Aruba Certified Professional (ACP) — Questions and Answers

Question 1: What does the ClearPass Policy Simulation tool allow administrators to do?

Test how services and policies respond to hypothetical authentication requests without real clients (Correct answer)
Preview firmware changes before committing them to managed access points
Simulate RF coverage changes in wireless controller deployments
Test enforcement profiles against live traffic without affecting production users

Correct answer: Test how services and policies respond to hypothetical authentication requests without real clients

The Policy Simulation tool lets administrators input request attributes (like username, MAC, or NAS IP) and see exactly which service would match and what enforcement would be applied, without requiring a live client.

Question 2: How does Aruba Central help in troubleshooting client issues?

By restarting the controller
By providing detailed client connection analytics (Correct answer)
By limiting access
By clearing browser cache

Correct answer: By providing detailed client connection analytics

Aruba Central offers robust client troubleshooting capabilities by providing detailed analytics on client connection health, performance, and historical data. This allows administrators to quickly pinpoint issues affecting individual clients, such as poor signal, authentication failures, or application performance problems, directly from a centralized dashboard.

Question 3: Which feature of AirWave assists in locating problematic access points?

AppRF
RFProtect
VisualRF (Correct answer)
Network Profiler

Correct answer: VisualRF

VisualRF is a key feature within Aruba AirWave that provides a graphical representation of the wireless network, overlaying APs and client locations on floor plans. This visual tool helps administrators quickly identify problematic access points, visualize RF coverage, and troubleshoot performance issues based on physical location.

Question 4: What is a 'Static Host List' in ClearPass used for?

Maintaining a whitelist of permitted RADIUS client (NAS) IP addresses
Defining the IP addresses of ClearPass cluster publisher and subscriber nodes
Storing a manually maintained list of MAC or IP addresses for authentication or device classification (Correct answer)
Listing static routes configured on connected network access devices

Correct answer: Storing a manually maintained list of MAC or IP addresses for authentication or device classification

A Static Host List in ClearPass is a manually maintained repository of MAC addresses, IP addresses, or subnets that can serve as an authentication source or device category input, useful for headless devices that cannot perform 802.1X.

Question 5: After upgrading Aruba controller firmware, several APs fail to rejoin and show 'cert-mismatch' in the AP debug log. What is the correct remediation?

Delete and re-add the AP entries in the AP database
Re-provision the controller certificate and push updated AP whitelist (Correct answer)
Factory reset all affected APs
Downgrade the controller firmware to the previous version

Correct answer: Re-provision the controller certificate and push updated AP whitelist

A cert-mismatch error indicates the AP cannot validate the controller's certificate; re-provisioning the controller's certificate and ensuring the AP whitelist is current resolves this.

Question 6: When documenting Aruba Instant AP (IAP) cluster settings, which configuration element is MOST important to capture for disaster recovery?

The technician's badge number who installed it
The color of the AP LED indicator
The height at which the AP is mounted
The virtual controller IP, SSID profiles, and security settings (Correct answer)

Correct answer: The virtual controller IP, SSID profiles, and security settings

Virtual controller IP, SSID profiles, and security settings are the core parameters needed to restore an IAP cluster after a failure.

Question 7: How does risk appetite influence management decisions?

It only applies to financial risks
It is determined solely by regulators
It defines the level of risk an organization is willing to accept in pursuit of objectives (Correct answer)
It eliminates the need for risk assessment

Correct answer: It defines the level of risk an organization is willing to accept in pursuit of objectives

Risk appetite defines acceptable risk levels in pursuit of objectives, guiding decisions about which risks to accept, mitigate, transfer, or avoid.

Question 8: What is the function of a switch in a network?

Connects to the internet
Directs traffic within a LAN (Correct answer)
Distributes IP addresses
Manages user accounts

Correct answer: Directs traffic within a LAN

A network switch operates within a Local Area Network (LAN) to connect multiple devices, such as computers, printers, and servers. Its function is to efficiently direct data traffic only to the specific device for which it is intended, based on MAC addresses. This intelligent forwarding improves network performance by reducing unnecessary traffic compared to a hub.

Question 9: What is the primary role of the distribution layer in a hierarchical campus network?

