HPE6-A86 HPE Network Switching Associate Exam Free Practice Exam Questions (2026 Updated)

The correct answer is D. Allowed VLANs between access switches. The diagram shows Server-1 connected to Access-2 in VLAN 20 and PC-1 connected to Access-1. The inter-switch link between Access-1 and Access-2 is shown as a trunk carrying VLANs 1, 10, and 20. If users on Access-1 cannot reach Server-1 in VLAN 20 after a recent change, while devices directly connected to Access-2 are not affected, the most likely issue is that VLAN 20 is not being correctly carried across the trunk between the access switches. HPE Aruba Networking AOS-CX documentation states that vlan trunk allowed defines which VLAN traffic is allowed across a trunk interface. It also explains that allowed VLANs are the VLANs that can be transported by the trunk; if a required VLAN is missing from the allowed list, that VLAN’s traffic will not traverse the trunk. Option A is less likely because devices directly connected to Access-2 can access Server-1, indicating Server-1’s local VLAN placement is probably correct. Option B is unlikely because a down trunk would affect more VLANs than just access to VLAN 20. Option C is not supported by the symptom pattern.

The correct matches are based on the high-availability technologies supported by each CX switch family in the answer list. HPE Aruba Networking AOS-CX VSF documentation states that VSF supports up to 8-member stacks for CX 6200F devices and up to 10-member stacks for CX 6300 devices. That makes CX 6200 match “VSF - 8 members” and CX 6300 match “VSF - 10 members.” HPE Aruba Networking documentation for VSX support lists the CX 8100 as a VSX-supported switch series, so CX 8100 matches “VSX.” The CX 6100 and CX 4100i do not match the listed VSF 8-member, VSF 10-member, or VSX choices. Although AOS-CX VSF documentation lists other VSF limits for some platforms, the choices provided only include VSF-8, VSF-10, VSX, and None; therefore, CX 6100 and CX 4100i map to “None” in this drag-and-drop question.

The correct answer is A. Change the hash algorithm. In a LAG, traffic is not normally split packet-by-packet across every member link. Instead, the switch uses a hashing method to choose which physical interface in the aggregate should transmit each flow. The output shows that the current hash is l3-src-dst, which means the load-balancing calculation uses Layer 3 source and destination IP information. If many flows share the same source and destination IP pair, traffic can be unevenly distributed, causing one link to become congested while another link is lightly used. HPE Aruba Networking AOS-CX documentation states that the lacp hash command controls the selection of an interface in an aggregate group and supports Layer 2, Layer 3, and Layer 4 source/destination hash options. Changing the hash algorithm, for example to include Layer 4 source and destination TCP/UDP ports, can improve distribution when Layer 3 values alone are not diverse enough. Changing LACP mode, configuring static LAG, or changing LACP heartbeat rate would not directly fix uneven traffic distribution.

The correct answer is D. To configure a physical interface as a Layer 3 routed port on an HPE Aruba Networking CX 6300 switch, the interface must be placed in routing mode and assigned an IP address directly. This creates a routed interface rather than a bridged Layer 2 port. HPE Aruba Networking AOS-CX examples show routed physical interfaces configured with routing, followed by an ip address, and then no shutdown. The same examples contrast this with Layer 2 ports, which use no routing and VLAN commands such as vlan access or vlan trunk. Option A is incorrect because no routing makes the interface a Layer 2 interface, so assigning an IP address directly is not the correct routed-port configuration. Options B and C are incorrect because vlan access 1 configures the port as a bridged access port. The requirement specifically says the switch should be configured without a bridged port, so the correct CX configuration is a routed physical interface using routing with the IP address configured directly on the port.

The correct answer is A. operators. HPE Aruba Networking AOS-CX documentation for the CX 8400 identifies built-in user groups that exist by default on the switch. These include administrators, operators, and auditors. The operators group has limited privileges, such as basic display-only CLI access and the ability to view nonsensitive switch configuration information. It does not have full switch configuration privileges. The other options—helpdesk, servicedesk, and support—are not listed as built-in default user groups for the CX 8400. Those names could be created manually as custom local user groups in some environments, but they are not default AOS-CX groups. Therefore, from the available choices, the default group is operators.

