According to the Aruba Validated Design: Campus Wireless LAN 1 , MCs that are in different subnets cannot form a cluster, which is a logical group of MCs that share the same configuration and provide redundancy and load balancing for each other. However, MCs that are in different subnets can still provide backup LMS (local mobility switch) functionality for each other’s APs. This means that if the primary MC that controls an AP fails, the AP can fail over to the backup MC that is in a different subnet. However, this failover is not stateful, meaning that the user sessions and firewall states are not preserved. Therefore, option D is the correct answer.

Option A is incorrect because the MCs can provide some level of redundancy for each other without being in the same subnet, as explained above. Option B is incorrect because VRRP is not required to provide redundancy for MCs that are in different subnets. VRRP is a protocol that provides redundancy for routers by creating a virtual router with a shared IP address. However, MCs do not act as routers, and they do not need a shared IP address to provide backup LMS functionality. Option C is incorrect because the MCs cannot be in a cluster if they are in different subnets, as explained above. Therefore, the cluster will not support any features, such as stateful failover, load balancing, or centralized configuration.  References : Aruba Validated Design: Campus Wireless LAN)

it meets the customer’s requirements for wired network upgrade. By combining the switches in each Building 2 closet as a Virtual Switching Framework (VSF) fabric, the architect can reduce the number of logical devices within the network, simplifying management and reducing complexity, aligning with the goal of flattening architecture. Es tablishing two 10 GbE connections to the core per fabric ensures redundancy and resilience, maintaining connectivity even if one link fails, without necessitating additional cabling. This also provides sufficient bandwidth and scalability for the network traffic.

The other options are incorrect because:

A. Using two additional 2930F switches to act as an aggregation layer for Building 2 adds another layer of devices and complexity to the network, contradicting the goal of flattening architecture. It also requires additional cabling and ports to connect the switches to the core and the access layer.

B. Connecting each Building 2 switch directly to the core on a single fiber strand through the use of SFP±SR transceivers does not provide redundancy and resilience, as one link failure would disconnect the switch from the core. It also limits the bandwidth and scalability of the network, as each switch would have only one 10 GbE connection to the core.

D. Extending additional fiber between the buildings so that each Building 2 switch can have a direct 10 GbE connection to the core requires recabling, which the customer wants to avoid. It also increases the cost and complexity of the network, as more fiber strands and ports would be needed.

References :

Aruba 2930M Switch Series - Data sheet)

Aruba Validated Reference Design: Campus Wired LAN - Chapter 3)

ArubaOS-Switch Virtual Switching Framework - Configuration guide)

Air Monitors (AMs) are Aruba access points (APs) that are configured to operate in a dedicated mode for scanning the RF spectrum and detecting rogue APs, clients, and intrusion attacks. AMs do not serve any wireless clients and can scan all channels in both 2.4 GHz and 5 GHz bands. AMs provide better visibility and coverage of the RF environment than APs that serve clients, as they can scan more frequently and thoroughly. However, AMs also consume more power and network resources than APs, and require additional hardware and licensing costs. Therefore, the optimal number of AMs per floor depends on several factors, such as the size and shape of the floor, the density and distribution of APs and clients, the security and compliance requirements, and the budget and availability of the organization.

According to the Aruba Wireless Intrusion Protection (WIP) Technology Guide 1 , a general rule of thumb is to deploy one AM for every four to six APs. This ratio can provide adequate coverage and detection for most environments, while balancing the trade-offs between performance and cost. However, this ratio is not fixed and can vary depending on the specific needs and characteristics of each deployment. For example, if the floor has a high density of APs and clients, or a high risk of rogue or malicious activity, more AMs may be needed to provide better security and visibility. Conversely, if the floor has a low density of APs and clients, or a low risk of rogue or malicious activity, fewer AMs may be sufficient to provide adequate security and visibility.

