoring, reports, and audit trail 2 .

https://www.arubanetworks.com/techdocs/central/latest/content/nms/groups/abt-groups.htm  2 : https://www.arubanetworks.com/techdocs/central/latest/content/nms/groups/groups.htm

CoA (Change of Authorization) is a feature that allows ClearPass to dynamically change the authorization and access privileges of a device after it has been authenticated 1 .  CoA uses RADIUS messages to communicate with the network device and instruct it to perform an action, such as reauthenticating the device, applying a new VLAN or user role, or disconnecting the device 2 .

To enable CoA on a CX switch, the network engineer needs to configure dynamic authorization on the switch, which is a global command that allows the switch to accept RADIUS messages from ClearPass and execute the requested actions 3 .  The network engineer also needs to specify the IP address and shared secret of ClearPass as a dynamic authorization client on the switch 3 .

To trigger CoA for a specific wired device, the network engineer needs to bounce the switchport, which is an action that temporarily disables and re-enables the port where the device is connected. This forces the device to reauthenticate and receive the new policy from ClearPass. Bouncing the switchport can be done manually by using the interface shutdown and no shutdown commands, or automatically by using ClearPass as a CoA server and sending a RADIUS message with the Port-Bounce-Host AVP (Attribute-Value Pair).

The correct mechanism is RADIUS Change of Authorization (CoA) . ClearPass Policy Manager can dynamically alter or terminate an already authenticated network session by sending a RADIUS dynamic-authorization message to the network access device. Aruba defines dynamic authorization as the capability to modify a user ' s authorization while the session is active, including disconnecting the session . Aruba Networking

For guest accounts, ClearPass can associate an expiration time or permitted access duration with the account. When the configured expiration condition requires the guest to be logged out, ClearPass can issue a RADIUS Disconnect-Request to the NAS, such as an Aruba wireless controller or access infrastructure. Aruba ' s ClearPass Guest documentation specifically describes the Disable and logout behavior as disabling further authorization and using a RADIUS Disconnect-Request for matching active sessions. Aruba Networking Once disconnected, the client must go through the applicable authentication and authorization process again before network access can resume.

An Authorization Profile defines what access should be granted but does not itself provide the dynamic session-disconnect mechanism. Active Directory session timeout and Wi-Fi Sense do not fulfill this ClearPass enforcement function.

Study Guide Topics: ClearPass Policy Manager, AAA, Guest Access, RADIUS Dynamic Authorization, Change of Authorization (CoA), Disconnect-Request, Session Enforcement.

 Aruba Installer App is a mobile app that simplifies site installations and enables network connectivity for Aruba devices. The app allows the user to scan the barcode of the device and add it to the network using Aruba Central.  The app also automates importing Aruba devices into Aruba NetEdit for intelligent configuration management and continuous conformance validation

This is the best practice for handling voice traffic with dynamic segmentation on AOS-CX switches. Dynamic segmentation is a feature that allows AOS-CX switches to tunnel user traffic to a controller or another switch based on user roles and policies. For voice traffic, it is recommended to use switch authentication and local forwarding, which means the voice devices are authenticated by the switch and their traffic is forwarded locally without tunneling. This reduces latency and jitter for voice traffic and improves voice quality. The other options are incorrect because they either use central authentication or tunneling, which are not optimal for voice traffic. References: https://www.arubanetworks.com/techdocs/AOS-CX/10.04/HTML/5200-6728/bk01-ch05.html https://www.arubanetworks.com/assets/ds/DS_AOS-CX.pdf

According to the Aruba Campus Access Professional documents 1 , WPA3-Enterprise is a security mode that supports 802.1X authentication and encryption with either AES-CCM or AES-GCMP.  WPA3-Enterprise also optionally adds usage of Suite-B 192-bit minimum-level security suite that is aligned with Commercial National Security Algorithm (CNSA) for enterprise networks 2 . This mode provides the highest level of security and is suitable for government and financial institutions.

The exhibit shows that the SSID is configured with WPA3-Enterprise (CCM), which uses AES-CCM as the encryption protocol. However, this mode is not compatible with some devices that require CNSA compliance. Therefore, changing the SSID to WPA3-Enterprise (CNSA) would fix the issue and allow all devices to connect to the network.

The built-in auditors role is specifically designed for restricted access to AOS-CX auditing and logging functions. HPE Aruba Networking documents that users assigned to the auditors group have Web UI access only to the System > Log page . For REST API access, auditors are authorized to use GET only against the audit log (/logs/audit) and event log (/logs/event) resources , apart from the POST operations required for login and logout. Aruba Networking

This matches the scenario directly. The requested administrator must be able to inspect event-log information without receiving broader switch management or configuration privileges. The auditors role is therefore an application of least privilege : it provides precisely the logging visibility needed without exposing configuration-changing capabilities.

AOS-CX assigns the auditors role privilege level 19 and restricts CLI access to the auditor context. By comparison, administrators receive privilege level 15 and broad read/write access to switch resources, which would exceed this requirement substantially. Aruba Networking

The AOS-CX REST API documentation also confirms that a GET request against /logs/event retrieves event-log entries, exactly matching the resource specified in the question. Aruba Networking

Therefore, D. auditors is the appropriate default AOS-CX management role.

Study Guide Topics: AOS-CX RBAC, Built-In User Groups, Auditors Role, Web UI Permissions, REST API Authorization, Event and Audit Logs.