The correct answer is B. Switch port. The Physical Layer of the OSI model is concerned with the physical transmission of signals across network media, including electrical or optical signaling, cabling, connectors, transceivers, and physical interfaces. HPE Aruba Networking hardware and transceiver documentation describes switch ports, transceiver slots, copper cabling, fiber-optic cabling, and link LEDs as physical connection components. A switch port is therefore the only option listed that belongs directly to the Physical Layer. Option A, URL, is associated with application-level access to web resources and is not a Physical Layer item. Option C, IP address, belongs to Layer 3 because it is used for logical addressing and routing. Option D, TCP port, belongs to Layer 4 because TCP ports identify transport-layer application sessions. Although a switch port may participate in Layer 2 switching after a link is established, the physical connector/interface itself is part of the Layer 1 network infrastructure. This makes “switch port” the correct answer from the listed options.

Built-in stateful firewall = D

400Gb port speeds = C

7–12U chassis form factor = A

8U chassis form factor = B

The correct matches are CX 10000 for built-in stateful firewall, CX 9300 for 400Gb port speeds, CX 6400 for the 7–12U chassis form factor, and CX 8400 for the 8U chassis form factor. HPE Aruba Networking documentation describes the CX 10000 Distributed Services Switch as including stateful firewall capabilities through its distributed services architecture, making it the correct match for built-in stateful firewall. The CX 9300 is identified by HPE Aruba Networking as a high-density 100G/400G switch platform, so it matches the 400Gb port-speed feature. The CX 6400 is a modular chassis family available in 5-slot and 10-slot models; HPE QuickSpecs describe these as compact 7 RU and 12 RU chassis models, matching the 7–12U chassis form factor. The CX 8400 is a modular campus core and aggregation switch described by HPE as a compact 8-slot, 8U chassis, which matches the 8U chassis form factor. These four features are product-line differentiators and should not be interchanged.

The correct answer is D. CX 8400. The requirement asks for a chassis solution, 100G speeds to the aggregation layer, and a maximum size of 10U. HPE Aruba Networking describes the CX 8400 as a core and aggregation switch with line-rate 10GbE, 25GbE, 40GbE, and 100GbE connectivity in a compact 8-slot chassis. The installation guide also identifies the CX 8400 as an eight-slot chassis platform for core and aggregation switching. This satisfies both the 100G requirement and the physical-size requirement because 8U is below the 10U maximum. The CX 10000, CX 9300, and CX 8360 are fixed-form-factor platforms rather than chassis solutions, so they do not match the customer’s chassis requirement. Therefore, the best initial proposal from the listed options is the HPE Aruba Networking CX 8400.

The correct answer is A. 10G-DAC. The limiting device in this connection is the CX 6200. HPE Aruba Networking CX 6200 models use built-in high-speed uplinks, and the CX 6200 product listings identify models with 4SFP+ uplinks. SFP+ uplinks support 10G, not 25G, 50G, or 100G single-port connectivity. HPE Aruba Networking transceiver guidance also notes that CX 6200 switches support split-side SFP connections only in available 10G-capable SFP ports, and that 50G transceivers can only be used in ports capable of 50G speeds, such as SFP56-capable ports. Therefore, even though the CX 8100 supports higher-speed connectivity options, the shared validated single-port option between the two switch families is 10G over DAC for a short 3-meter connection. Option B is incorrect because the CX 6200 does not have 100G ports. Option C is incorrect because 25G-LR is not the best validated 3-meter option and exceeds the CX 6200 SFP+ port capability. Option D is incorrect because 50G-DAC requires 50G-capable ports.

