View Full HP HPE6-A85 Exam Dumps and Practice Test Dumps.

Question 161. What does AAA provide?

1. VLAN tagging
2. Route aggregation
3. Authentication, authorization, and accounting
4. RF optimization

Correct Answer: 3. Authentication, authorization, and accounting

Explanation:

AAA is a security framework used to control administrative and network access. Authentication verifies a user’s identity, authorization determines what the authenticated user is allowed to do, and accounting records activity for auditing or operational purposes. AOS-CX supports both local AAA and remote AAA through services such as RADIUS and TACACS+. Centralized AAA is particularly useful when many switches must follow consistent administrator-access policies. It is unrelated to VLAN tagging, route aggregation, or wireless RF optimization.

Question 162. What does a remote AAA sequence define?

1. The order of authentication methods or server groups
2. VLAN forwarding order
3. STP root order
4. PoE allocation order

Correct Answer: 1. The order of authentication methods or server groups

Explanation:

AOS-CX allows administrators to define an authentication sequence for different management connection types. For example, SSH authentication can reference one or more TACACS+ or RADIUS server groups and then use local authentication as a fallback where configured. Server groups are contacted according to the order defined in the AAA configuration. This allows an organization to prefer centralized authentication while retaining controlled backup access when remote servers are unavailable. The sequence controls management authentication, not VLAN forwarding, spanning-tree decisions, or PoE allocation.

Question 163. What is a key TACACS+ benefit?

1. RF channel selection
2. DHCP assignment
3. MAC learning
4. Fine-grained command authorization

Correct Answer: 4. Fine-grained command authorization

Explanation:

TACACS+ is commonly selected for network-device administration because it supports centralized authentication and detailed authorization. A major advantage is the ability to control which administrative commands or privilege levels a user is permitted to access. AOS-CX also supports TACACS+ accounting, allowing administrative activity to be recorded centrally. This makes TACACS+ particularly useful for switches and routers where organizations need separation between operators, administrators, auditors, or custom roles. It is unrelated to wireless channel selection, DHCP address assignment, or ordinary Layer 2 MAC learning.

Question 164. What is RADIUS commonly used for?

1. VSF links
2. Centralized authentication
3. STP election
4. PoE negotiation

Correct Answer: 2. Centralized authentication

Explanation:

RADIUS provides centralized authentication, authorization, and accounting services for network access and management use cases. An AOS-CX switch can send authentication requests to configured RADIUS servers rather than relying only on locally stored credentials. Administrators can define RADIUS groups and specify authentication sequences for different management connection types. Centralized authentication improves consistency because identities and policies can be maintained centrally instead of separately on every switch. RADIUS is not used to build VSF links, elect spanning-tree roots, or negotiate PoE power delivery.

Question 165. Why configure local AAA fallback?

1. To increase VLAN capacity
2. To disable remote authentication
3. To change switch firmware
4. To retain access if remote AAA is unavailable

Correct Answer: 4. To retain access if remote AAA is unavailable

Explanation:

A local authentication method can be placed after remote AAA server groups so administrators still have a controlled method of accessing the switch if remote AAA servers become unreachable. AOS-CX authentication sequences can include RADIUS or TACACS+ groups followed by local authentication. This provides operational resilience during AAA-server or network failures. The fallback should be protected with strong credentials because it represents an alternate administrative path. Local fallback does not disable remote authentication; it is simply another method attempted according to the configured authentication sequence.

Question 166. What does minimum password length improve?

1. Local password security
2. LACP speed
3. VLAN throughput
4. OSPF convergence

Correct Answer: 1. Local password security

Explanation:

AOS-CX supports enforcing a minimum password length for local password-based authentication. Requiring longer passwords reduces the likelihood that administrators choose extremely short credentials that are easier to guess or brute-force. Password-length controls are one element of a broader management security policy that can also include login-attempt limits, SSH public-key authentication, remote AAA, and user-role authorization. Changing password requirements has no direct effect on LACP performance, VLAN throughput, or OSPF convergence because those features belong to different network functions.

Question 167. What does login-attempt limiting help prevent?

1. VLAN hopping only
2. RF interference
3. Repeated password-guessing attempts
4. DHCP relay

Correct Answer: 3. Repeated password-guessing attempts

Explanation:

Login-attempt limiting protects local administrative accounts against repeated password-guessing attacks. AOS-CX can limit the number of failed authentication attempts and apply a lockout period after the configured threshold is reached. This slows brute-force attempts and provides additional protection when local password authentication is enabled. The feature belongs to management-plane security rather than Layer 2 switching or wireless operation. Administrators should combine it with strong passwords, remote AAA where appropriate, and secure protocols such as SSH or HTTPS to improve overall device-management security.

