2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free HPE HPE7-A08 Network Switching Professional Practice Questions

17 free HPE HPE7-A08 Network Switching Professional practice questions from the CertStash pack of 168, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 17 free here, all 168 in the pack, and each step includes the one before it.

Get all 168 questions (US$39) · Download the first 10 as a PDF

Question 1

You are planning a 10 Gbps link between two CX switches.

Which type of SFP port will be required?

  1. SFP28
  2. SFP+
  3. SFP
  4. QSFP+
Show answer and explanation

Correct answer: B. SFP+

A 10 Gbps link between two CX switches uses SFP+ ports and SFP+ transceivers or DAC cables. SFP+ keeps the small SFP form factor but raises the supported data rate to 10 Gbps, which is why access and aggregation switches use SFP+ uplinks for 10 Gbps connections. The other port types are built for different speeds: SFP for 1 Gbps, SFP28 for 25 Gbps and QSFP+ for 40 Gbps.

Why the other options are wrong

  • A. SFP28 is the 25 Gbps port type, not the standard choice for a 10 Gbps link.
  • C. SFP ports are limited to 1 Gbps.
  • D. QSFP+ is a four-lane 40 Gbps port type.

Question 2

Your customer is concerned about users connecting unmanaged switches to the network and causing outages.

Which CX switch feature should you recommend?

  1. Port security
  2. BPDU Guard
  3. Loop protection
  4. MAC authentication
Show answer and explanation

Correct answer: C. Loop protection

Unmanaged switches do not take part in spanning tree and simply drop or flood BPDUs, so a loop created through one of them is invisible to spanning tree and its protections. Loop protection solves this: the CX switch sends its own loop protection packets on the enabled ports or VLANs, and if a packet returns to the same switch a loop exists, so the transmitting port is disabled by default. This makes loop protection the feature to recommend when users may plug unmanaged switches into edge ports and cause outages.

Why the other options are wrong

  • A. Port security limits learned MAC addresses but does not detect loops.
  • B. BPDU Guard only reacts to received BPDUs, which unmanaged switches do not send.
  • D. MAC authentication controls access per device but does not stop a loop through an unmanaged switch.

Question 3

You have added a switch with existing configuration to an existing group in HPE Aruba Networking Central but the configuration is not synchronizing.

What could cause this?

  1. The switch is configured in a VSX pair, which HPE Aruba Networking Central does not support.
  2. Only switches with factory default config can be added to a group with existing config.
  3. Configuration auto-commit has been disabled for the group in HPE Aruba Networking Central.
  4. The switch is still pending authorization on the organization settings page.
Show answer and explanation

Correct answer: B. Only switches with factory default config can be added to a group with existing config.

When a switch already carrying its own configuration is added to a group in HPE Aruba Networking Central that also has a configuration, the two configurations conflict and the group configuration does not synchronize to the switch. Central expects a switch joining a configured group to start from factory default settings so that the group configuration can be applied cleanly. Resetting the switch to factory defaults, or creating a new group from the switch configuration, resolves the issue.

Why the other options are wrong

  • A. Central supports managing switches configured as a VSX pair.
  • C. Auto-commit affects when changes are committed, not whether a configured switch can join the group.
  • D. A switch pending authorization would not be shown in the group at all.

Question 4

You are reviewing the configuration of a VSX lag and have noticed the command lacp fallback.

Why might this have been configured?

  1. To allow operation with active or passive LACP.
  2. To support devices that require PXE Boot.
  3. For backwards compatibility with LACP v1.
  4. For operation using a single partner LACP interface.
Show answer and explanation

Correct answer: B. To support devices that require PXE Boot.

LACP fallback allows a LAG member port to come up and forward traffic as an individual port when the connected device is not sending LACPDUs. This is typical for servers that boot from the network with PXE: during the boot phase the NIC has no LACP running, so without fallback the LAG ports would stay down and the server could not reach the PXE and DHCP servers. Once the operating system starts LACP, the ports join the LAG normally.

Why the other options are wrong

  • A. Active and passive modes work together without any fallback setting.
  • C. There is no LACP v1 compatibility mode tied to this command.
  • D. A single partner interface works in a normal LAG; fallback is about a partner sending no LACPDUs.

