Question bank
HPE Aruba Certified Professional - Campus Access
44 HPE Aruba Certified Professional - Campus Access questions with the correct answer and a written explanation, organised across 5 exam domains.
- 44 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Campus Access Implementation
12 questions in this domain
- Question 1Single Choice
What is the main purpose of SSID to VLAN mapping in an Aruba campus architecture?
- AIt encapsulates WLAN traffic in GRE or VXLAN and places it into the correct broadcast domain.Correct answer
- BIt assigns IP addresses to wireless clients.
- CIt selects the AP transmit power.
- DIt creates per-user firewall rules.
Why this is the answer
SSID-to-VLAN mapping binds the wireless network to the proper wired VLAN, with GRE/VXLAN carrying traffic to the gateway.
- Question 2Multiple Select
Which two encapsulation mechanisms are used to carry WLAN traffic from an SSID to the wired VLAN in Aruba architectures?
- AGRECorrect answer
- BVXLANCorrect answer
- CIPsec
- DMPLS
Why this is the answer
Aruba architectures use GRE or VXLAN to encapsulate and transport WLAN traffic to the appropriate backend VLAN.
- Question 3Interactive
Refer to the configuration snippet. What is the effect of the vlan 100 command?
- AEmployee traffic will enter VLAN 100 at the gateway after GRE/VXLAN encapsulation.Correct answer
- BThe AP will ignore all client traffic.
- CThe SSID will be hidden from probes.
- DThe client is assigned a static IP in VLAN 100.
Why this is the answer
The vlan command on the SSID maps that WLAN to the backend VLAN, so client traffic is delivered to the correct broadcast domain.
- Question 4Single Choice
In Aruba RBAC, what is the primary factor that determines a user's network privileges?
- AUser identityCorrect answer
- BSSID
- CAP hardware model
- DRadio frequency band
Why this is the answer
RBAC uses user identity to assign privileges, not just the SSID or connection point.
- Question 5Multiple Select
Which items can an Aruba user role govern in a campus network?
- AFirewall policiesCorrect answer
- BBandwidth limitsCorrect answer
- CAccess rightsCorrect answer
- DChannel assignment
Why this is the answer
User roles govern firewall policies, bandwidth limits, and access rights regardless of client location.
- Question 6Interactive
Refer to the role definition. What does this configuration demonstrate about RBAC?
- AThe role enforces security based on identity, independent of the physical connection point.Correct answer
- BThe role is applied only to wired ports.
- CThe role changes the AP channel.
- DThe role affects only SSID-to-VLAN mapping.
Why this is the answer
The role includes VLAN and ACL settings that follow the user identity, not the connection point.
- Question 7Single Choice
Which security profile is required for enterprise-grade identity management in campus WLANs?
- AWPA3-Enterprise with 802.1XCorrect answer
- BWPA2-Personal
- CWEP
- DOpen
Why this is the answer
Enterprise identity management requires 802.1X and WPA3-Enterprise, not pre-shared key or open security.
- Question 8Multiple Select
Which items are associated with implementing enterprise-grade security profiles for Aruba campus access?
- A802.1XCorrect answer
- BEAP typesCorrect answer
- CRADIUS server attributesCorrect answer
- DWPA2-Personal
Why this is the answer
Enterprise security uses 802.1X, EAP, and RADIUS attributes to authenticate users securely.
- Question 9Interactive
Refer to the AAA configuration. Why are RADIUS attributes important in this setup?
- AIt supports secure authentication and seamless handoffs during association.Correct answer
- BIt assigns static channel widths to APs.
- CIt disables client roaming.
- DIt provides DHCP lease information.
Why this is the answer
RADIUS attributes support 802.1X authentication, enabling secure enterprise access and smooth roaming.
- Question 10Single Choice
What is the main function of Radio Resource Management (RRM) in Aruba WLANs?
- AChannel selection and transmit powerCorrect answer
- BSSID broadcast and VLAN IDs
- CClient IP addresses and DNS
- DFirewall policies and user roles
Why this is the answer
RRM automates channel and transmit power settings to reduce interference and maintain coverage.
- Question 11Multiple Select
Which two RF parameters are adjusted by Radio Resource Management?
- AChannel selectionCorrect answer
- BTransmit powerCorrect answer
- CClient MAC address
- DRADIUS secret
Why this is the answer
RRM tunes channel and transmit power, not client addressing or authentication credentials.
- Question 12Interactive
Refer to the ARM profile. What best describes AirMatch operation?
- AIt uses historical data and periodic optimization cycles to predict optimal channel and power plans.Correct answer
- BIt changes channels every second based on real-time interference.
- CIt disables Dynamic Channel Assignment.
- DIt operates independently of client data.