The correct answer is C. The management port is used for multi-active detection. The show vsf output clearly shows Split Detection Method : mgmt, which means the stack is using the management interface as the VSF split-detection method. HPE Aruba Networking AOS-CX VSF documentation states that VSF split detection provides a mechanism for stack fragments to discover each other if a stack split occurs. Once fragments are discovered, the fragment with the primary member remains active, while the other fragment becomes inactive and its non-VSF interfaces are brought down to avoid duplicate MAC or IP addresses and reduce network disruption. The same guide states that the 6200 and 6300 switch series support split detection through the management interface and that the CLI command to enable it is vsf split-detect mgmt. Option A is incorrect because the output does not show peer-switch-based detection. Option B is incorrect because “Status: No Split” is the current state, not the detection method. Option D is incorrect because a ring changing to a chain is a topology change, but the configured integrity method shown is management-based split detection. ( arubanetworking.hpe.com )

The correct answer is B. Single-mode fiber. A 35 km connection between two sites is a long-distance optical link, and single-mode fiber is the appropriate cable type for long-haul communication. HPE Aruba Networking transceiver documentation describes single-mode fiber as having a small core size and being suitable for long-haul communication because it transmits light in one mode and suffers less intermodal dispersion than multi-mode fiber. Multi-mode fiber is used for shorter-distance links inside buildings or data centers and is not the correct choice for a 35 km site-to-site connection. UTP copper cabling cannot support a 40Gbps Ethernet connection over 35 km. ZTP is Zero Touch Provisioning, not a cable type. HPE Aruba transceiver guidance also lists long-distance optical transceivers, such as 40 km single-mode fiber options, reinforcing that long-distance high-speed links require SMF rather than MMF or copper. Therefore, for a 40Gbps link between sites 35 km apart, the required cabling is single-mode fiber. ( arubanetworking.hpe.com )

The correct answer is D. The link on interface 1/1/16 is not established. The output clearly states Interface 1/1/16 is down, Admin state is up, and State information: Waiting for link. This means the port is enabled administratively, but the physical link is not up. HPE Aruba Networking AOS-CX show interface documentation displays these fields to show operational and administrative interface status, including examples where the interface is down while the admin state remains up. Option A is incorrect because the output says qos trust dscp, which trusts Layer 3 DSCP markings, not Layer 2 CoS markings. Option B is incorrect because Admin state is up; an administratively disabled interface would be shut down. Option C is incorrect because the output shows VLAN Mode: native-untagged and Native VLAN: 10; native VLAN 10 is untagged, while the allowed VLAN list shows VLANs permitted on the trunk. Since the port is waiting for link, the immediate verified issue is that the physical link is not established

The correct answer is C. The contents of Flash survive when a device reboots or powers down. In HPE Aruba switch operation, the active configuration used by the device while it is running is the running configuration. The startup configuration is the saved configuration that is preserved and used after reboot. HPE Aruba documentation explains that saving the running configuration writes it to the startup configuration file in Flash memory, allowing the configuration to remain after the switch reboots. This confirms that Flash is nonvolatile storage. HPE Aruba AOS-CX documentation also describes eMMC or SSD switch storage as nonvolatile memory used for persistent storage of configurations, files, databases, and scripts. Option A is incorrect because switch Flash storage is not normally expanded by adding extra Flash for configuration storage. Option B is incorrect because the running configuration is held as the active operating configuration, not simply “Flash.” Option D is incorrect because show running-config displays the current running configuration, not the saved startup configuration stored in Flash.

The correct answer is D. When 10.1.251.2 is no longer in the routing table. The configuration shows two static default routes to the same destination, 0.0.0.0/0. The first route uses the default administrative distance, while the second route has a higher administrative distance of 10, making it a floating static route. HPE Aruba Networking AOS-CX documentation for static routing states that the distance option sets the administrative distance associated with a static route, with a default of 1 and a range of 1–255. Because lower administrative distance is preferred, the route through 10.1.251.2 remains active as long as it is valid in the routing table. The backup route through 10.1.252.2 becomes active only when the preferred route is removed or no longer installed. A remote upstream fiber break might not remove the directly reachable next hop from the routing table, which explains why failover did not occur. BFD tracking could improve failure detection, but the condition for this configured floating static route to take over is loss of the primary route from the routing table.

