View Full HP HPE6-A85 Exam Dumps and Practice Test Dumps.

Question 341. What does port security control?

1. OSPF routes
2. Authorized MAC addresses
3. AP channels
4. NTP servers

Correct Answer: 2. Authorized MAC addresses

Explanation:

Port security controls which endpoint MAC addresses are authorized to communicate through a switch port. AOS-CX can use static, dynamically learned, or sticky MAC addresses depending on configuration. When unauthorized devices attempt to use a protected interface, the switch can detect, prevent, and log the activity. This makes port security useful on access ports where administrators know which endpoints should normally be connected. It does not protect routing protocols, WLAN radio channels, or time synchronization.

Question 342. What is the default port-security learning mode?

1. Sticky only
2. Static only
3. Disabled permanently
4. Dynamic

Correct Answer: 4. Dynamic

Explanation:

HPE documents the default port-security behavior as dynamic mode, in which the switch learns MAC addresses from inbound traffic from connected devices. Administrators can later restrict the port by configuring static authorized MAC addresses, a client limit, or sticky learning. Dynamic learning is convenient initially because the switch does not require every endpoint MAC address to be entered manually. However, stronger restrictions may be appropriate on sensitive access ports where only known devices should be permitted.

Question 343. What does sticky learning do?

1. Retains learned MAC addresses
2. Deletes all MAC addresses
3. Disables port security
4. Enables LACP

Correct Answer: 1. Retains learned MAC addresses

Explanation:

Sticky learning converts existing and newly learned non-static MAC addresses into sticky MAC entries on a protected port. HPE states that sticky authorized clients can remain recognized through events such as switch reboots or link flaps after being learned. This allows administrators to learn legitimate endpoints dynamically and then retain those bindings without manually entering every MAC address. If sticky learning is later disabled, the sticky entries become dynamic clients again. Sticky learning is therefore a port-security persistence feature, not an LACP or VLAN mechanism.

Question 344. What happens if a sticky MAC moves ports?

1. Nothing
2. It becomes a route
3. A violation occurs
4. It becomes multicast

Correct Answer: 3. A violation occurs

Explanation:

A sticky MAC is associated with the port on which it was learned or configured. HPE documents that moving a sticky MAC client from one port to another is treated as a security violation. The switch can record the event, and administrators can display sticky-MAC move violations with the appropriate port-security diagnostic command. This helps prevent an authorized device identity from being moved to another access port without detection and can reduce the risk of station movement or MAC hijacking.

Question 345. What does client-limit set?

1. Maximum VLANs
2. Maximum routes
3. Maximum LAG members
4. Maximum clients on a port

Correct Answer: 4. Maximum clients on a port

Explanation:

The port-security client-limit setting defines the maximum number of clients that may be authorized or learned on a protected interface. HPE documents a default value of one client, with supported maximum values depending on the switch platform. Client MAC addresses can be entered statically, learned dynamically, or managed using a combination of both. If the configured limit is exceeded, the switch can trigger the configured security-violation behavior. This is useful on ports where only a known number of endpoints should be connected.

Question 346. What is the default violation action?

1. Notify
2. Reboot
3. Shutdown
4. Ignore

Correct Answer: 1. Notify

Explanation:

HPE documents notify as the default action when a port-access security violation occurs. In this mode, the switch records the violation as an event or syslog message and can also send an SNMP trap notification. The port itself is not automatically shut down simply because the default notify action is used. Administrators who want a stronger enforcement response can configure the shutdown action instead. Choosing between notification and shutdown depends on the security requirement and the acceptable operational impact of disabling a production access port.

Question 347. What does violation action shutdown do?

1. Sends only a log
2. Shuts the affected port
3. Deletes the VLAN
4. Reboots the switch

Correct Answer: 2. Shuts the affected port

Explanation:

When the security-violation action is configured as shutdown, AOS-CX shuts down the affected port after the relevant violation occurs, such as exceeding the configured client limit. This is a more disruptive but stronger security response than the default notify action. HPE also supports optional automatic recovery so a port disabled by a security violation can later return to service after the configured recovery period. Administrators should use shutdown carefully because it can interrupt legitimate users if client limits or policy are configured incorrectly.