In this case, the floor has 20 APs, which implies a moderate to high density of APs and clients. Assuming that the floor has a rectangular shape and a uniform distribution of APs and clients, a reasonable estimate of the number of AMs per floor would be about 3 to 5, based on the general rule of thumb. This would provide enough coverage and detection for most scenarios, while minimizing the additional costs and resources. However, this estimate may need to be adjusted if the floor has a different shape or a non-uniform distribution of APs and clients, or if the organization has specific security and compliance requirements that demand more or less AMs per floor.  References :

Wireless Intrusion Protection (WIP) Technology Guide

Installing Air Monitors | Wireless Access - Airheads Community

Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47)

 A collision domain is a logical area of the network where devices share the same wireless medium and may interfere with each other’s transmissions. In a WLAN, a collision domain is defined by the channel and the coverage area of an AP or a client. Devices that operate on the same channel and are within range of each other belong to the same collision domain and must contend for access to the medium using the Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) protocol. Devices that operate on different channels or are out of range of each other belong to different collision domains and do not interfere with each other.

In this scenario, the architect plans 12 APs for an auditorium that is 325 square meters (3,498 square feet). Each AP has one 2.4 GHz radio and one 5 GHz radio. Both types of radios use 20 MHz channels. Assuming that DFS channels can be used in this design, the question is how many 5 GHz collision domains does this design provide.

To answer this question, we need to consider the following factors:

The number of available 5 GHz channels in the regulatory domain of the auditorium. Different countries have different regulations on the use of the 5 GHz band, which affects the number and availability of channels for WLANs. For example, in the United States, there are 25 non-overlapping 20 MHz channels in the 5 GHz band, but some of them are subject to Dynamic Frequency Selection (DFS) requirements, which means that they must avoid interfering with radar systems by detecting and switching to another channel if radar signals are present. In other countries, such as Japan, there are 19 non-overlapping 20 MHz channels in the 5 GHz band, but some of them are restricted to indoor use only. Therefore, the number of available 5 GHz channels for the design depends on the regulatory domain of the auditorium.

The channel assignment and distribution of the 12 APs in the auditorium. The channel assignment and distribution of the APs affect the number and size of the collision domains in the WLAN. Ideally, the APs should be assigned to non-overlapping channels and distributed evenly across the auditorium to provide optimal coverage and capacity, while minimizing co-channel interference and adjacent channel interference. Co-channel interference occurs when devices on the same channel interfere with each other, while adjacent channel interference occurs when devices on nearby channels interfere with each other. Both types of interference degrade the performance and quality of the WLAN. Therefore, the channel assignment and distribution of the APs should follow the best practices of RF design, such as using a channel reuse plan, avoiding channel overlap, and adjusting the transmit power and antenna gain of the APs to match the coverage and capacity requirements of the auditorium.

The coverage and capacity requirements of the auditorium. The coverage and capacity requirements of the auditorium affect the number and placement of the APs and the transmit power and antenna gain settings of the radios. The coverage requirement refers to the minimum signal strength and signal-to-noise ratio (SNR) that the APs and clients need to maintain a reliable wireless connection. The capacity requirement refers to the maximum number of clients and the minimum throughput and quality of service (QoS) that the APs and clients need to support the applications and services of the auditorium. The coverage and capacity requirements of the auditorium depend on the size and shape of the space, the density and distribution of the clients, the types and characteristics of the applications and services, and the performance and capabilities of the devices. Therefore, the coverage and capacity requirements of the auditorium should be determined by conducting a site survey and a network analysis, and then used to guide the design and configuration of the APs and radios.

Based on these factors, we can estimate the number of 5 GHz collision domains in the design as follows:

Assuming that the auditorium is located in the United States and that DFS channels can be used in the design, there are 25 non-overlapping 20 MHz channels in the 5 GHz band. However, not all of them may be available or suitable for the design, depending on the presence and activity of radar systems in the area, the compatibility and support of the APs and clients, and the interference and noise level of the environment. Therefore, we will use a conservative estimate of 15 available 20 MHz channels in the 5 GHz band for the design.

Assuming that the 12 APs are assigned to non-overlapping channels and distributed evenly across the auditorium, each AP will have its own 5 GHz collision domain, as there will be no co-channel interference or adjacent channel interference among the APs. Therefore, there will be 12 5 GHz collision domains in the design, corresponding to the 12 APs.

Assuming that the coverage and capacity requirements of the auditorium are moderate and that the transmit power and antenna gain settings of the radios are adjusted accordingly, each AP will cover an area of about 27 square meters (290 square feet), which is roughly the size of a small classroom. This means that the APs will provide adequate signal strength and SNR for the clients, while avoiding excessive overlap and interference among the APs. Therefore, there will be no need to further divide or merge the 5 GHz collision domains in the design, as they will match the coverage and capacity requirements of the auditorium.

Hence, the number of 5 GHz collision domains in the design is 12, which is the answer option C.  References :

RF Design | Validated Solution Guide - Aruba

Configuring 2.4 Ghz and 5 Ghz Radios - Aruba

Chapter T-5: Understanding RF Collision Domains - Aruba

[Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47)]

The customer wants to use certificates to authenticate user devices, which means that they need a strong and secure method of verifying the identity of the devices that connect to the employee WLAN. The best option for this is to use EAP-TLS instead of PEAP-MSCHAPv2. EAP-TLS stands for Extensible Authentication Protocol-Transport Layer Security, and it is a protocol that uses certificates on both the client and the server side to establish a mutual authentication and a secure channel for data exchange. EAP-TLS is considered the most secure EAP method, as it prevents common attacks such as dictionary attacks, man-in-the-middle attacks, and replay attacks.

The other options are not suitable for the customer requirements:

Option B is incorrect because TKIP encryption is weaker than AES encryption. TKIP stands for Temporal Key Integrity Protocol, and it is an older encryption method that was designed to replace WEP, which had serious security flaws. However, TKIP also has some vulnerabilities, and it is not recommended for modern WLANs. AES stands for Advanced Encryption Standard, and it is a newer and stronger encryption method that provides better security and performance for WLANs.

Option C is incorrect because WPA2-PSK is less secure than WPA2-Enterprise. WPA2-PSK stands for Wi-Fi Protected Access 2-Pre-Shared Key, and it is a security mode that uses a common passphrase or key to authenticate all devices that connect to the WLAN. However, this passphrase or key can be easily compromised or shared, and it does not provide individual authentication or encryption for each device. WPA2-Enterprise stands for Wi-Fi Protected Access 2-Enterprise, and it is a security mode that uses a RADIUS server to authenticate each device individually and dynamically generate encryption keys for each session. WPA2-Enterprise provides better security and scalability for WLANs.

Option D is incorrect because TTLS does not use certificates to authenticate user devices. TTLS stands for Tunneled Transport Layer Security, and it is a protocol that uses certificates only on the server side to establish a secure tunnel for data exchange. The client side can use different methods to authenticate, such as passwords, tokens, or certificates. However, TTLS does not require certificates on the client side, and it is less secure than EAP-TLS.

References :

ArubaOS 8.5 User Guide)

ArubaOS 8.5 Security Guide)

Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))

This answer is correct because it matches the scenario for which the Aruba backplane stacking technology is designed. Aruba backplane stacking technology allows up to 10 switches to be interconnected using high-speed backplane cables, creating a single logical device with a single IP address and configuration. This simplifies the management and operation of the network, as well as the redundancy design, as the stack can operate in ring or chain topology and provide fast failover in case of link or switch failure. This technology is suitable for customers who need to deploy a pair of aggregation switches in the same closet, as it reduces the number of devices and links to manage, and provides high availability and scalability for the network.

The other options are incorrect because:

B. The customer needs to simplify the deployment of core switches which are located in different closets for redundancy purposes. This scenario is not suitable for Aruba backplane stacking technology, as it requires the switches to be physically close to each other and connected with backplane cables. A better option for this scenario would be to use Aruba Virtual Switching Framework (VSF) technology, which allows up to two switches to be interconnected using standard Ethernet links, creating a virtual switch that can span across different closets or racks.

C. The customer needs to expand the network and make it possible for the current core switches to support more MAC forwarding and ARP entries. This scenario is not suitable for Aruba backplane stacking technology, as it does not increase the MAC or ARP table size of the switches. The MAC and ARP table size is determined by the hardware specifications of each switch model, and stacking them together does not change that. A better option for this scenario would be to upgrade the core switches to a higher-end model that supports more MAC and ARP entries, or to segment the network into smaller subnets to reduce the MAC and ARP traffic.

D. The customer needs to deploy a switch at a branch office and have the switch automatically discover and join the network stack at the main office. This scenario is not suitable for Aruba backplane stacking technology, as it requires the switches to be on the same LAN and connected with backplane cables. A better option for this scenario would be to use Aruba Central, which is a cloud-based management platform that allows remote provisioning and monitoring of Aruba switches and other devices. Aruba Central can automatically discover and join the switch to the network, and apply the configuration and policies from the main office.

References :

Aruba 2930M Switch Series - Data sheet)

ArubaOS-Switch Virtual Switching Framework - Configuration guide)

Aruba Central - Data sheet)

The guideline for defining another VLAN for wireless devices should be based on the employee roles, with a different VLAN for each role or department. This approach allows for better control and management of network resources. It also enhances security by segregating network traffic based on roles or departments.  This is particularly useful in large organizations where different departments may have different network requirements and security levels 1 2 .

References :

Configuring VLANs - Aruba

TECH BRIEF SINGLE VLAN DESIGN FOR WIRELESS LAN - Aruba

A wide sector directional antenna is a type of antenna that radiates or receives radio waves in a sector-shaped pattern, covering a wide angle of a circle.  The width of the sector is determined by the horizontal beamwidth (H-plane) of the antenna, while the height of the sector is determined by the vertical beamwidth (E-plane) of the antenna 1 2 .  A wide sector directional antenna is usually used to provide regional coverage for wireless networks, such as Wireless Internet Service Providers (WISP) or similar applications 2 .

According to the antenna specifications given, Antenna 3 has the widest horizontal beamwidth of 100 degrees, which means it can cover a large sector of a circle. Antenna 4 has a narrower horizontal beamwidth of 60 degrees, which means it can cover a smaller sector of a circle. Antenna 1 and Antenna 2 have a horizontal beamwidth of 360 degrees, which means they are omnidirectional antennas, not directional antennas. Therefore, Antenna 3 is the best choice for the plan that specifies wide sector directional antennas.

References :

1 : https://en.wikipedia.org/wiki/Sector_antenna

2 : https://lcantennas.com/directional-antennas/

The specifications for the AP models are in the format of Tx:Rx:SU-MIMO:MU-MIMO:MU-MIMO clients, where Tx is the number of transmit antennas, Rx is the number of receive antennas, SU-MIMO is the number of spatial streams supported in single-user MIMO mode, MU-MIMO is the number of spatial streams supported in multi-user MIMO mode, and MU-MIMO clients is the number of MU-MIMO clients that can be served simultaneously.

The customer requirements are:

Support for MU-MIMO: This means the AP must have a MU-MIMO value greater than 1, as MU-MIMO is a technique that allows multiple spatial streams to be transmitted to different clients at the same time.

Support for up to four spatial streams, both when MU-MIMO is used and when it is not used: This means the AP must have a SU-MIMO value and a MU-MIMO value of 4, as spatial streams are independent data streams that can be transmitted or received by an antenna.

Support for transmissions to up to three MU-MIMO clients at the same time: This means the AP must have a MU-MIMO clients value of 3, as this indicates the maximum number of clients that can receive MU-MIMO transmissions from the AP at the same time.

Based on these criteria, only the AP 335 meets the customer requirements, as it has a specification of 4x4:4:4:4:3, which means it has 4 transmit and receive antennas, 4 spatial streams in both SU-MIMO and MU-MIMO modes, and can serve 3 MU-MIMO clients simultaneously. The AP 325 does not meet the customer requirements, as it has a specification of 4x4:4:4:3:3, which means it has only 3 spatial streams in MU-MIMO mode, and can only serve 2 MU-MIMO clients simultaneously.

References :

Aruba AP-335 Wireless Access Point | Aruba

Aruba AP-325 Wireless Access Point | Aruba

Multi-User MIMO in WiFi 6 - Arista Networks

The customer needs to upgrade their wireless network, which has a single large building with four floors. The customer requires 30 APs on each floor, totaling 120 APs for the whole building. The customer also wants to use a MM-based architecture, and deploy one Aruba 7030 MC on each floor, with the MCs combined in a cluster for seamless client failover and roaming. However, the proposed solution does not meet the customer’s requirements, because the Aruba 7030 MC does not support enough APs for the customer’s needs. Each Aruba 7030 MC can only support up to 64 APs, which means that deploying one on each floor would not be enough to support all the required APs. The architect should explain this limitation to the customer, and suggest a different solution that can support more APs, such as using a higher-capacity MC model, or deploying more MCs per floor.

References :

Aruba 7000 Series Mobility Controllers Data Sheet)

ArubaOS 8.5 User Guide)

Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))