View Full HP HPE6-A85 Exam Dumps and Practice Test Dumps.

Question 221. What does an ACL control?

1. AP transmit power
2. PoE allocation
3. Traffic matching and filtering
4. Firmware versions

Correct Answer: 3. Traffic matching and filtering

Explanation:

An Access Control List contains ordered rules that classify traffic according to fields such as source address, destination address, protocol, or port number. Each Access Control Entry can then permit or deny matching traffic. AOS-CX supports IPv4, IPv6, and MAC ACLs, and ACLs can be applied to interfaces, VLANs, routed interfaces, and supported control-plane contexts. ACLs are therefore useful for restricting unwanted communication or allowing only specific services. They do not manage AP radio power, switch PoE budgets, or firmware versions.

Question 222. What is an ACE?

1. One ACL rule
2. A VLAN interface
3. A RADIUS server
4. A VSF member

Correct Answer: 1. One ACL rule

Explanation:

An Access Control Entry (ACE) is an individual rule inside an ACL. Each ACE contains matching conditions and an action, commonly permit or deny. For example, an ACE might permit TCP traffic from one subnet to a specific destination port. ACLs normally contain several ACEs arranged in sequence so more-specific rules can be evaluated before broader rules. Proper ACE order is important because traffic is processed according to the ACL rule sequence. An ACE is therefore a security-policy element, not a VLAN interface, authentication server, or VSF stack member.

Question 223. What occurs after the final ACL rule?

1. Permit all traffic
2. Restart the ACL
3. Send traffic to RADIUS
4. Implicit deny

Correct Answer: 4. Implicit deny

Explanation:

AOS-CX ACL processing includes an implicit deny after the explicitly configured rules. Traffic that reaches the end of the ACL without matching a permit entry is denied. HPE command output explicitly displays an implicit deny any any any entry in ACL statistics. Because of this behavior, administrators often add an explicit final permit rule when the goal is to block only selected traffic while allowing everything else. Forgetting the implicit deny can unintentionally interrupt legitimate connectivity after an ACL is applied.

Question 224. What do ACL hit counts show?

1. Firmware downloads
2. Rule match statistics
3. PoE consumption
4. AP client count

Correct Answer: 2. Rule match statistics

Explanation:

ACL hit counts show how many packets have matched specific ACL entries that have counting enabled. This is valuable during troubleshooting because an administrator can determine whether traffic is reaching the intended rule. If a permit or deny ACE has zero hits when traffic should match it, the problem may involve rule order, addressing, protocol selection, or the ACL application point. AOS-CX provides commands to display ACL hit counts, including for control-plane ACLs. Hit counts monitor rule usage; they do not report firmware, PoE, or wireless client statistics.

Question 225. What can a MAC ACL match?

1. Ethernet MAC information
2. OSPF cost
3. WLAN channel
4. NTP stratum

Correct Answer: 1. Ethernet MAC information

Explanation:

A MAC ACL operates at Layer 2 and can match Ethernet-related fields such as source MAC address, destination MAC address, and EtherType. AOS-CX supports MAC ACL rules alongside IPv4 and IPv6 ACLs. MAC ACLs can be useful when policy needs to identify devices or Layer 2 traffic before relying on IP addressing. An IPv4 or IPv6 ACL is more appropriate when filtering based on network-layer addresses and transport ports. MAC ACLs have no direct role in OSPF path cost, WLAN channel selection, or NTP synchronization.

Question 226. What does a port-access role define?

1. Switch firmware
2. STP root
3. VSF priority
4. Client network privileges

Correct Answer: 4. Client network privileges

Explanation:

A port-access role defines the permissions and network treatment assigned to a connected client. HPE examples include Employee, Contractor, and Guest roles with different levels of access. A role can contain parameters such as ingress policy, VLAN assignment, inactivity timeout, reauthentication behavior, and bandwidth-related settings depending on the platform and configuration. Roles are applied to authenticated and unauthenticated clients as appropriate. They therefore provide identity-aware network authorization and are unrelated to switch firmware versions, spanning-tree root selection, or VSF election priority.

Question 227. Which role fits limited external access?