To serve as the high-speed packet-forwarding backbone between wiring closets
To provide physical connectivity to end devices like PCs and phones
To connect the campus network to the internet and WAN circuits
To aggregate access layer connections and enforce inter-VLAN routing and policies (Correct answer)

Correct answer: To aggregate access layer connections and enforce inter-VLAN routing and policies

The distribution layer aggregates uplinks from access switches, performs inter-VLAN routing, and enforces QoS, security, and traffic policies before forwarding to the core.

Question 10: A ClearPass administrator needs to enforce different network access policies based on whether a Windows endpoint passes a health check (antivirus up-to-date). Which ClearPass component handles this posture assessment?

ClearPass OnGuard (Correct answer)
ClearPass Guest
ClearPass Insight
ClearPass Profiler

Correct answer: ClearPass OnGuard

ClearPass OnGuard is the endpoint health assessment agent that checks antivirus status, patch level, and other posture attributes before granting full network access.

Question 11: A network admin notices high retry rates on a 5 GHz SSID. Which Aruba AirMatch or ARM feature should be tuned first to address co-channel interference?

Band steering aggressiveness
Minimum RSSI threshold for client association
Channel and transmit power reoptimization interval (Correct answer)
RTS/CTS threshold value

Correct answer: Channel and transmit power reoptimization interval

Reducing the AirMatch/ARM reoptimization interval allows the system to reassign channels and power levels more frequently to resolve interference.

Question 12: In Aruba's AirWave or Central platforms, which capability directly supports continuous quality assurance of the wireless environment?

Automatic VLAN trunk negotiation
Zero-touch provisioning of new APs
Real-time RF health monitoring and alerting (Correct answer)
Layer 3 routing between subnets

Correct answer: Real-time RF health monitoring and alerting

Real-time RF health monitoring detects coverage gaps, interference, and performance degradation, supporting ongoing QA of the WLAN.

Question 13: What does 802.11r (Fast BSS Transition) improve in a wireless environment?

Roaming speed between APs by pre-authenticating before disassociation (Correct answer)
WPA3 key derivation time
MIMO spatial stream negotiation
Maximum data throughput on 5 GHz band

Correct answer: Roaming speed between APs by pre-authenticating before disassociation

802.11r reduces roaming latency by allowing a client to pre-establish keys with the target AP before leaving the current AP.

Question 14: What is the primary reason ACP certification holders are required to agree to a code of ethics at the time of certification?

To require certified professionals to recommend Aruba products exclusively
To give Hewlett Packard Enterprise a legal mechanism to revoke certifications for any business reason
To prevent certified professionals from working for competitors of Aruba
To establish a shared standard of professional behavior that protects clients, employers, and the public (Correct answer)

Correct answer: To establish a shared standard of professional behavior that protects clients, employers, and the public

Codes of ethics exist to align professional behavior with the interests of clients, employers, and the broader public, not to serve corporate or competitive interests.

Question 15: What is the purpose of a DHCP relay agent in a multi-subnet Aruba network?

To forward DHCP broadcast requests from client subnets to a centralized DHCP server on a different subnet (Correct answer)
To replicate DHCP leases between redundant DHCP servers
To encrypt DHCP traffic between clients and the server
To assign static IP addresses based on MAC address reservations

Correct answer: To forward DHCP broadcast requests from client subnets to a centralized DHCP server on a different subnet

A DHCP relay agent forwards DHCP broadcast messages as unicast packets to a centralized DHCP server, allowing a single server to serve clients across multiple VLANs.

Question 16: In ClearPass Policy Manager, what is the purpose of a 'Service'?

A software license module that enables specific ClearPass features
A hardware component that handles RADIUS encryption operations
A policy rule set that defines how incoming authentication requests are processed (Correct answer)
A background process that maintains cluster synchronization

Correct answer: A policy rule set that defines how incoming authentication requests are processed

A ClearPass Service is a top-level policy construct that matches incoming AAA requests and defines which authentication sources, role mapping, and enforcement policies to apply.

Question 17: When performing a post-deployment validation of an Aruba WLAN, which tool is used to conduct an active survey that measures actual throughput to the AP?

