Free HPE6-A91 practice test: 30 questions with answers

A read-only administrator role gives the service desk monitoring access without allowing configuration changes, which limits risk. A shared full-access account removes accountability, while guest and client roles are not administrator roles and cannot manage the gateway.

A management access list restricts the source networks that can reach the admin interface, and central RADIUS or TACACS+ authentication controls which accounts can log in. Disabling a guest captive portal and changing DHCP lease times do not restrict administrator access.

TACACS+ separates authentication, authorization and accounting, so it can approve individual device administration commands. 802.1X, MAC authentication bypass and SAE are used for network access, not for command-level administrator authorization.

In AOS-10, gateways enforce centralized role-based policy, and the WLAN forwarding mode selects tunneling to the gateway or local bridging at the AP. Option A describes an architecture AOS-10 does not use, option B reverses the roles of AP and gateway, and option D ties tunneling to subnet placement, which is not the control mechanism.

AOS-10 devices are managed through Aruba Central rather than through a Mobility Conductor and controller hierarchy. ClearPass provides authentication and policy, not device configuration, and the controller-based options belong to the AOS-8 architecture.

Gateways enforce role-based policy on tunneled traffic, and Aruba Central provides cloud-based monitoring and configuration for AOS-10 devices. Option C is wrong because WLANs can bridge traffic locally at the AP, and option D is wrong because tunnels are not restricted to fiber links.

Lower power and narrower channels shrink each cell, which reduces how many access points contend on the same channel. Raising power widens cells and adds interference, and disabling 5 GHz or adding APs on the same channels does not reduce co-channel contention.

A predictive design relies on assumed wall materials and attenuation, so an on-site survey measures actual coverage and interference. The other options misstate what predictive tools and site surveys do.

With 20 MHz channels the 2.4 GHz band has three non-overlapping channels, 1, 6 and 11, which is the standard planning set. Two and four channels leave usable spectrum unplanned or overlap their neighbours, and eleven channels overlap heavily.

An AP that carries several VLANs needs the switch port in trunk mode, with a native VLAN for management and the bridged WLAN VLANs tagged. The other options remove the VLAN separation the design depends on or disable the tagged traffic the bridged WLANs need.

Uplink priority with health-based failover moves traffic to the backup link when the primary is detected as unhealthy. A static route without health checks never detects the failure, manual DHCP changes need an operator, and an SSID on the backup link does not reroute the wired uplink.

A current-state inventory and a staged cutover let the team validate each step and roll back if needed. Replacing all hardware at once, disabling authentication, or disabling DHCP each increases outage risk rather than reducing it.

SAE replaces the pre-shared key exchange in WPA3-Personal and resists offline dictionary attacks on the passphrase. OWE is for open networks, PMF protects management frames, and TKIP is a legacy WPA cipher, so none of the others fits.

WPA3 requires Protected Management Frames, and WPA3-Personal authenticates with SAE instead of the WPA2 four-way PSK exchange. The statements about keeping the WPA2 handshake and about WEP are incorrect because WPA3 does not use WEP.

MPSK gives each device its own pre-shared key on one SSID, so one key can be revoked without changing the others. A single shared passphrase cannot revoke one user, WEP is obsolete, and an open SSID with a name-only portal gives no device-level access control.

A captive portal supports terms acceptance, self-registration and sponsor approval, which fits a guest workflow. A shared passphrase gives no per-visitor control, static addressing does not provide access control, and EAP-TLS needs certificates that visitors would not normally have.

The captive portal login page can be customized so guests see branded content and terms text on the guest WLAN. An SNMP string, a DNS record and a VPN client do not control the look of the login page.

Guest accounts can carry a validity period so access ends without manual cleanup. Rotating a shared passphrase affects every user, DHCP reservations do not control access, and a revocation list applies to certificates rather than guest credentials.

A gateway cluster provides redundancy, so access points move to a surviving member and the wireless service continues. Options A and C describe the single point of failure that a cluster exists to remove, and option D is a cabling change that failover does not require.

A gateway cluster provides redundancy for access points and tunnels, and it can spread the AP load across members. Encryption, wired-only conversion and DHCP for wired desktops are not the purpose of a cluster.

Cluster members need compatible software and matching cluster-related configuration to operate as one group. Isolating the gateways, using different time zones or unique WPA3 passphrases does not help them share state, and the last two are not cluster requirements.

A mesh point reaches the wired network through a wireless backhaul to a mesh portal, which suits areas without cabling. A wired AP with no uplink cannot reach the network, a DSL-attached mesh point creates a separate network, and a USB cable is not a supported way to power or connect an AP.

The mesh portal is the mesh AP with a wired uplink, and mesh points reach the network through it over a wireless backhaul. The mesh point depends on the portal, a Mobility Conductor is a management platform, and a client is an end device.

Mesh backhaul uses the same airtime as the clients being served, which lowers throughput compared with a wired uplink. A firewall rule, transmit power or band limits would not single out the mesh area while the wired AP performs well.

A role-based firewall policy on the gateway restricts sensor traffic to the allowed cloud destinations, which enforces the rule centrally. Shared VLANs with device filtering, static addressing and disabling WPA3 do not enforce a boundary, and the last one weakens security.

Many IoT devices have no supplicant able to perform 802.1X, so MAC authentication or a unique MPSK key gives them a workable onboarding method. The other statements are incorrect because 802.1X works alongside WPA3, IoT devices do not need faster rates, and MAC authentication provides no encryption.

User-Based Tunneling lets an access switch tunnel authenticated wired client traffic to a gateway, where the same role-based policy used for wireless clients is applied. Mesh portals, client isolation and RadSec do not move wired traffic to a gateway.

User-Based Tunneling uses GRE tunnels from the access switch to the gateway to carry tunneled client traffic. The other options are not the transport used for UBT.

Unified communications features recognize real-time applications and apply QoS so they are not starved by bulk transfers. AirGroup is for discovering shared devices, captive portal approval does not prioritize traffic, and DHCP reservations do not affect priority.

AirGroup relies on mDNS-based service discovery so wireless users can find shared services across VLANs, subject to its policies. It does not provide encryption or tunnel all client traffic, so the statements about WPA3 and gateway forwarding are incorrect.