Why this is the answer
AirMatch is a centralized AI-driven engine using historical client and RF telemetry in periodic, data-driven cycles.
Network Management
10 questions in this domain
- Question 13Single Choice
In Aruba campus access, what is the primary purpose of SSID to VLAN mapping?
- AIt binds a wireless network identity to a backend wired VLAN so traffic enters the correct broadcast domain.Correct answer
- BIt changes the physical port configuration of the access switch.
- CIt replaces the need for role-based access control.
- DIt encrypts all traffic between the AP and the internet.
Why this is the answer
SSID-to-VLAN mapping binds a WLAN identity to a wired VLAN, placing traffic into the correct broadcast domain when it reaches the gateway. It does not replace RBAC or encryption.
- Question 14Multiple Select
Which of the following are characteristics of Role-Based Access Control (RBAC) in Aruba? (Select all that apply.)
- AUser identity, not just the SSID, dictates network privileges.Correct answer
- BUser roles govern firewall policies and bandwidth limits.Correct answer
- CAccess rights are tied to the physical connection point.
- DRBAC is used only for guest networks.
Why this is the answer
RBAC uses user identity to determine privileges, with roles enforcing firewall policies and bandwidth limits. It does not tie rights to physical connection points and is not limited to guest networks.
- Question 15Interactive
The code block shows wireless client signal, noise, and channel details. Based on those values, what is the most accurate RF assessment?
- AThe client has a strong signal and a healthy signal-to-noise ratio.
- BThe client has adequate signal strength but low signal quality due to a higher noise floor.Correct answer
- CThe client has poor signal strength but excellent signal quality.
- DThe client is experiencing co-channel interference from Bluetooth.
Why this is the answer
The RSSI is adequate, but the SNR is low because the noise floor is relatively high. This distinction between signal strength and signal quality is a common RF trap.
- Question 16Single Choice
What is Radio Resource Management (RRM) in Aruba wireless networks?
- AAutomated configuration of channel selection and transmit powerCorrect answer
- BDynamic creation of user roles for guest access
- CEncryption of management traffic between controllers
- DAutomatic firmware upgrades for access points
Why this is the answer
RRM automates channel planning and transmit power to mitigate interference and maintain coverage density. It is not used for roles, encryption, or firmware.
- Question 17Multiple Select
Which of the following are RF optimization techniques described in the playbook? (Select all that apply.)
- AAirMatchCorrect answer
- BTransmit Power Control (TPC)Correct answer
- CDynamic Channel Assignment (DCA)Correct answer
- DStatic Channel Assignment
Why this is the answer
AirMatch, TPC, and DCA are Aruba RF optimization features. Static channel assignment does not adapt to environmental changes and is not considered an optimization technique.
- Question 18Interactive
The code block shows an RF optimization summary for a mobility domain. What does the output reveal about AirMatch?
- AAirMatch continuously adjusts channels second by second.
- BAirMatch follows a periodic, data-driven optimization cycle.Correct answer
- CAirMatch requires manual channel configuration before it can run.
- DAirMatch only optimizes transmit power on the 2.4 GHz band.
Why this is the answer
AirMatch is centralized and data-driven, using periodic optimization cycles rather than real-time second-by-second adjustments. It does not require manual channel configuration.
- Question 19Single Choice
What is the main purpose of 802.11k Neighbor Reports in an Aruba WLAN?
- AIt gives clients a list of adjacent APs, reducing the time spent scanning all channels.Correct answer
- BIt enables the network to suggest a better AP without client involvement.
- CIt performs the security key handshake before a client moves.
- DIt increases transmit power to extend AP coverage.
Why this is the answer
802.11k Neighbor Reports provide candidate APs, shortening the discovery phase of roaming. 802.11v handles BSS Transition Management, and 802.11r handles fast security handoffs.
- Question 20Multiple Select
What are intended benefits of client steering and band steering in Aruba? (Select all that apply.)
- AReduces congestion on the 2.4 GHz spectrumCorrect answer
- BLeverages wider channels and lower noise floorsCorrect answer
- CImproves client throughput by using less congested bandsCorrect answer
- DForces all clients to remain on 2.4 GHz for compatibility
Why this is the answer
Steering dual-band clients to 5 GHz or 6 GHz reduces 2.4 GHz congestion and leverages wider channels and lower noise. It does not force clients to stay on 2.4 GHz.
- Question 21Interactive
During a client roaming event, the network sends the client a list of nearby APs, as shown in the code block. Which IEEE standard enables this neighbor-report exchange?
- A802.11kCorrect answer
- B802.11v
- C802.11r
- D802.11ax
Why this is the answer
802.11k Neighbor Reports give clients a list of adjacent APs, reducing the time spent scanning all channels. 802.11v handles transition management, and 802.11r handles fast security handoffs.