Ekahau Site Survey (Correct answer)
Aruba Activate
NetEdit
Aruba ALE

Correct answer: Ekahau Site Survey

Ekahau Site Survey performs active surveys that measure real throughput, latency, and packet loss to verify post-deployment performance.

Question 18: In a ClearPass cluster deployment, what is the specific role of the Publisher node?

It serves as the primary configuration node that replicates settings to Subscriber nodes (Correct answer)
It stores reporting data and generates compliance audit reports
It handles all guest user registrations exclusively
It processes the majority of inbound RADIUS authentication requests

Correct answer: It serves as the primary configuration node that replicates settings to Subscriber nodes

In a ClearPass cluster, the Publisher is the sole writable configuration node; all administrative changes are made on the Publisher and automatically synchronized out to Subscriber nodes.

Question 19: Which authentication source type in ClearPass is used to verify user credentials and group membership against Microsoft Active Directory?

Active Directory / LDAP (Correct answer)
HTTP Authentication
SQL Database
Static Host List

Correct answer: Active Directory / LDAP

ClearPass uses the Active Directory / LDAP authentication source type to bind to Microsoft AD and query user credentials and group memberships during authentication.

Question 20: What is the primary role of Aruba ClearPass Policy Manager (CPPM) in an enterprise network?

It functions as a core routing and switching platform
It manages SD-WAN overlay tunnels between branch offices
It serves as a Network Access Control (NAC) solution providing AAA services (Correct answer)
It provides wireless RF management and channel optimization

Correct answer: It serves as a Network Access Control (NAC) solution providing AAA services

ClearPass Policy Manager is Aruba's NAC platform that provides Authentication, Authorization, and Accounting (AAA) services to centrally control who and what can access the network.

Question 21: When using Aruba Central, which feature allows administrators to run CLI commands on multiple APs simultaneously without opening individual SSH sessions?

AIOps Insights
Device Bulk Actions / Remote Console (Correct answer)
Network Health Dashboard
Config Groups

Correct answer: Device Bulk Actions / Remote Console

Aruba Central's Device Bulk Actions (Remote Console) lets admins execute CLI commands across multiple devices in a single operation.

Question 22: Which 802.1X EAP method supported by ClearPass uses mutual certificate-based authentication on both the client and server?

EAP-PEAP
EAP-FAST
EAP-TTLS
EAP-TLS (Correct answer)

Correct answer: EAP-TLS

EAP-TLS uses digital certificates on both the client device and the authentication server, providing the strongest form of 802.1X authentication supported by ClearPass.

Question 23: An Aruba network engineer is assessing client roaming performance. Which Aruba feature should be evaluated to determine if clients are being proactively moved to better APs?

Client Match (Correct answer)
AirSlice
AppRF
ARM (Adaptive Radio Management)

Correct answer: Client Match

Client Match proactively steers clients to better APs based on real-time RF conditions and client capabilities.

Question 24: What is Aruba VSX (Virtual Switching Extension)?

A protocol for extending VLANs across WAN links
A feature for stacking up to eight Aruba switches into a single logical unit
A virtual overlay network for connecting remote data centers
An active-active switch virtualization technology providing redundancy without spanning tree (Correct answer)

Correct answer: An active-active switch virtualization technology providing redundancy without spanning tree

Aruba VSX creates an active-active switch pair that appears as a single logical device, providing redundancy and load sharing without relying on spanning tree protocols.

Question 25: What is the purpose of Spanning Tree Protocol (STP) in switched networks?

To encrypt broadcast traffic between switches
To prevent Layer 2 loops by blocking redundant paths in a switched network (Correct answer)
To segment multicast traffic in a campus LAN
To balance traffic load across multiple uplinks simultaneously

Correct answer: To prevent Layer 2 loops by blocking redundant paths in a switched network

STP prevents Layer 2 broadcast storms by detecting redundant paths in switched networks and placing redundant ports in a blocking state.

Question 26: What is the purpose of Aruba's 'User-Based Tunneling' (UBT) on an AOS-CX switch?

Provides encrypted management access via SSH tunneling
Tunnels authenticated user traffic from a wired switch port to a Mobility Controller for centralized policy enforcement (Correct answer)
Bonds multiple switch uplinks into a single logical tunnel
Creates IPsec VPN tunnels to the data center for encrypted branch traffic

Correct answer: Tunnels authenticated user traffic from a wired switch port to a Mobility Controller for centralized policy enforcement

UBT allows AOS-CX switches to tunnel wired user traffic to an Aruba Mobility Controller, extending Dynamic Segmentation to the wired edge.

