HPE HPE6-A91: HPE Networking AOS-10 Exam

Last checked November 10, 2026 against the official HPE exam page.

1. Question 1Admin access control and operations

   A service desk team needs to check gateway health and client status, but must not change configuration. Which administrator access setting best fits this requirement?

   1. AOne shared full-access administrator account used by every help desk technician.
   2. BA read-only administrator role that allows monitoring but no configuration changes.
   3. CA wireless client role that is allowed to edit VLAN and firewall settings on the gateway.
   4. DA guest role with captive portal access to the gateway management console.
   Show answer and explanationHide answer

   Correct answer: B

   A read-only administrator role gives the service desk monitoring access without allowing configuration changes, which limits risk. A shared full-access account removes accountability, while guest and client roles are not administrator roles and cannot manage the gateway.

2. Question 2AOS-10 fundamentals

   A campus team deploys AOS-10 access points and gateways. Most WLANs must send client traffic to a gateway so role-based firewall policy applies, but one lab WLAN should forward traffic locally at the access point. Which description explains how AOS-10 supports both behaviours?

   1. AEach access point runs its own independent firewall, so all policy is configured and enforced at the AP level.
   2. BAccess points forward all client traffic locally, and gateways only provide DHCP and DNS services to wireless clients.
   3. CGateways enforce central policy, and each WLAN's forwarding mode decides whether its traffic is tunneled or bridged locally.
   4. DThe gateway receives client traffic only when the access point is placed in a separate management subnet from its wireless clients and servers.
   Show answer and explanationHide answer

   Correct answer: C

   In AOS-10, gateways enforce centralized role-based policy, and the WLAN forwarding mode selects tunneling to the gateway or local bridging at the AP. Option A describes an architecture AOS-10 does not use, option B reverses the roles of AP and gateway, and option D ties tunneling to subnet placement, which is not the control mechanism.

3. Question 3RF design and network deployment

   A dense open-plan office has many access points sharing the same 2.4 GHz channels. Users report slow roaming and high retransmission rates. Which adjustment best reduces co-channel interference?

   1. AIncrease transmit power on every access point so that each radio reaches farther across the floor.
   2. BDisable all 5 GHz radios so that every client is forced onto the 2.4 GHz band.
   3. CAdd a second access point on each channel to double the number of clients served by each radio.
   4. DReduce transmit power and use 20 MHz channels so that each access point covers a smaller cell area.
   Show answer and explanationHide answer

   Correct answer: D

   Lower power and narrower channels shrink each cell, which reduces how many access points contend on the same channel. Raising power widens cells and adds interference, and disabling 5 GHz or adding APs on the same channels does not reduce co-channel contention.

4. Question 4Uplink and migration

   A newly installed access point is cabled to a switch port that is configured as an access port in one user VLAN. The team needs the AP to keep its management traffic on its own VLAN and to carry several tagged VLANs for bridged WLANs. What is the correct switch port change?

   1. ADisable spanning tree on the port and move the AP to the guest VLAN so tagged traffic is no longer needed.
   2. BChange the port to a single access VLAN and enable port security so only one MAC address can be learned.
   3. CConfigure the port as a trunk with a native VLAN for AP management and the bridged WLAN VLANs allowed on the trunk.
   4. DConvert the port to a routed interface with a static IP address, remove all VLAN tags from the uplink, and keep the access VLAN.
   Show answer and explanationHide answer

   Correct answer: C

   An AP that carries several VLANs needs the switch port in trunk mode, with a native VLAN for management and the bridged WLAN VLANs tagged. The other options remove the VLAN separation the design depends on or disable the tagged traffic the bridged WLANs need.

5. Question 5Wireless security

   Which WPA3 mechanism replaces the four-way pre-shared key handshake in WPA3-Personal and protects against offline dictionary attacks on the passphrase?

   1. ASimultaneous Authentication of Equals (SAE), a password-based key exchange resistant to offline dictionary guessing.
   2. BProtected Management Frames, which protect 802.11 management traffic such as deauthentication and disassociation frames.
   3. COpportunistic Wireless Encryption, which encrypts traffic on open networks without requiring a passphrase from the user.
   4. DTemporal Key Integrity Protocol, a legacy cipher carried over from the original WPA design.
   Show answer and explanationHide answer

   Correct answer: A

   SAE replaces the pre-shared key exchange in WPA3-Personal and resists offline dictionary attacks on the passphrase. OWE is for open networks, PMF protects management frames, and TKIP is a legacy WPA cipher, so none of the others fits.