- Question 22Single Choice
What is the purpose of Dynamic Channel Assignment (DCA) in Aruba networks?
- AIt assigns non-overlapping channels to neighboring APs to minimize interference.Correct answer
- BIt adjusts client roaming thresholds on mobile devices.
- CIt configures security profiles for enterprise authentication.
- DIt creates VLANs for wireless broadcast domains.
Why this is the answer
DCA assigns non-overlapping channels using global visibility to avoid interference, preventing the domino effect where one channel change causes site-wide instability.
Network Resiliency and Device Management
6 questions in this domain
- Question 23Single Choice
What does SSID-to-VLAN mapping accomplish in Aruba campus networks?
- ADefines user roles for firewall filtering
- BPlaces WLAN traffic into the correct VLAN via GRE/VXLANCorrect answer
- CAssigns a static IP to each wireless client
- DCreates a separate management tunnel
Why this is the answer
SSID-to-VLAN mapping binds the WLAN to a VLAN and encapsulates traffic with GRE/VXLAN so it reaches the correct broadcast domain at the gateway.
- Question 24Multiple Select
Which encapsulation methods are used to carry Aruba WLAN traffic to its mapped VLAN?
- AGRECorrect answer
- BVXLANCorrect answer
- CIPsec
- DMPLS
Why this is the answer
GRE and VXLAN are the overlay encapsulation methods used to transport WLAN traffic to the mapped VLAN.
- Question 25Interactive
Based on the CLI configuration shown in the code block, which security profile is applied?
- AWPA2-Personal
- BWPA2-EnterpriseCorrect answer
- CCaptive Portal
- DMAC authentication
Why this is the answer
The configuration specifies wpa2-enterprise with a RADIUS auth server, indicating 802.1X/WPA2-Enterprise is enabled.
- Question 26Single Choice
In Role-Based Access Control, what determines a user's network privileges?
- AUser role derived from identityCorrect answer
- BSSID in use
- CAP location
- DStatic VLAN only
Why this is the answer
RBAC uses user identity and assigned role to shape firewall policies, bandwidth limits, and access rights.
- Question 27Multiple Select
Which RF functions are automated by Aruba Radio Resource Management?
- AChannel selectionCorrect answer
- BTransmit power controlCorrect answer
- CClient band preference
- DQoS mapping
Why this is the answer
RRM automates channel selection and transmit power control to reduce co-channel interference and ensure optimal coverage.
- Question 28Interactive
According to the mapping in the code block, what DSCP value is assigned to WMM voice?
- A34
- B46Correct answer
- C0
- D56
Why this is the answer
This QoS mapping translates WMM voice to DSCP 46, preserving priority for latency-sensitive traffic in the wired network.
Network Stack
3 questions in this domain
- Question 29Single Choice
In HPE Aruba campus access, what does Role-Based Access Control (RBAC) primarily determine?
- AUser identity and privilegesCorrect answer
- BAP transmit power channel
- CSSID broadcast state
- DVLAN membership only
Why this is the answer
RBAC uses the user's identity, not just the SSID, to define firewall policies, bandwidth limits, and access rights.
- Question 30Multiple Select
Which two RF management techniques does Aruba use to reduce co-channel interference in campus deployments?
- ADynamic Channel AssignmentCorrect answer
- BTransmit Power ControlCorrect answer
- CStatic maximum transmit power
- DDisabling non-Wi-Fi radios
Why this is the answer
DCA assigns non-overlapping channels, while TPC adjusts transmit power to reduce overlap and prevent APs from shouting over one another.
- Question 31Interactive
Review the provided WLAN configuration block. Which component is missing to enforce enterprise-grade identity management?
- A802.1X/RADIUS security profileCorrect answer
- BHidden SSID
- CStatic IP addressing
- DBroadcast SSID
Why this is the answer
WPA2/WPA3-Enterprise requires an 802.1X/RADIUS security profile; the snippet only defines an SSID and VLAN, leaving authentication absent.
Wireless LAN
13 questions in this domain
- Question 32Single Choice
In an Aruba campus WLAN, what is the primary purpose of mapping an SSID to a backend wired VLAN?
- APlaces traffic in the correct broadcast domainCorrect answer
- BIncreases RF transmit power
- CHides the network from clients
- DReplaces RADIUS authentication
Why this is the answer
SSID-to-VLAN mapping binds the wireless network identity to a backend wired VLAN so traffic is placed into the correct broadcast domain at the gateway.
- Question 33Multiple Select
Which two functions are performed by Radio Resource Management to automate RF optimization in Aruba WLANs?
- ADynamic Channel AssignmentCorrect answer
- BTransmit Power ControlCorrect answer
- CManual channel locking
- DClient OS patching
Why this is the answer
RRM automates dynamic channel assignment and transmit power control, adapting to environmental changes and reducing interference without manual static configuration.