Question 27: What does ClearPass Insight provide to network administrators?

API-based bidirectional integration with third-party security platforms
Reporting, analytics dashboards, and visibility into authentication events and access trends (Correct answer)
Certificate lifecycle management with automatic renewal workflows
Real-time RADIUS packet capture and protocol debugging tools

Correct answer: Reporting, analytics dashboards, and visibility into authentication events and access trends

ClearPass Insight is the built-in reporting and analytics module that transforms raw authentication logs into visual dashboards, trend reports, and exportable compliance data.

Question 28: What is the primary advantage of a collapsed core network design?

It adds an extra layer of redundancy by doubling the core switches
It reduces cost and complexity by merging the distribution and core layers into one (Correct answer)
It isolates broadcast domains more effectively than three-tier designs
It provides higher throughput by separating routing from switching

Correct answer: It reduces cost and complexity by merging the distribution and core layers into one

A collapsed core design merges the distribution and core layers into a single tier, reducing hardware costs and management complexity, typically used in smaller campus networks.

Question 29: A customer reports that clients connected to an Aruba AP can reach the internet but not internal servers after a VLAN reconfiguration. What should be verified first?

Controller license count
AP channel utilization
Client DNS server settings
AP group SSID VLAN tagging and upstream trunk port configuration (Correct answer)

Correct answer: AP group SSID VLAN tagging and upstream trunk port configuration

Mismatched VLAN tagging between the AP/controller SSID profile and the upstream switch trunk port is the most common cause of selective connectivity loss after VLAN changes.

Question 30: When troubleshooting an Aruba SD-WAN deployment, which command verifies the health and uptime of overlay tunnels between branch and hub?

show vpdn tunnel
show branch-gw tunnels
show datapath tunnel (Correct answer)
show vpn-diag

Correct answer: show datapath tunnel

'show datapath tunnel' displays active GRE/IPsec tunnel states, packet counts, and health metrics for SD-WAN overlay connections.

Question 31: Which address type is used to send a packet to all devices within a specific multicast group?

Anycast address
Unicast address
Broadcast address
Multicast address (Correct answer)

Correct answer: Multicast address

Multicast addresses (224.0.0.0–239.255.255.255) deliver packets to all members of a subscribed multicast group.

Question 32: Which ClearPass feature automatically identifies and categorizes devices based on network behavior, DHCP fingerprints, and HTTP attributes?

ClearPass OnBoard
Device Profiler (Correct answer)
ClearPass Insight
Policy Simulator

Correct answer: Device Profiler

The ClearPass Device Profiler passively and actively collects device fingerprint information to automatically classify devices by type, operating system, and manufacturer without requiring user authentication.

Question 33: Which IEEE standard underpins the 802.11i security amendment that most enterprise compliance frameworks (PCI DSS, HIPAA) reference when requiring strong wireless encryption?

IEEE 802.11k (Radio Resource Management)
IEEE 802.11e (QoS)
IEEE 802.11i (RSN — Robust Security Network) (Correct answer)
IEEE 802.11r (Fast BSS Transition)

Correct answer: IEEE 802.11i (RSN — Robust Security Network)

IEEE 802.11i defined the Robust Security Network (RSN) architecture, including CCMP/AES encryption and 802.1X authentication, which WPA2 and WPA3 are based on.

Question 34: What is ClearPass OnBoard primarily used for?

Managing guest user accounts and time-limited access policies
Configuring initial ClearPass cluster publisher settings
Provisioning BYOD devices with certificates and network configuration profiles (Correct answer)
Monitoring network device health and uptime status

Correct answer: Provisioning BYOD devices with certificates and network configuration profiles

ClearPass OnBoard provides a self-service BYOD portal that automates certificate enrollment and delivers network configuration profiles to personal devices.

Question 35: What does a high retransmission rate typically indicate in wireless troubleshooting?