Question 348. What does shutdown auto-recovery provide?

1. New firmware
2. VLAN recovery
3. Automatic port restoration
4. AP failover

Correct Answer: 3. Automatic port restoration

Explanation:

Automatic recovery allows an interface that was shut down by a port-access security violation to return to service after a defined recovery period. Without auto-recovery, an administrator may need to intervene manually before normal operation resumes. HPE provides commands for enabling shutdown auto-recovery and defining the associated recovery timer. This feature balances enforcement and availability: a violation can immediately disable the affected port while still allowing the network to restore service automatically after the configured delay.

Question 349. What does client-status show?

1. Authorized port-security clients
2. OSPF neighbors
3. PoE budgets
4. NTP peers

Correct Answer: 1. Authorized port-security clients

Explanation:

The port-security client-status display shows authorized clients associated with protected switch ports. HPE output can identify client MAC addresses and whether each client is static, dynamic, sticky-static, or sticky-dynamic. Administrators can filter the output by interface or, on supported platforms, by MAC address. This makes the command useful when troubleshooting why a particular endpoint is permitted or rejected on an access port. It provides port-security information rather than routing, power, or time-synchronization status.

Question 350. What does port-statistics show?

1. OSPF cost
2. RF utilization
3. DHCP options
4. Port-security client counts

Correct Answer: 4. Port-security client counts

Explanation:

The port-security port-statistics command displays client statistics for protected interfaces. HPE examples include the number of authorized clients and the number of sticky authorized clients associated with each port. Administrators can display statistics for all interfaces or filter the output to a specific port. These statistics help verify whether the expected number of devices has been authorized and whether sticky learning is operating as intended. The command is specifically focused on port-security state rather than WLAN, routing, or DHCP configuration.

Question 351. What does MAC Lockdown do?

1. Enables DHCP relay
2. Increases MTU
3. Binds a MAC to a port
4. Creates a VRF

Correct Answer: 3. Binds a MAC to a port

Explanation:

MAC Lockdown, also called Static Addressing, prevents a station from moving freely between switch ports by allowing the configured MAC address to use only its assigned interface. HPE also notes that MAC Lockdown restricts the device to a specific VLAN. This helps protect against station movement and certain MAC hijacking scenarios. MAC Lockdown is more restrictive than ordinary dynamic learning and should therefore be used where endpoint placement is expected to remain stable. It is unrelated to DHCP relay, interface MTU, or VRF configuration.

Question 352. Which has higher priority?

1. Dynamic learning
2. MAC Lockdown
3. LLDP
4. DHCP snooping

Correct Answer: 2. MAC Lockdown

Explanation:

HPE explicitly states that MAC Lockdown has higher priority than port security. MAC Lockdown creates a strong static association between a device MAC address, its allowed switch port, and its VLAN. If overlapping access controls exist, administrators should understand this priority because it affects which mechanism governs the endpoint. The feature is useful where station movement must be prevented. Dynamic MAC learning and DHCP snooping serve different purposes and do not supersede the configured MAC Lockdown relationship.

Question 353. What does port security NOT block by itself?

1. Static clients
2. Sticky clients
3. Unauthorized unicast
4. Received broadcast and multicast

Correct Answer: 4. Received broadcast and multicast

Explanation:

HPE documents an important limitation: port security does not prevent an intruder from receiving broadcast and multicast traffic. Port security primarily restricts whether unauthorized source MAC addresses can communicate through the switch port. Broadcast and multicast frames may still be received because those traffic types are distributed differently from known unicast traffic. Additional segmentation and access controls may therefore be required when protecting sensitive information from unauthorized endpoints. Port security should be viewed as one security layer rather than a complete endpoint-isolation mechanism.

Question 354. Can MAC authentication and port security share one port?

1. Always
2. No, they are mutually exclusive
3. Only with OSPF
4. Only on trunks

Correct Answer: 2. No, they are mutually exclusive

Explanation:

HPE documents that MAC authentication and port security are mutually exclusive on a given port on the applicable AOS-CX platforms. MAC authentication uses the client MAC address as an identity input for RADIUS-based authentication, while port security maintains its own authorized MAC behavior. Because these functions overlap in endpoint admission control, administrators should select the appropriate mechanism instead of attempting to enable both simultaneously on the same port. The same documentation also notes other feature interactions that should be reviewed before configuring port access.