Question 168. What is an SSH public key used for?

1. VLAN assignment
2. Passwordless cryptographic user authentication
3. DHCP allocation
4. PoE classification

Correct Answer: 2. Passwordless cryptographic user authentication

Explanation:

AOS-CX supports SSH public-key authentication for local management users. The administrator stores the authorized public key on the switch, while the corresponding private key remains securely with the user. During SSH authentication, the user proves possession of the private key without transmitting a reusable password. This can provide stronger and more automatable authentication than passwords when keys are managed correctly. AOS-CX also allows password-based SSH authentication to be enabled or disabled independently. SSH public keys are unrelated to VLAN assignment, DHCP address allocation, or PoE classification.

Question 169. Which TACACS+ attribute has role precedence?

1. Aruba-Admin-Role
2. VLAN-ID
3. DSCP
4. NAS-Port

Correct Answer: 1. Aruba-Admin-Role

Explanation:

For TACACS+ user-role assignment on AOS-CX, HPE documents that the Aruba-Admin-Role vendor-specific attribute takes precedence when present. The switch maps the returned value to a matching local user-group name. If Aruba-Admin-Role is not provided, the switch can use the TACACS+ priv-lvl attribute to map the user to a role such as operators, administrators, or auditors. This allows centralized servers to determine the authorization level assigned to remote management users after authentication.

Question 170. TACACS+ privilege level 15 maps to which role?

1. Operators
2. Auditors
3. Guests
4. Administrators

Correct Answer: 4. Administrators

Explanation:

HPE documents standard TACACS+ privilege-level mappings for AOS-CX management users. Privilege level 15 maps to the built-in administrators role. Privilege level 1 maps to operators, while privilege level 19 maps to auditors. User-defined groups can also be used for additional privilege levels where configured. These mappings allow a centralized TACACS+ server to authenticate an administrator and return authorization information that determines the user’s effective permissions on the switch. This separates identity verification from authorization and supports role-based administrative control.

Question 171. What is PKI mainly used for?

1. VLAN creation
2. Digital certificate management
3. RF calibration
4. LACP hashing

Correct Answer: 2. Digital certificate management

Explanation:

Public Key Infrastructure provides mechanisms for creating, enrolling, storing, validating, and using digital certificates. AOS-CX supports PKI for applications that need trusted cryptographic identity. Certificates allow communicating entities to verify one another and establish secure sessions. HPE documentation shows certificate support for functions such as HTTPS services, secure syslog communication, EST enrollment, and other secure applications. PKI does not create VLANs, optimize wireless RF channels, or control LACP traffic distribution. It is a security framework for managing cryptographic trust and identity.

Question 172. What does a Certificate Authority do?

1. Assigns VLANs
2. Provides DHCP addresses
3. Issues and validates digital certificates
4. Elects an STP root

Correct Answer: 3. Issues and validates digital certificates

Explanation:

A Certificate Authority is a trusted entity within a PKI that issues digitally signed certificates after validating the identity associated with a certificate request. Other systems can trust the CA and use its signature to validate certificates presented by devices or users. AOS-CX supports Trust Anchor profiles containing trusted CA certificates so secure applications can validate peers. The CA therefore establishes cryptographic trust between entities. It does not participate in VLAN configuration, DHCP address assignment, or spanning-tree root election.

Question 173. What does EST simplify?

1. Certificate enrollment and renewal
2. VLAN trunking
3. RF scanning
4. OSPF routing

Correct Answer: 4. Certificate enrollment and renewal

Explanation:

Enrollment over Secure Transport, or EST, provides a scalable method for certificate enrollment, re-enrollment, and renewal. HPE describes EST as improving the AOS-CX PKI workflow by simplifying secure certificate provisioning. Instead of relying entirely on manual certificate creation and installation, an EST profile can interact with appropriate certificate infrastructure to manage the certificate lifecycle more efficiently. This is valuable in environments containing many switches that require trusted certificates for secure management applications. EST is unrelated to VLAN trunking, radio scanning, or OSPF routing.

Question 174. What is local-cert on AOS-CX?