The correct answer is D. 6. In a switched Ethernet network, each individual switch link or switch port represents a separate collision domain. The diagram shows four end-user device links: PC-A to the VLAN 10 access switch, PC-B to the VLAN 10 access switch, PC-C to the VLAN 20 access switch, and PC-D to the VLAN 20 access switch. It also shows two uplinks from the access switches to the Layer 3 switch or routing switch that contains the SVIs for VLAN 10 and VLAN 20. That gives a total of six physical Ethernet links, and therefore six collision domains. The VLANs do not reduce this count to two; VLANs define Layer 2 broadcast domains, not collision domains. The SVIs also do not create one collision domain; they are Layer 3 gateway interfaces used for routing between VLANs. HPE Aruba Networking campus design documentation describes Layer 2 and Layer 3 switching technologies used in campus topologies, while HPE Aruba switch documentation treats physical switch ports as individual Ethernet interfaces. For this diagram, the collision-domain count is based on the physical switched links, so the answer is 6.

The correct answer is C. Customers that do not allow cloud connectivity. HPE Aruba Networking Central On-Premises is intended for organizations that need Aruba Central-style management capabilities but cannot or do not want to place management data in the public cloud. Official HPE Aruba Networking Central On-Premises documentation describes it as a variant of HPE Aruba Networking Central that is deployed in the customer’s own environment, while the Validated Solution Guide states that Central On-Premises is appropriate when security requirements disallow Internet connectivity. This makes it suitable for organizations with strict regulatory, security, data sovereignty, or internal policy requirements that prevent cloud-managed network infrastructure. Option A is incorrect because using hyperscaler-hosted server resources does not, by itself, require Central On-Premises. Option B is incorrect because a SaaS-maintained management platform describes the cloud version of HPE Aruba Networking Central, not the on-premises deployment. Option D is not the best answer because geographical redundancy is not the primary use case described for choosing Central On-Premises.

The correct answer is B. 2. The diagram shows two VLANs: VLAN 10 and VLAN 20. In Ethernet switching, each VLAN represents a separate Layer 2 broadcast domain. HPE Aruba Networking documentation defines a VLAN as a single Layer 2 network that can be partitioned to create multiple distinct broadcast domains, isolated from each other unless traffic passes through a router or Layer 3 interface. In this diagram, PCs A and B are in VLAN 10, so they share one broadcast domain. PCs C and D are in VLAN 20, so they share a second broadcast domain. The Layer 3 switch has SVIs for VLAN 10 and VLAN 20, which allow routing between the two VLANs, but the SVIs do not merge the broadcast domains. They provide Layer 3 gateways for each VLAN. Therefore, the number of broadcast domains is based on the number of VLANs shown, not the number of PCs, switch links, or SVIs. Since there are two VLANs, there are two broadcast domains.

The correct answers are A and F. Valid RADIUS authentication responses include Access-Accept and Access-Reject. HPE Aruba Networking documentation explains that a RADIUS server responds to an authentication request with an Access-Accept response when authentication succeeds, or an Access-Reject response when the user is not authorized. In the answer choices, these are represented as ACCEPT and REJECT. The other options are not valid RADIUS response names in this context. “ALLOW” and “PERMIT” may describe an access-control result in plain language, but they are not the RADIUS authentication response messages used by the protocol. “DENY” and “BLOCK” are also not the listed RADIUS response types in HPE Aruba Networking documentation. In an HPE Aruba Networking environment, RADIUS is commonly used for authentication, authorization, and accounting workflows, including administrative login and network access authentication. The important exam distinction is that the RADIUS server returns Access-Accept for successful authentication and Access-Reject for failed or unauthorized authentication.

The correct answer is D. SNMPv3. HPE Aruba Networking AOS-CX hardening documentation recommends using SNMPv3 instead of older SNMP versions because older SNMP versions are unauthenticated and unencrypted, with the community string transmitted in plaintext. The same guide states that SNMPv3 supports different users, authentication, and strong encryption. This makes SNMPv3 the secure protocol among the options. HTTP is not the best answer because standard HTTP does not encrypt management or web traffic; HTTPS would be the secure alternative. TFTP is not secure because it does not provide encryption or strong authentication for file transfers. Telnet is also not secure because it sends session traffic, including login information, in clear text; SSH is the secure alternative for CLI management. Therefore, from the listed protocols, only SNMPv3 provides security mechanisms appropriate for secure network management, including authenticated and encrypted communication.