1. Administrator
2. Contractor
3. Conductor
4. Root

Correct Answer: 2. Contractor

Explanation:

A Contractor role is a common example of a role that provides more restricted network access than a full Employee role. HPE’s port-access documentation specifically uses Employee, Contractor, and Guest as examples of roles with different privileges. A contractor might receive access to selected business applications while being denied sensitive internal infrastructure. Role-based access makes policy easier to maintain because permissions follow the assigned role rather than relying solely on physical port configuration. Administrator, Conductor, and Root describe different management or networking concepts rather than ordinary client authorization roles.

Question 228. Which command shows active port-access clients?

1. show vlan
2. show spanning-tree
3. show port-access clients
4. show ntp

Correct Answer: 3. show port-access clients

Explanation:

The show port-access clients command family displays information about clients currently onboarded through port-access mechanisms. HPE provides a detailed form that can show information such as the client’s MAC address, authentication method, assigned role, VLAN association, and other status details. Administrators can also filter output by interface, MAC address, authentication method, or role. This makes the command useful when troubleshooting client authentication or authorization. The other listed commands focus on VLANs, spanning tree, or time synchronization rather than port-access client state.

Question 229. What does CoPP protect?

1. The device control plane
2. WLAN passwords
3. PoE devices
4. VLAN databases

Correct Answer: 4. The device control plane

Explanation:

Control Plane Policing protects switch CPU and control-plane resources from excessive traffic. Certain packets must be sent to the processor for protocol handling or management. If too many such packets arrive, they can consume CPU resources and affect important networking functions. CoPP classifies control-plane traffic and can apply rate limits, priorities, or drop behavior to selected classes. AOS-CX includes a predefined default CoPP policy at first startup. CoPP is therefore designed to protect processor resources rather than WLAN passwords, PoE endpoints, or VLAN databases.

Question 230. What can a CoPP class set?

1. RF power
2. Rate and priority
3. Client VLAN only
4. Firmware image

Correct Answer: 1. Rate and priority

Explanation:

A CoPP class can define treatment for a particular category of traffic destined to the switch processor. HPE documents options including priority, maximum rate, burst size, or explicit drop behavior. For example, LACP control traffic can be assigned a defined priority and rate. This allows important protocol traffic to receive suitable processor treatment while excessive unwanted traffic is constrained. CoPP settings operate on control-plane traffic and are not used to configure AP radio power, client VLAN assignment, or system software images.

Question 231. What is the default CoPP policy called?

1. standard
2. factory
3. default
4. protect

Correct Answer: 3. default

Explanation:

AOS-CX includes a predefined CoPP policy named default. HPE states that this policy contains factory-defined classes and is applied when the switch first starts. The default policy cannot simply be deleted, although its configuration can be changed or restored to factory settings using the supported commands. Administrators can also create custom CoPP policies where required. Having a default protection policy ensures that the switch control plane receives basic traffic-management protection even before an administrator creates a custom policy.

Question 232. What does a dynamic MAC entry represent?

1. A manually fixed MAC
2. A learned MAC-to-port mapping
3. A RADIUS role
4. An AP radio

Correct Answer: 2. A learned MAC-to-port mapping

Explanation:

A switch learns source MAC addresses from incoming Ethernet frames and records the associated VLAN and interface in its MAC address table. These automatically learned records are dynamic MAC entries. The switch then uses them to forward known unicast frames toward the correct port instead of flooding them. HPE’s show mac-address-table output identifies learned entries as dynamic and shows the MAC address, VLAN, type, and port. Dynamic entries can age out after a period of inactivity.

Question 233. What is MAC aging used for?

1. Remove stale dynamic MAC entries
2. Increase PoE wattage
3. Change VSX roles
4. Renew certificates

Correct Answer: 1. Remove stale dynamic MAC entries

Explanation:

Dynamic MAC entries should not remain indefinitely when an endpoint moves or disconnects. MAC aging removes learned entries that have not been refreshed within the configured aging interval. HPE’s AOS-CX MAC table output displays the current MAC age time, with documentation examples showing 300 seconds. Aging allows the forwarding database to adapt as hosts move between switch ports. Static MAC entries are handled differently because they are manually configured and do not depend on normal dynamic learning. MAC aging has no relation to PoE, VSX roles, or certificates.

Question 234. What is a static MAC entry?