Wireless interference or poor quality (Correct answer)
Strong signal strength
Good connection stability
Low bandwidth usage

Correct answer: Wireless interference or poor quality

A high retransmission rate in a wireless network indicates that data packets are not being successfully delivered on the first attempt and need to be resent. This is typically a symptom of poor signal quality, excessive wireless interference, or distance issues, leading to reduced throughput and degraded network performance.

Question 36: Which strategic risk is most associated with a rapid, organization-wide Aruba network deployment compressed into six months?

Over-investment in redundant hardware
Underutilization of the new infrastructure
Inadequate change management leading to operational disruption and low adoption (Correct answer)
Excessive vendor negotiating leverage

Correct answer: Inadequate change management leading to operational disruption and low adoption

Compressed timelines create change management risk because users and operations teams may not be adequately prepared, causing disruption and poor adoption.

Question 37: Which of the following best illustrates the principle of 'professional competence' in the context of ACP ethics?

Delegating all tasks outside one's comfort zone to more experienced colleagues
Continuously updating skills and knowledge to remain capable of delivering quality work (Correct answer)
Recommending only solutions for which manufacturer-provided case studies exist
Passing the ACP exam at the minimum passing score required for certification

Correct answer: Continuously updating skills and knowledge to remain capable of delivering quality work

Professional competence is an ongoing commitment to skill development, not a one-time threshold achieved at certification.

Question 38: Which protocol does ClearPass primarily use to communicate with network access devices for user authentication?

TACACS
DIAMETER
LDAP
RADIUS (Correct answer)

Correct answer: RADIUS

RADIUS (Remote Authentication Dial-In User Service) is the primary protocol ClearPass uses to exchange AAA messages with network devices like wireless controllers and switches.

Question 39: Which component of Aruba ClearPass is responsible for profiling and identifying device types on the network?

ClearPass Guest
ClearPass OnGuard
ClearPass Device Insight / Profiling Engine (Correct answer)
ClearPass Access Tracker

Correct answer: ClearPass Device Insight / Profiling Engine

ClearPass's profiling engine fingerprints devices using DHCP, HTTP, and SNMP data to categorize endpoint types automatically.

Question 40: What is the most important principle in professional Aruba Certified Professional practice?

Following only personal judgment
Maintaining competence through continuous learning and adherence to standards (Correct answer)
Maximizing revenue from each client
Working as quickly as possible

Correct answer: Maintaining competence through continuous learning and adherence to standards

Maintaining competence through continuous learning and adherence to professional standards ensures quality service delivery and public protection in Aruba Certified Professional practice.

Question 41: Which protocol does Aruba use for controller-to-AP communication in a tunneled WLAN deployment?

CAPWAP (Control and Provisioning of Wireless Access Points) (Correct answer)
LWAPP (Lightweight Access Point Protocol)
VXLAN
GRE over IPsec

Correct answer: CAPWAP (Control and Provisioning of Wireless Access Points)

Aruba uses CAPWAP to tunnel both control and data traffic between the Mobility Controller and managed APs.

Question 42: An Aruba engineer is evaluating whether 802.11ax (Wi-Fi 6) deployment improved client efficiency. Which 802.11ax-specific metric should be assessed to confirm OFDMA spatial reuse gains?

WPA3 handshake success rate
AP-to-client distance in meters
OFDMA Resource Unit (RU) allocation efficiency (Correct answer)
Beacon Interval

Correct answer: OFDMA Resource Unit (RU) allocation efficiency

OFDMA RU allocation efficiency measures how effectively the AP subdivides channels to serve multiple clients simultaneously, confirming Wi-Fi 6 spatial reuse benefits.

Question 43: What is the purpose of ClearPass Extensions?

To extend the RADIUS accounting interval for long-lived user sessions
To unlock additional authentication methods through software license activation
To add physical hardware modules to a ClearPass appliance for increased RADIUS throughput
To integrate third-party applications or custom functionality using containerized add-ons (Correct answer)

Correct answer: To integrate third-party applications or custom functionality using containerized add-ons

ClearPass Extensions allow administrators to install Docker-based containerized applications directly within ClearPass, enabling integrations with MDM solutions, security tools, and custom enterprise platforms.

Question 44: Which Aruba Vendor-Specific Attribute (VSA) is commonly used in a ClearPass Enforcement Profile to place a wireless user into a specific VLAN on an Aruba controller?