Question 5

From which sources can you download NAE agent scripts directly from the CX switch UI?

  1. HPE Networking Support Portal
  2. Aruba Solutions Exchange
  3. Airheads Community
  4. GitHub Community
Show answer and explanation

Correct answer: B. Aruba Solutions Exchange

The CX switch web UI can browse and download Network Analytics Engine scripts directly from the Aruba Solutions Exchange (ASE). ASE hosts scripts written by Aruba engineers and partners, and from the NAE page of the switch UI an administrator can pick a script, download it to the switch and create agents from it. Scripts obtained elsewhere must be uploaded to the switch manually.

Why the other options are wrong

  • A. The support portal is used for software images and support cases, not for NAE script downloads from the UI.
  • C. Airheads is a discussion site and is not linked into the switch UI as a script repository.
  • D. GitHub is not a download location built into the CX switch UI.

Question 6

An HPE Aruba Networking CX switch is managed in HPE Aruba Networking Central. If you need to validate configuration changes in the switch’s Global view, what information can you get using the Audit trail?

  1. The configuration changes history is up to 7 years.
  2. The configuration difference that was pushed to the device.
  3. The method used to create the configuration (template, multi-edit, or GUI).
  4. The username of the person who pushed the configuration.
Show answer and explanation

Correct answer: C. The method used to create the configuration (template, multi-edit, or GUI).

The audit trail in HPE Aruba Networking Central records configuration activity for the account, including which method created each configuration change, such as a template, MultiEdit or the guided UI. When validating changes for a switch from the Global view, this tells the administrator how the configuration reached the device, which is useful when template and UI changes are mixed in the same environment.

Why the other options are wrong

  • A. The audit trail does not keep configuration history for seven years.
  • B. The full configuration difference is viewed in the configuration tools, not in the audit trail.
  • D. The user who made a change is also recorded, but it does not show how the configuration was built, which is what validating the change relies on.

Question 7

You need to configure BGP on an HPE Aruba Networking switch using AS 65010.

What is required when establishing peering with neighboring devices using eBGP AS 65100?

  1. Use of peer AS65001
  2. Use of route-reflector
  3. Use of directly connected peer
  4. Use of address-family ipv4 internal
Show answer and explanation

Correct answer: C. Use of directly connected peer

An eBGP session between AS 65010 and AS 65100 is by default expected to be between directly connected peers. eBGP packets are sent with a TTL of 1, so the neighbor address must be on a directly connected network, typically the point-to-point link between the two routers. Peering with a non-adjacent address would require extra configuration such as multihop.

Why the other options are wrong

  • A. The neighbor must be defined with its real AS, 65100, not 65001.
  • B. Route reflectors are an iBGP feature and play no part in eBGP peering.
  • D. There is no address-family ipv4 internal requirement for eBGP.

Question 8

When combining Strict Priority (SP) with other queuing types, how can you avoid starvation of lower priority queues?

  1. Apply multiple queuing profiles to the same interface.
  2. Configure WFQ DWRR instead of queuing.
  3. Apply shaping to queue 7.
  4. Configure a higher weight for lower priority queues.
Show answer and explanation

Correct answer: C. Apply shaping to queue 7.

A strict priority queue is always served first, so if it carries a lot of traffic the WFQ or DWRR queues below it can be starved. On CX switches the strict priority queue is queue 7, and applying a shaping limit to it caps the bandwidth it can take. Traffic above the limit is held back, and the remaining bandwidth is left for the lower priority queues.

Why the other options are wrong

  • A. Only one queuing profile can be applied to an interface.
  • B. Removing strict priority loses the low-latency treatment the design needs.
  • D. Weights do not limit a strict priority queue, which is always served first.

Question 9

Your customer’s CISO would like to deploy colorless ports across the network.

Which will you need to configure to meet this requirement?

  1. 802.1Q
  2. 802.1X
  3. 802.11X
  4. 802.1AD
Show answer and explanation

Correct answer: B. 802.1X

Colorless ports are access ports with no fixed VLAN or policy: every port is configured the same way, and the role, VLAN and policy are assigned dynamically after the connected device authenticates. This requires 802.1X, together with MAC authentication for devices without a supplicant, so that a RADIUS server such as ClearPass can identify each device and return its role.