1. Automatically aged entry
2. DHCP-learned entry
3. Wireless-only entry
4. Manually configured MAC mapping

Correct Answer: 4. Manually configured MAC mapping

Explanation:

A static MAC entry is manually configured to associate a particular MAC address with a VLAN and forwarding interface. Unlike a normal dynamic MAC entry, it is not learned automatically from incoming traffic and is not removed through ordinary dynamic aging behavior. Static entries can be useful when a specific endpoint must always be associated with a known forwarding location or where dynamic learning is not desired. Administrators should use static entries carefully because an incorrect mapping can direct traffic to the wrong interface after a device moves physically.

Question 235. Which table is used for Layer 2 unicast forwarding?

1. ARP only
2. MAC address table
3. Routing table only
4. NTP table

Correct Answer: 2. MAC address table

Explanation:

Ethernet switches use the MAC address table to decide where known unicast frames should be forwarded. The switch learns source MAC addresses and records which interfaces are associated with them. When a frame arrives, the destination MAC address is compared with this table. If a matching entry exists, the frame is sent toward the associated interface. If the destination is unknown, the switch may flood the frame within the relevant VLAN. The IP routing table performs Layer 3 forwarding and therefore serves a different purpose.

Question 236. What happens to an unknown unicast frame?

1. It is routed by OSPF
2. It is always dropped
3. It is flooded within the VLAN
4. It is sent to RADIUS

Correct Answer: 3. It is flooded within the VLAN

Explanation:

When a switch receives a unicast Ethernet frame whose destination MAC address is not present in the forwarding table, it cannot identify one specific outgoing port. The normal Layer 2 behavior is therefore to flood the frame out eligible ports in the same VLAN, except the port on which it arrived and any ports blocked by applicable policy. Once the destination sends traffic, the switch can learn its source MAC address and future frames can be forwarded directly. This learning-and-flooding behavior is fundamental to Ethernet switching.

Question 237. What does a control-plane ACL protect?

1. Traffic destined to the switch CPU
2. PoE endpoints
3. AP channels
4. VSF cabling

Correct Answer: 4. Traffic destined to the switch CPU

Explanation:

A control-plane ACL filters traffic directed toward the switch’s own control and management plane rather than ordinary transit traffic passing through the device. It can help restrict which sources are allowed to access specific IP services or protocol traffic on the switch. AOS-CX supports applying IPv4 or IPv6 ACLs to the control plane on supported VRFs and provides dedicated commands for displaying control-plane ACL hit counts. This differs from an interface data-plane ACL, which filters forwarded user traffic.

Question 238. What does TCAM store for access policy?

1. Firmware files
2. Hardware match/action entries
3. NTP history
4. AP licenses only

Correct Answer: 2. Hardware match/action entries

Explanation:

Ternary Content-Addressable Memory is specialized hardware used to perform very fast matching for functions such as ACLs, policies, and active port-access roles. HPE notes that active user roles are created only when sufficient TCAM resources are available. Because TCAM capacity is finite, overly complex or excessive policy configuration can consume available hardware resources. This is one reason administrators should avoid unnecessary duplicate rules and design policies efficiently. TCAM is optimized for rapid packet classification rather than storing firmware files, time history, or licensing information.

Question 239. What can port-access roles assign?

1. VLAN and policy settings
2. Switch serial number
3. Firmware partition
4. VSF member ID

Correct Answer: 1. VLAN and policy settings

Explanation:

Port-access roles can define network privileges for connected clients and may include settings such as VLAN assignment, ingress policy, reauthentication behavior, inactivity timeout, or bandwidth-related controls depending on platform support. This allows users with different identities to receive different network access even when they connect through the same physical switch infrastructure. For example, an employee may receive broader access than a contractor or guest. The role affects the client session rather than hardware identity or firmware-management parameters.

Question 240. Which design BEST protects access traffic?

1. Permit all traffic
2. Disable authentication
3. Use ACLs, port-access roles, and CoPP
4. Remove MAC learning

Correct Answer: 3. Use ACLs, port-access roles, and CoPP

Explanation:

These controls protect different parts of the switch. ACLs filter traffic according to defined Layer 2, IPv4, or IPv6 criteria. Port-access roles provide identity-aware authorization for connected clients, allowing employees, contractors, and guests to receive different permissions. CoPP protects the device’s control plane by limiting or prioritizing traffic sent to the processor. Combining these functions provides stronger layered security than relying on one mechanism alone. Disabling authentication or permitting all traffic weakens access control, while disabling MAC learning would interfere with ordinary Layer 2 switching rather than provide a complete security design.