1. A VLAN template
2. A default self-signed certificate
3. A RADIUS server
4. A DHCP lease

Correct Answer: 2. A default self-signed certificate

Explanation:

AOS-CX creates a default self-signed certificate named local-cert when the switch first starts. HPE documentation shows that applications can use this certificate when another application-specific certificate has not yet been configured. Self-signed certificates can provide encryption, but they are not automatically trusted by external clients in the same way as certificates issued by a trusted enterprise or public CA. Production environments often replace or supplement the default certificate with trusted certificates to improve identity validation and reduce certificate warnings.

Question 175. What is NTP used for?

1. Switch clock synchronization
2. VLAN routing
3. RF encryption
4. LACP negotiation

Correct Answer: 1. Switch clock synchronization

Explanation:

Network Time Protocol synchronizes the switch clock with one or more time servers. Accurate time is important because logs, security events, AAA accounting records, certificates, and troubleshooting information depend on consistent timestamps. HPE specifically recommends reliable NTP synchronization for security, logging, and system management. Central can configure NTP servers and select the VRF used for those connections. NTP is not a routing, wireless encryption, or link-aggregation protocol; its job is to keep device clocks aligned with reliable time sources.

Question 176. What is an NTP stratum 1 server?

1. A disconnected server
2. A server using only local time
3. A server directly connected to an authoritative time source
4. A DHCP relay

Correct Answer: 3. A server directly connected to an authoritative time source

Explanation:

NTP stratum indicates how far a time server is from the authoritative reference clock. A stratum 1 server is directly connected to a trusted time source such as GPS, an atomic clock, or another authoritative reference. A stratum 2 server receives time from a stratum 1 server, and subsequent levels continue through the hierarchy. Lower valid stratum values generally indicate closer proximity to the primary reference. AOS-CX can select among configured NTP sources and can also mark a preferred server.

Question 177. What does NTP iburst help with?

1. VLAN discovery
2. Faster initial time synchronization
3. RF optimization
4. STP convergence

Correct Answer: 2. Faster initial time synchronization

Explanation:

The NTP iburst option causes the switch to send a short burst of NTP packets when it is not yet synchronized with the server. HPE states that this is useful for reducing synchronization time at startup. Rather than waiting for several normal polling intervals before collecting enough timing information, the switch can obtain several measurements quickly. This can help a newly booted device establish accurate time sooner, which is beneficial for logging and certificate-related operations. The option does not affect VLAN discovery, wireless RF behavior, or spanning-tree convergence.

Question 178. What does DNS provide to a switch?

1. PoE power
2. VLAN tags
3. STP protection
4. Hostname-to-IP resolution

Correct Answer: 4. Hostname-to-IP resolution

Explanation:

Domain Name System allows a switch to resolve human-readable hostnames into IP addresses. This is useful when services such as NTP, management systems, or other infrastructure are referenced by DNS names rather than fixed addresses. HPE Aruba Networking Central allows administrators to configure DNS servers for the selected switch VRF. Proper DNS connectivity can therefore be necessary for some cloud and management operations. DNS does not provide electrical power, VLAN tagging, or spanning-tree protection; it is fundamentally a naming and address-resolution service.

Question 179. What does an IP source-interface setting control?

1. The source interface/address used by selected management services
2. The VLAN’s STP priority
3. AP radio power
4. LACP member order

Correct Answer: 3. The source interface/address used by selected management services

Explanation:

AOS-CX source-interface configuration lets administrators control which interface and therefore which source IP address is used by selected management or service traffic. HPE examples include source-interface settings for DNS, Central, NTP, HTTP, and SSH. This is valuable when a switch has multiple routed interfaces or VRFs and management systems expect traffic to originate from a predictable address. A stable source address can simplify ACLs, monitoring, authentication-server configuration, and troubleshooting. The feature does not change spanning-tree priority, wireless radio power, or LACP member selection.

Question 180. Which design BEST secures switch administration?

1. Central AAA, strong roles, PKI, NTP, and secure management
2. Shared passwords only
3. Unauthenticated Telnet
4. No time synchronization

Correct Answer: 1. Central AAA, strong roles, PKI, NTP, and secure management

Explanation:

A strong management-plane design uses several complementary controls. Remote AAA through RADIUS or TACACS+ centralizes authentication, while role assignment limits each administrator to appropriate privileges. PKI supplies trusted certificates for secure management applications, and accurate NTP ensures reliable timestamps for authentication and accounting records. SSH or HTTPS should be used instead of insecure cleartext management. A local fallback account can also provide controlled recovery access if remote AAA becomes unavailable. This layered design offers stronger identity, authorization, auditing, encryption, and operational resilience than relying on shared local passwords alone.