Why the other options are wrong

  • A. 802.1Q is VLAN tagging, which does not identify or authorize devices.
  • C. 802.11X is not a standard.
  • D. 802.1ad is provider bridging (Q-in-Q), not port authentication.

Question 10

You are helping another engineer troubleshoot a new downloadable user role configuration between your CX switches and ClearPass.

Which configuration on the switch should you verify?

  1. HTTPS client certificate
  2. REST API credentials
  3. SNMP community string
  4. User-role configuration
Show answer and explanation

Correct answer: D. User-role configuration

With downloadable user roles, ClearPass returns a role name and the switch downloads the full role definition from ClearPass and installs it as a user role. When troubleshooting, the user-role configuration on the switch should be verified: whether the role was downloaded and installed, what VLAN and policy it contains, and whether it is applied to the client session. Checking the role on the switch shows quickly whether the problem is in the download or in the role content.

Why the other options are wrong

  • A. The switch validates the ClearPass server certificate; it does not present an HTTPS client certificate.
  • B. REST API credentials control access to the switch API, not role downloads.
  • C. SNMP settings play no part in downloadable roles.

Question 11

You need to quickly verify whether a server is responding to a connection request from a client device.

What is the best way to capture these packets on a CX switch?

  1. Configure a mirror session using ERSPAN to a computer running Wireshark.
  2. Configure a mirror session with another port on the switch as the destination.
  3. Inspect the summary of the packets in real time on the switch using tcpdump.
  4. Configure a mirror session to the CPU, use tshark to capture to a PCAP file.
Show answer and explanation

Correct answer: B. Configure a mirror session with another port on the switch as the destination.

To see whether a server answers a client connection request, the traffic on the client or server port can be copied with a local mirror session to another port on the same switch, where a laptop running a packet analyzer captures it. This is the quickest method because it needs only a mirror session and a free port, with no encapsulation or remote collector, and it shows the full packets in both directions.

Why the other options are wrong

  • A. ERSPAN to a remote host adds tunnel setup and is not the quickest local option.
  • C. Packets switched in hardware are not visible to an on-box tcpdump.
  • D. Mirroring to the CPU is rate limited and needs extra steps compared with a local port mirror.

Question 12

A customer would like to use HPE Aruba Networking Central to monitor and configure switch backups, but does not want to be able to make configuration changes.

What can you tell them?

  1. This can be done with the ‘read-only’ device attribute.
  2. This is possible for AOS-S switches but not AOS-CX switches.
  3. This is possible for AOS-CX switches but not AOS-S switches.
  4. This can be done with the ‘Monitoring only’ group option.
Show answer and explanation

Correct answer: D. This can be done with the ‘Monitoring only’ group option.

HPE Aruba Networking Central groups can be set as monitor-only for switches. Switches in such a group are monitored and their configurations are backed up, but Central does not push configuration to them, so changes cannot be made from Central. This matches a customer who wants visibility and configuration backups without configuration management.

Why the other options are wrong

  • A. There is no read-only device attribute for this purpose.
  • B. Monitor-only group behavior is not limited to AOS-S switches.
  • C. Monitor-only group behavior is not limited to AOS-CX switches.

Question 13

You are remotely connected to an HPE Aruba Networking CX 6200M switch using SSH to change the Control Plane ACL, allowing only defined subnets to access the switch with the assistance of the checkpoint auto 10 command. Later in the day, you are testing if the control-plane ACL is working, and you notice that access is allowed from all networks.

What needs to be done with the checkpoint feature to have the change remain without rolling back?

  1. Use the checkpoint commit command before you commit the change.
  2. Use the checkpoint commit after you commit the change.
  3. Use the checkpoint auto command after you commit the change.
  4. Use the checkpoint auto command before you commit the change.
Show answer and explanation

Correct answer: C. Use the checkpoint auto command after you commit the change.

The checkpoint auto 10 command starts auto checkpoint mode with a 10-minute window. If the change is not confirmed within that time, the switch restores the previous configuration, which is why the control plane ACL disappeared and access was allowed from all networks again. To keep a tested change, the checkpoint auto confirm command must be entered after the change is made and verified, which saves the running configuration and ends auto checkpoint mode.