Tunnel-Private-Group-ID
Cisco-AVPair
Aruba-User-Vlan (Correct answer)
Filter-ID

Correct answer: Aruba-User-Vlan

The Aruba-User-Vlan VSA is an Aruba-specific RADIUS attribute used in ClearPass Enforcement Profiles to instruct Aruba wireless controllers to assign authenticated users to a designated VLAN.

Question 45: Which tunneling protocol encapsulates Layer 2 Ethernet frames over an IP network and is commonly used in data center fabrics?

GRE
L2TP
IPsec
VXLAN (Correct answer)

Correct answer: VXLAN

VXLAN (Virtual Extensible LAN) encapsulates Layer 2 frames in UDP packets, enabling scalable overlay networks across Layer 3 boundaries.

Question 46: What are the three layers in the traditional hierarchical network design model?

Edge, Core, Cloud
Ingress, Routing, Egress
LAN, MAN, WAN
Access, Distribution, Core (Correct answer)

Correct answer: Access, Distribution, Core

The traditional hierarchical model consists of Access (endpoint connectivity), Distribution (policy and inter-VLAN routing), and Core (high-speed backbone) layers.

Question 47: When evaluating Aruba AP placement using AirWave, which report type provides historical channel utilization trends over a 30-day period?

RF Health Report
Capacity Planning Report (Correct answer)
Rogue Detection Report
Client Match Report

Correct answer: Capacity Planning Report

The Capacity Planning Report in AirWave tracks historical channel utilization to help forecast future AP placement needs.

Question 48: The 6 GHz Wi-Fi band (Wi-Fi 6E/7) in the US is authorized under which FCC rule and is restricted to what type of operation?

FCC Part 15 UNII-5 through UNII-8; indoor low-power and standard power (AFC-controlled) (Correct answer)
FCC Part 90; public safety priority
FCC Part 22; licensed outdoor only
FCC Part 97; amateur radio shared use

Correct answer: FCC Part 15 UNII-5 through UNII-8; indoor low-power and standard power (AFC-controlled)

The FCC opened 1200 MHz of 6 GHz spectrum under Part 15 with indoor low-power and AFC-managed standard power tiers (UNII-5 through UNII-8).

Question 49: A client is associated at MCS0 on 5 GHz despite being within 3 meters of the AP. Which troubleshooting action should be taken first?

Disable 2.4 GHz radio to force 5 GHz association
Check for a sticky client issue and verify minimum RSSI enforcement is configured (Correct answer)
Increase the AP transmit power to maximum
Update the AP firmware

Correct answer: Check for a sticky client issue and verify minimum RSSI enforcement is configured

A client associated at MCS0 at close range typically indicates a sticky client that never re-evaluated its connection; enforcing minimum RSSI thresholds forces disconnection and reconnection at a better rate.

Question 50: What is the appropriate response to witnessing unethical conduct by a colleague?

Confront the colleague publicly
Post about it on social media
Report the conduct through established channels and document observations (Correct answer)
Ignore it to maintain workplace harmony

Correct answer: Report the conduct through established channels and document observations

Reporting through established channels with proper documentation follows professional obligations to protect public welfare while ensuring due process.

Question 51: What is the primary function of a ClearPass Enforcement Policy?

To schedule automatic configuration backups of the ClearPass database
To match assigned roles and posture results to enforcement profiles for final access decisions (Correct answer)
To define the priority order of authentication sources within a service
To define the encryption algorithms used for RADIUS communication

Correct answer: To match assigned roles and posture results to enforcement profiles for final access decisions

A ClearPass Enforcement Policy contains rules that evaluate a client's assigned role and posture status, mapping them to specific Enforcement Profiles that define the granted or denied network access.

Question 52: What does ClearPass Guest provide in an enterprise deployment?

A customizable web portal and management interface for temporary guest network access (Correct answer)
A posture assessment engine for checking device health compliance
An API gateway for third-party security integrations
A built-in certificate authority for issuing device certificates

Correct answer: A customizable web portal and management interface for temporary guest network access

ClearPass Guest provides a fully customizable self-registration portal and admin interface for creating time-limited guest accounts with sponsor approval workflows.