- Question 34Interactive
Refer to the code block. What is the result of binding the WLAN profile to VLAN 25 in this configuration?
- AMaps wireless traffic to VLAN 25 at the gatewayCorrect answer
- BDisables wireless encryption
- CAssigns a static IP to every client
- DCreates a new user role for each employee
Why this is the answer
The code block shows SSID-to-VLAN mapping. Traffic from the WLAN is encapsulated and delivered to VLAN 25 after reaching the gateway.
- Question 35Single Choice
In Aruba Role-Based Access Control, what is the primary factor that determines the privileges granted to a wireless user?
- AUser identityCorrect answer
- BSSID name
- CAP hardware model
- DRadio channel
Why this is the answer
RBAC uses user identity, not just SSID or connection point, to define firewall policies, bandwidth limits, and access rights.
- Question 36Multiple Select
Which two security profile types are appropriate for enterprise-grade identity management in an Aruba WLAN?
- AWPA2-EnterpriseCorrect answer
- BWPA3-EnterpriseCorrect answer
- CWPA2-Personal
- DOpen authentication
Why this is the answer
Enterprise identity management requires 802.1X authentication, which is provided by WPA2-Enterprise and WPA3-Enterprise security profiles.
- Question 37Interactive
The code block defines a security profile. Which authentication type is enabled when this profile is applied to an SSID?
- A802.1X with EAPCorrect answer
- BPre-shared key
- CCaptive portal
- DMAC authentication only
Why this is the answer
The profile uses dot1x with EAP, aligning with WPA2/WPA3-Enterprise and RADIUS-based identity management.
- Question 38Single Choice
What is the most efficient way to segment users who connect to the same SSID in an Aruba campus WLAN?
- ADefine user roles with RBACCorrect answer
- BCreate a unique SSID for every user group
- CChange the VLAN on one SSID
- DHide the SSID
Why this is the answer
Changing VLAN per SSID is less efficient than role-based access control. The exam expects user identity, not SSID, to drive segmentation.
- Question 39Multiple Select
Which two statements accurately describe Aruba AirMatch and how it performs RF optimization across the mobility domain?
- AIt is an AI-driven engine that automates RF optimizationCorrect answer
- BIt uses historical client data and RF telemetryCorrect answer
- CIt makes real-time second-by-second channel changes
- DIt only adjusts SSID broadcast intervals
Why this is the answer
AirMatch is a centralized AI engine using historical data and RF telemetry in periodic, data-driven optimization cycles.
- Question 40Interactive
The code block enables an automated RF feature in Aruba. What does this feature primarily optimize across the campus?
- AChannel selection and transmit powerCorrect answer
- BClient web authentication
- CGateway routing tables
- DDHCP address pools
Why this is the answer
AirMatch automates optimal channel plans and transmit power across the mobility domain, moving beyond reactive adjustments.
- Question 41Single Choice
What is the main purpose of Transmit Power Control on Aruba access points in a dense campus environment?
- AManage the coverage footprint of APsCorrect answer
- BIncrease encryption strength
- CAssign IP addresses to clients
- DBlock non-Wi-Fi interference
Why this is the answer
Transmit Power Control dynamically adjusts AP power levels, managing coverage and reducing co-channel interference in dense deployments.
- Question 42Multiple Select
Which two sources are classified by Aruba RF management as non-Wi-Fi interference that can affect airtime fairness?
- AMicrowave ovensCorrect answer
- BBluetooth devicesCorrect answer
- CAdjacent AP on same channel
- DClient probe requests
Why this is the answer
Microwaves and Bluetooth are non-Wi-Fi interference sources. Aruba uses spectrum analysis and adjustable sensitivity to maintain airtime fairness.
- Question 43Interactive
The code block enables a client distribution technique. What is the intended outcome of this RF management feature?
- APush dual-band clients toward 5 GHz or 6 GHzCorrect answer
- BDisable 2.4 GHz radios
- CForce all clients to use WPA3
- DIncrease the number of SSIDs
Why this is the answer
Band steering moves dual-band clients to less congested 5 GHz or 6 GHz bands, reducing congestion on 2.4 GHz.
- Question 44Single Choice
A client shows high RSSI but low SNR on a wireless survey. What does this combination indicate about the RF environment?
- AStrong signal with poor SNRCorrect answer
- BWeak signal on a clean channel
- CClient is too far from the AP
- DAP power is too low
Why this is the answer
RSSI is signal strength while SNR is signal quality. High RSSI with low SNR means noise is harming performance.
Frequently asked questions
Everything about the HPE Aruba Certified Professional - Campus Access question bank and how to use it.