Why the other options are wrong

  • A. There is no checkpoint commit command, and confirmation comes after the change, not before.
  • B. AOS-CX has no checkpoint commit command; the change is kept with checkpoint auto confirm.
  • D. Entering checkpoint auto before the change only starts the timer that causes the rollback.

Question 14

You want to upgrade a re-provisioned Mobility Gateway that is currently using LACP.

What feature will allow you to do this without removing interfaces from LAG?

  1. LACP fallback
  2. LACP active
  3. LACP passive
  4. LACP static
Show answer and explanation

Correct answer: A. LACP fallback

During an upgrade or re-provisioning, the Mobility Gateway may stop running LACP while it boots, so its ports send no LACPDUs. With LACP fallback configured on the switch LAG, a member port that receives no LACPDUs can still come up as an individual port and forward traffic. The gateway therefore stays reachable during the upgrade, and the interfaces never have to be removed from the LAG; once LACP returns, the ports rejoin the aggregation.

Why the other options are wrong

  • B. Active mode still requires LACPDUs from the partner before ports forward.
  • C. Passive mode waits for the partner to start LACP and does not help when the partner stops.
  • D. A static LAG would require changing the LAG configuration, which the requirement avoids.

Question 15

Which data format do CX switches support for the REST API?

  1. SOAP
  2. XML
  3. YAML
  4. JSON
Show answer and explanation

Correct answer: D. JSON

The AOS-CX REST API exchanges data in JSON. Requests that create or change configuration carry a JSON body, and GET requests return the switch configuration and state as JSON objects, which makes the API easy to use from scripts, automation tools and management platforms. The same JSON structure is used for interfaces, VLANs and other resources.

Why the other options are wrong

  • A. SOAP is a different web service protocol that the CX REST API does not use.
  • B. XML is not the data format of the CX REST API.
  • C. YAML is used by some automation tools but is not the REST API payload format.

Question 16

A customer has connected a server to VLAN 100 on a 6300 switch which is streaming video using multicast group 224.0.0.100. This stream would need to be received by the clients in VLANs 200 and 300, routed on the same CX switch.

What needs to be done to enable the requirement?

  1. The multicast group address needs to be changed to a routable subnet.
  2. The multicast group address needs to be changed to other 224.0.0.x non-overlapping address
  3. The igmp-snooping needs to be enabled on SVIs 100, 200, and 300
  4. The igmp needs to be enabled on the SVIs 100, 200, and 300
Show answer and explanation

Correct answer: A. The multicast group address needs to be changed to a routable subnet.

The group 224.0.0.100 falls in the 224.0.0.0/24 local network control block, which is link-local: packets to these groups are sent with a TTL of 1 and are never routed. The stream can only reach receivers in VLAN 100. For clients in VLANs 200 and 300 to receive it through the routed CX switch, the server must use a routable multicast group address outside 224.0.0.0/24.

Why the other options are wrong

  • B. Any address in 224.0.0.0/24 is link-local and will not be routed.
  • C. IGMP snooping constrains layer 2 flooding but cannot route a link-local group.
  • D. IGMP on the SVIs cannot route a group from the link-local range.

Question 17

Your customer has an existing gateway cluster that they are using to tunnel traffic from APs and would like to configure the same for their CX switches.

Which tunnelling option should you recommend?

  1. UBT
  2. GRE
  3. IPSec
  4. VNBT
Show answer and explanation

Correct answer: A. UBT

User-based tunneling lets CX switches tunnel wired user traffic to the same gateway cluster that already terminates AP tunnels. Traffic from authenticated users is sent over GRE to the gateway cluster based on the user role, so wired and wireless users get the same centralized policy, firewalling and segmentation. Because the customer already has a gateway cluster for APs, UBT is the option to recommend.

Why the other options are wrong

  • B. Plain GRE tunnels are not the integrated per-user tunneling feature used with gateway clusters.
  • C. IPsec is used for site-to-site VPNs, not for tunneling wired users to a gateway cluster.
  • D. VNBT is a VLAN-based tunneling mode, not the per-user feature the requirement describes.

That was 17 of 168.

The full HPE HPE7-A08 Network Switching Professional pack has all 168 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 83 free as one PDF by email. Get the Half Pack →