Question 53: A risk assessment identifies that the Aruba Mobility Controller is a single point of failure. The team installs a redundant controller in hot standby. This control is classified as which type?

Corrective control
Compensating control
Preventive control (Correct answer)
Detective control

Correct answer: Preventive control

A hot standby controller prevents service interruption by proactively eliminating the single point of failure before an incident occurs.

Question 54: Which command on an Aruba Mobility Controller would help identify if a specific user's traffic is being dropped by a firewall policy?

show firewall-policy match <IP>
show datapath user <IP> (Correct answer)
show datapath acl-hit-count user <IP>
show user-table ip <IP>

Correct answer: show datapath user <IP>

'show datapath user <IP>' displays the user's role, ACL assignments, and packet counters including drops attributable to the applied firewall policy.

Question 55: A roaming client on an Aruba network experiences a 2-second interruption every time it moves between APs. Which feature, when enabled, would most reduce this roaming latency?

802.11k neighbor reports
UAPSD power save
Broadcast filter ARP
Opportunistic Key Caching (OKC) / PMK caching (Correct answer)

Correct answer: Opportunistic Key Caching (OKC) / PMK caching

OKC (Opportunistic Key Caching) allows clients to reuse cached PMKs when roaming between APs on the same controller, eliminating the full 802.1X re-authentication delay.

Question 56: Which Aruba Mobility Controller CLI command displays real-time statistics for a specific client including signal strength, data rate, and frame counts?

show ap monitor ap-list
show datapath session
show user-table
show ap association (Correct answer)

Correct answer: show ap association

'show ap association' provides per-client RF statistics including RSSI, data rate, and frame counters from the AP's perspective.

Question 57: A technician needs to verify that OSPF adjacencies are forming correctly on an Aruba switch. Which command provides this information?

show ip ospf neighbor (Correct answer)
show ip route ospf
show ip ospf interface
show running-config router ospf

Correct answer: show ip ospf neighbor

'show ip ospf neighbor' displays the state of all OSPF neighbor relationships including their current FSM state (e.g., FULL, 2WAY).

Question 58: An Aruba project manager uses the PDCA (Plan-Do-Check-Act) cycle to manage WLAN quality. Which phase involves analyzing performance data and comparing it against KPIs?

Plan
Check (Correct answer)
Do
Act

Correct answer: Check

The Check phase involves measuring actual performance against planned targets and KPIs to identify gaps.

Question 59: When assessing Aruba switch stack performance, which metric indicates that the stacking interconnect is a bottleneck?

ARP table overflow warnings
OSPF neighbor flapping
High CPU utilization on the primary switch
Elevated stack port error rates and drops (Correct answer)

Correct answer: Elevated stack port error rates and drops

Elevated error rates and packet drops on stack interconnect ports directly indicate a stacking bandwidth or cabling bottleneck.

Question 60: Which entity typically has authority to establish practice standards?

Individual practitioners
State licensing boards and professional regulatory bodies (Correct answer)
Insurance companies
Equipment manufacturers

Correct answer: State licensing boards and professional regulatory bodies

State licensing boards and professional regulatory bodies have the legal authority to establish and enforce practice standards within their jurisdiction.

Question 61: Which Wi-Fi generation introduced OFDMA (Orthogonal Frequency Division Multiple Access) to improve multi-client efficiency?

Wi-Fi 5 (802.11ac)
Wi-Fi 6E
Wi-Fi 6 (802.11ax) (Correct answer)
Wi-Fi 4 (802.11n)

Correct answer: Wi-Fi 6 (802.11ax)

Wi-Fi 6 (802.11ax) introduced OFDMA, allowing an AP to serve multiple clients simultaneously in the same channel by subdividing it into resource units.

Question 62: A network administrator needs to allow multiple VLANs to traverse a single link between two switches. Which configuration is required?

Routed port
Hybrid port
Trunk port (Correct answer)
Access port

Correct answer: Trunk port

A trunk port carries traffic for multiple VLANs using 802.1Q tagging, enabling VLAN propagation across switch-to-switch links.

Question 63: Which protocol does ClearPass support for authenticating and authorizing administrator logins to network infrastructure devices (routers and switches)?