Question 355. What does LACP fallback-static allow?

1. One member to forward without an LACP partner
2. All members to forward independently
3. Automatic VSF creation
4. VLAN deletion

Correct Answer: 1. One member to forward without an LACP partner

Explanation:

LACP fallback-static provides temporary connectivity when an LACP-enabled LAG does not detect an LACP partner. HPE documents that one member interface is selected to remain up and forward traffic, while the other members remain in an LACP-blocked state. This can be useful during server boot or provisioning when the remote endpoint is not yet running LACP. Allowing multiple independent links to forward would create risks such as loops and MAC-learning problems, so fallback intentionally permits only one active member.

Question 356. Without LACP fallback, what happens with no partner?

1. All members forward
2. One random VLAN forwards
3. The LAG blocks
4. The switch reboots

Correct Answer: 3. The LAG blocks

Explanation:

HPE states that when LACP fallback-static is not enabled and no LACP partner is detected, the LAG enters a BLOCK state. This prevents traffic from being forwarded incorrectly over links that have not successfully negotiated an aggregation relationship. Enabling fallback-static changes that behavior by allowing exactly one physical member to forward temporarily. Administrators should use fallback only where required and should still expect normal LACP negotiation to take over when the peer begins participating correctly.

Question 357. What does broadcast rate limiting control?

1. Egress routing
2. Ingress broadcast traffic
3. AP association
4. NTP polling

Correct Answer: 2. Ingress broadcast traffic

Explanation:

The AOS-CX rate-limit broadcast function limits the amount of broadcast traffic entering an Ethernet interface. This can help reduce the effect of broadcast storms or abnormal endpoint behavior that could otherwise consume excessive bandwidth and processing resources. HPE also provides rate limiting for traffic categories such as multicast, unknown unicast, and ICMP on supported platforms. Rate limiting should be configured carefully because thresholds that are too low can discard legitimate traffic needed for normal network operation.

Question 358. Which rate-limit units are supported?

1. Mbps only
2. Frames only
3. Seconds only
4. kbps, percent, or pps

Correct Answer: 4. kbps, percent, or pps

Explanation:

HPE documents several supported ways to express AOS-CX interface rate limits: kilobits per second (kbps), percentage of link bandwidth, or packets per second (pps). This provides flexibility when configuring traffic controls. A fixed kbps rate may be useful when a precise bandwidth limit is required, percent scales relative to interface speed, and pps can be useful for traffic types where packet rate is the concern. The actual applied rate can be inspected with interface QoS commands on supported switches.

Question 359. How is a LAG rate limit applied?

1. Once to the whole LAG
2. Only to the first link
3. Separately to each member
4. Only when LACP fails

Correct Answer: 3. Separately to each member

Explanation:

HPE documents that applicable ingress rate limits on a LAG are enforced separately on each individual member interface, rather than as one aggregate limit across the entire logical LAG. This distinction matters when calculating how much traffic can enter a bundle. For example, a rate applied to a LAG with several active physical members can effectively be enforced independently on each link. Administrators should account for this behavior when designing broadcast, multicast, unknown-unicast, or ICMP protection policies.

Question 360. Which design BEST protects an access port?

1. Port security, sticky MAC, limits, and violation actions
2. Disable all security
3. Allow unlimited clients
4. Trust every MAC dynamically

Correct Answer: 1. Port security, sticky MAC, limits, and violation actions

Explanation:

A well-protected access port can combine several AOS-CX controls. Port security restricts authorized endpoint MAC addresses. Sticky learning can retain legitimate dynamically learned clients. A client limit prevents an unexpected number of devices from using the port, while violation actions determine whether unauthorized behavior generates notifications or shuts the interface down. Traffic rate limiting can provide an additional layer against excessive broadcast or similar traffic where appropriate. Together, these controls offer stronger endpoint protection than unlimited dynamic learning with no enforcement or monitoring.