Technical explanation

Firmware policy allows administrators to select devices by deployment scope, desired image and an upgrade mechanism. A live upgrade organizes participating APs into reboot sets rather than restarting the entire RF neighborhood together. Prechecks include supported AP hardware, appropriate licensing, access to image distribution and sufficient overlapping coverage. Schedule sites in controlled waves, observe client experience between waves and retain a backout plan. BIOS-dependent transitions and unsupported combinations may require a standard maintenance-window upgrade. For forty sites, stagger upgrade waves by RF coverage and criticality; avoid putting neighboring radios into the same reboot wave. Check the actual release supports the desired live-upgrade procedure for the APs involved.

Manually touching every AP multiplies administrative effort and risk across forty sites. An unscheduled global push can take adjacent radios offline together. A planned live-upgrade sequence is designed to preserve coverage while individual APs change software.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

VSX joins a pair of supported AOS-CX switches with independent control and management planes while synchronizing selected L2 forwarding state across an inter-switch link. Downstream MC-LAG connections can remain forwarding through the surviving peer after failure. Configure the keepalive in a resilient and isolated path, size the ISL appropriately and verify peer consistency. VSF, by contrast, presents a stack with a single logical control plane, which does not match the independent-plane requirement despite its access-layer resiliency benefits. In a two-core VSX design, a downstream access switch can form one LACP logical interface with one member on each core chassis. Fail one VSX peer during acceptance testing and confirm traffic remains on the surviving member.

VSF makes several members a logical stack with one control plane, so option A contradicts independent control and management. VRRP/MSTP on standalone peers can supply redundancy but not VSX’s state coordination and active-active MC-LAG behavior; they are not equivalent for this design.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Configure a VSX LAG on both core peers and a matching LACP bundle on the access switch. The logical LAG can use available links to both core chassis simultaneously without ordinary spanning-tree blocking one of the uplinks. A peer failure leaves the remaining physical member operational provided the access switch and VLAN design are correct. Ensure consistent VLAN tagging, LACP parameters and an adequately designed VSX ISL/keepalive. Independent VLANs do not offer equivalent transparent redundancy, and static routes cannot replace a Layer 2 aggregated access uplink. With one member to each VSX core, an access switch can forward across both links. If one core fails, the LAG retains the surviving member instead of waiting for STP to unblock a redundant standalone trunk.

Putting each uplink into different access VLANs is segmentation, not a shared resilient bundle. Static routes to an access switch do not aggregate the pair’s L2 member links. A VSX LAG presents a logical LACP endpoint spanning the two cores.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Gateway clustering couples high-availability datapath behavior with user state synchronization, load distribution and WLAN mobility support. Client traffic can be anchored and balanced across available gateways, and the cluster can preserve service through supported node failures or controlled software upgrades. Confirm that enough cluster capacity remains when a member is lost and that every gateway has consistent roles and tunnel reachability. RF channel planning belongs to AirMatch; DHCP snooping and spanning-tree are separate switching/security mechanisms rather than principal gateway-cluster benefits. A cluster maintains user-to-gateway mappings and shares relevant state across peers, improving failure recovery and distributing load. A design without valid cluster connectivity cannot provide that continuity simply because two gateways are online.

RF power/channel algorithms belong to radio management, and DHCP snooping or ARP inspection belong to switch security. Spanning tree and stack monitoring are Layer 2 infrastructure functions. Cluster value is the coordinated client state and traffic continuity between gateway peers.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Choose the affected site, associate the correct device function and apply the routing configuration at that scope. The effective configuration is determined by Central's profile association and inheritance rules, including whether an object is shared or local; a site-level adjustment should not be assumed to propagate into other sites. Verify any cross-scope dependencies such as VRFs, interfaces, next hops and named objects. After deployment, compare the site's effective settings and switch routing table with an unaffected location to ensure no unintended global change.

Device scope is more specific but does not propagate “up” the hierarchy. Site collection affects multiple sites if inherited, making it too broad. Site scope retains the global baseline elsewhere while allowing the targeted routing configuration to differ.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

AOS-10 APs send operating state, radio channel and transmit-power parameters, RF noise/retry indicators, client counts and related performance telemetry to Central. Analytics services aggregate these measurements for RF optimization, health scoring, anomaly detection and troubleshooting. Authentication secrets are not normal monitoring telemetry, and AP reporting is not a replacement for extracting arbitrary upstream router tables. When connectivity to Central is disrupted, APs can continue their currently applied forwarding and RF plans, although cloud-dependent optimizations may be delayed. A useful operational validation is to compare AP-reported RF counters and connectivity status before and after a known interference or availability event. The resulting time-series permits trend diagnosis without copying authentication credentials into the management platform.

DHCP lease information and learned routes can exist elsewhere in the topology but are not the defining AOS-10 AP telemetry category. Secret authentication material is not a routine performance-telemetry feed. Radios report operational metrics used in health and RF decisions.

Official HPE references | AOS-10 Cloud Services • Roaming and the Key Management Service | Study-guide topic: Introduction to AOS-10

Technical explanation

The WLAN security and access configuration defines how unauthenticated clients reach the portal, what redirect URL or hosted portal is used, and how successful authentication changes the user's role. Configure the pre-authentication role so clients can resolve DNS and reach the portal while remaining blocked from protected services. The precise wizard tab differs across Central interface versions, but the captive-portal behavior belongs to the SSID's access/authentication workflow, not merely to a VLAN definition. Validate the redirect on multiple operating systems.

ClearPass may supply identity or guest services, but merely naming its Guest role does not configure HTTP redirection. The Guest security level alone does not replace a captive-portal profile, its pre-authentication rules, or the portal URL.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Central's Key Management Service distributes an authenticated station record to neighboring APs. For supported fast-roaming methods, this can include the Pairwise Master Key or derived 802.11r keys, alongside the client's VLAN, role and authentication state. AirMatch supplies RF-neighbor information used to target synchronization. The destination AP can therefore complete a shortened key exchange without repeating the entire initial 802.1X transaction. The mechanism depends on supported clients and configured roaming behavior; it does not mean that all station keys are indiscriminately replicated throughout the entire enterprise. The initial 802.1X authentication establishes a cached key context; KMS distributes PMK or 802.11r-derived material plus VLAN/role information to neighbors selected using AirMatch adjacency. Clients still perform a four-way exchange during the roam.

Forcing full 802.1X authentication on every roam increases latency, and keys stored only on the old AP provide no fast key material at the new radio. KMS shares cached keying and station context with neighbors, though clients still complete the applicable handshake. The WLAN Security settings control 802.11r and related fast-roaming features; KMS supplies the station record and key material to eligible neighboring APs.

Official HPE references | Roaming and the Key Management Service • AirMatch | Study-guide topic: Introduction to AOS-10

Technical explanation

Application Visibility uses traffic classification, including DPI where supported, to show application families, usage and performance context rather than merely physical neighbors. Filter by site, wired/wireless client, time window and application category to identify misuse or policy-impacting traffic. Compare classified flows with user-role rules, access controls and QoS treatment. Encryption limits the visibility of payload contents, so classification often relies on signatures, protocol characteristics and metadata; it should not be confused with unrestricted decryption of every application session.

A topology diagram does not categorize application flows, and inventory only identifies assets. Application Visibility supplies classified usage information that can be compared with QoS and role-based policies, subject to the available telemetry and DPI capabilities.

Official HPE references | Application Visibility • AOS-10 Cloud Services | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

BPDU Guard is appropriate on edge interfaces that should never receive spanning-tree bridge protocol data units. If somebody connects a downstream switch or another bridge that sends a BPDU, the guard transitions the port to a protected state, limiting a potential topology disturbance. It does not detect every possible loop between ordinary ports when no BPDU is emitted; loop protection or storm control may also be required. Do not enable edge BPDU Guard on legitimate switch-to-switch uplinks.

BPDU Filter suppresses information STP needs, potentially hiding a loop. Root Guard protects bridge-root selection on specified ports, not arbitrary edge patching. BPDU Guard disables an unexpected bridge-facing edge port when a BPDU appears.

Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central