Kerberos
SNMP v3
TACACS+ (Correct answer)
DIAMETER

Correct answer: TACACS+

ClearPass supports TACACS+ (Terminal Access Controller Access-Control System Plus) specifically for network device administration, enabling per-command authorization for CLI access to routers and switches.

Question 64: Which Aruba tool provides AI-driven anomaly detection and root-cause analysis for wireless performance degradation?

Aruba Orchestrator
Aruba NetEdit
Aruba Policy Manager
Aruba AIOps in Central (Correct answer)

Correct answer: Aruba AIOps in Central

Aruba AIOps (within Aruba Central) uses machine learning to detect network anomalies and provides root-cause analysis with remediation suggestions.

Question 65: In Aruba's hierarchical WLAN architecture, which entity holds the global licensing pool and pushes configuration down to Mobility Controllers?

AirWave
ClearPass Policy Manager
Aruba Central
Mobility Master (Correct answer)

Correct answer: Mobility Master

Mobility Master sits at the top of the on-premises Aruba WLAN hierarchy, managing licenses and distributing configuration to Mobility Controllers.

Question 66: What is SASE, and how does Aruba address it?

Software Assurance Security Extension — addressed by Aruba Central
Secure Aggregation Switching Engine — addressed by Aruba CX switches
Secure Access Service Edge — Aruba addresses it via EdgeConnect and SSE integration (Correct answer)
Scalable Application Security Engine — addressed by Aruba ClearPass

Correct answer: Secure Access Service Edge — Aruba addresses it via EdgeConnect and SSE integration

SASE (Secure Access Service Edge) converges SD-WAN and cloud-delivered security; Aruba addresses it by combining EdgeConnect SD-WAN with SSE security services.

Question 67: A technician is writing a technical handoff document for a newly deployed Aruba mobility controller. Which information is LEAST necessary to include?

Controller admin credentials and access method
Number of cables purchased during installation (Correct answer)
Default gateway and VLAN assignments
AP group configurations and RF profiles

Correct answer: Number of cables purchased during installation

The number of cables purchased is a procurement detail irrelevant to operating or maintaining the network.

Question 68: ClearPass OnGuard is used to:

Perform health and posture checks on endpoints before granting full network access (Correct answer)
Configure firewall rules on perimeter network devices
Provision wireless access point firmware updates automatically
Generate compliance reports on network utilization and bandwidth

Correct answer: Perform health and posture checks on endpoints before granting full network access

ClearPass OnGuard is an endpoint posture assessment agent that checks health parameters like antivirus status, OS patch level, and firewall state before allowing full network access.

Question 69: What is the ClearPass REST API primarily used for in enterprise deployments?

Remotely upgrading ClearPass software versions across cluster nodes
Collecting SNMP traps from managed network devices
Streaming real-time authentication logs directly to SIEM platforms
Programmatically integrating ClearPass with external systems and automating management tasks (Correct answer)

Correct answer: Programmatically integrating ClearPass with external systems and automating management tasks

The ClearPass REST API uses standard HTTP methods to allow external scripts and systems to programmatically create guest accounts, query endpoint profiles, manage services, and automate other administrative operations.

Question 70: What is the primary purpose of regulatory compliance in professional practice?

To protect public safety and ensure minimum standards of care (Correct answer)
To create bureaucratic obstacles
To limit the number of practitioners
To increase operating costs

Correct answer: To protect public safety and ensure minimum standards of care

Regulatory compliance exists primarily to protect public safety by ensuring all practitioners meet minimum standards of competence and ethical conduct.

Question 71: What is the primary purpose of Transmit Power Control (TPC) as required in the 5 GHz UNII-2 band?

To comply with indoor-only operation rules
To reduce interference with incumbent services such as radar and satellites (Correct answer)
To maximize coverage in dense deployments
To enable faster roaming between APs

Correct answer: To reduce interference with incumbent services such as radar and satellites

TPC reduces the risk of interference with incumbent users (radar, satellite uplinks) sharing the UNII-2 band by dynamically limiting transmit power.

Aruba Certified Professional (ACP)

The Aruba Certified Professional (ACP) certification validates expertise in deploying and managing HPE Aruba networking solutions, covering network infrastructure design, cloud and mobility solutions, ClearPass policy management, and core Aruba networking fundamentals.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds